So far, we have discussed a few different techniques to execute our shell called using stack based
buffer overflow vulnerabilities.
Now let's discuss another technique called jump arizpe.
This is a rather common technique and a lot of articles and blogs on the Internet show this technique
in general when they talk about stack based buffer overflow attacks.
Let's create a new directory called Jump Dash Arizpe
and let's navigate their.
Let's copy the vulnerable binary and.
Let's copy the vulnerable binary and the latest working exploit from the jump attacks directly into
the current director.
So I'm just copying jump dash attacks.
Let's copy everything into the current military and we should have all of them.
As you can see, we have all the files in the current directorate.
Now, let's take a copy of this exploit and let's save it as exploit one dot here and let's edit this
file.
And let's remove all the things that we don't need.
Let's remove the lobster shall code and let's also remove the slime and let's make it junk equals two
hundred and fifty six days.
And we have a base to override our BP.
And let's use six BS to override our IP.
And let's use some more junk to fill in, so I'm just adding eight six.
Similarly, I'm just appending eight beest.
Let's also append eight E!
And finally, I'm just appending eight F's.
All right, so let's just remove this last line and let's also remove this line and let's just print
junk.
That's it.
Now we are going to start working on the exploit once again, as usual, and first going to create our
payload file using this exploit.
So I'm just saving the file.
And let's use exploit one dot pill and let's produce a payload card.
Payload one.
All right.
Now let's use gdb dot slash vulnerable and let's use Breakpoint at Main.
And let's also do this as well.
And it's quite fun.
And let's set up a great point at the right address.
And let's run the program by passing our payload as input.
I'm just hitting enter the first break point, which is that Maine is hit.
Let's continue.
If you see there is another breakpoint, which is at the instruction of one function, we are about
to return to the calling function.
So before doing that, let's just print out the stack.
I'm using X, slash 50 X and Arizpe.
If you look at this output, this is the state of the stack just before the crash, starting from Arizpe,
we have six B's which are going to be pumped into our once the next instruction is executed and the
next eight bytes will become the top of the stack and those arizpe will be pointing to these CS after
that instruction is executed.
What it means is anything that is coming after these six beams will be pointed by ADP at the time of
the crash.
So we can also use this space to place our Chalco.
We have only used a few CS followed by D, E and FS.
So instead of these characters we can actually place Chalco here.
If you remember earlier we placed a shell called before the same return pointer.
The technique we have used is really helpful if we don't have enough space after RHP, there may be
cases where you don't have enough space to place the shell code in the address where Arizpe is pointing
to.
But in this case, it doesn't seem to be the case.
Let's try to place the Schenkel here instead of placing it in the beginning of the buffer, which is
being pointed by the ATX register.
Now, this is the idea behind this jump arizpe technique.
We will place the shell called immediately after the ATP value and then we will place the address of
jump arizpe in the ATP value and thus it will directly jump onto the shell cord which is placed here.
Now let's take a look at a pictorial representation of this so you can better understand what we are
talking about.
Now, we have filled in the initial buffer with some junk until we reach our IP register and then we
are going to override this saved return address with jump arizpe address, which in turn will point
to the shell cord that's going to be placed here.
If we have more buffer left, we can place some junk here.
And then if not, we can leave it right after placing our complete call, we are only worried about
the space for the shell cord.
So let's go ahead and try to create this exploit.