Well, let's start riding, jump out, be exploited.
Let's first take a look at our days of exploitation and once again, this was the file we used in the
last video.
Now we don't need it anymore.
So let's take a copy of the final exploit that we have copied earlier, which is Exploit Basche final
appeal and let's save it as exploit to that pier.
And now let's open exploit to the art here and.
Let's use two hundred and fifty six days here.
We are not placing the shell cord and knob's in the beginning of our buffer anymore, so we will just
fill in the entire buffer in the beginning with is some displacing.
Two hundred and fifty six is in the beginning of our buffer.
After this we are writing eight BS, followed by the odd IP address.
So as per our original idea, this address is going to be an address of jump arizpe instruction.
So let's keep it as is for now and let's go ahead and find out jump out as we address.
So we will have to find out the address of jump arizpe in our binary using wrapper.
So I'm just saying this file and let's open wrapper and let's use file vulnerable and let's search for
jump arizpe entrance search slash one jump Arizpe.
Looks like there are no gadgets found with this instruction.
Let's increase the depth.
No, look, let's remove this depth so it will try to find out gadgets at all the depths.
So I'm just removing this and let it enter once again.
We are once again out of luck.
We do not have any gadgets containing the instruction arizpe within our binary.
So another option would be to look for call arizpe instruction, which can also do our job.
So let's search for Carl Arizpe instruction.
I'm searching for Carl Arizpe.
Unfortunately, we did not find any gadgets, even with Carl Arizpe instruction.
This doesn't mean we are out of options.
We can search for these instructions in the Lipsey library.
Let's load the vulnerable binary using GDB.
And let's get the location of the Lipsey Library so that we can copy it and search for gadget's, so
I'm just using Breakpoint at me and I just run the program and the breakpoint is hit admen.
Now, let's type the map.
And if you notice this output, this is the location of Lipsy.
Another way to get this is to type the map.
Lipsey, look at that.
This has also, Lawder, the full path to the Lipsey library.
So I'm just copying this.
And let's quit and let's copy this Lipsey Library into our current director.
Now let's use a proper file, Lipsey.
And this is going to load all the gadgets from this Lipsey library for us, Lipsey almost always contains
the gadgets.
Right.
So let's search for jump Arizpe once again.
Unfortunately, we do not have any jump arizpe instructions, even within Lipsey.
So, as I mentioned earlier, we can also search for Carl Arizpe instructions.
So let's do that.
Let's replace jump with the we found one gadget with Carl Arizpe and this is the offset.
If you remember, I mentioned that offset must be added to the base atrous when we get gadgets outside
the battery.
So we are going to add this offset to the base address of Lipsey.
So it gets us the actual address of this call Arizpe Instruction.
Now let's go back and get the basic rules of Lipsey from the AMAP output and let's update the exploit.
So let's first copy this.
And let's pasted in a notepad.
Go back to what your machine and let's look at the binary once again using GDB.
Let's set up a great point at Main, let's run it and let's get the best address of Lipsey.
Here it is.
This is the best interests of Lipsey.
So let's copy this and let's start here once again.
So this address plus this becomes the actual address of Carl Arizpe, right?
So what we can do is we can let people do this calculation for us.
So let's just copy this like this and let's go back to our exploit.
And let's just replace this address with the base address plus offset.
All right, so this should come to the absolute address of the gadget we were looking for when we printed
this payload.
We should not print this junk and then I'd rather we should keep it in the beginning because we want
these knobs and Chilcote to be at the end after overwriting the safe return address.
So let's use junk in the beginning, followed by knobs and followed by the shell cord
on it.
So that should fix overexploit.
So let's save this file and let's try to run this exploit and see if it works.
Exploited to that.
People can't.
Let's pipe it to the vulnerable binary.
They exploit fail.
Let's quickly check if ancillaries enabled, because for this exploit to work as a SLR should be disabled.
So let's open up a new tab and let's navigate to Isela directly.
And let's check if he's anybody there, it is a reasonable probably that's the reason our exploit failed.
So let's quickly disable ASALA and let's once again verify.
As you can see now, we have disabled SLR.
Let's go back to this previous tab and let's try to run this exploit once again.
Look at that exploit.
Look now let's open it up in GDP and examine what happened, right.
So let's first produce our payload using exploit to that point.
Let's say it as a payload to let's use Judy Bédard, slash one level and let's use this as one.
Let's call func and let's copy this to set up a breakpoint.
So I'm just copying this Endris of the instruction and I'm just setting up a breakpoint here.
Now, let's run the binary by passing this payload to as inputted.
And as you can see here, we have hit the breakpoint and we're about to execute this read instruction.
Odyssey is now currently pointing to the address of Col Arizpe.
You can see that here Arizpe is pointing to the address of Col Arizpe.
If you remember, this is the address we have gotten from Lipsey.
We are just overwriting the same return address.
So once this gets executed, this becomes RHP, which is basically called Arizpe.
Now, if you examine the stack right after this, you should see the Nazli followed by our Shenkar.
Now let's go back to our exploit and check the code just to confirm that this is our shell code.
OK, so I'm just going back to the next BAB.
And let's quickly take a look at exploit to dog here, if you see this version called starts with three
one six zero four eight.
And if you see this, it is three one six zero four eight.
So that's the shell code.
But let's check if the complete shall code is copied onto the stack.
We can do that by examining the complete stack.
So I'm just using X slash 50 Arizpe.
If you see this, this is where our shell code is starting 31 C zero forty eight, B, B, D one.
Let's check the bytes that are at the end.
It's zero F zero five.
If you see this three zero five zero five, so the complete code is placed on this stack, if we do
a single step, the bobsled will be on the top of the stack.
So let's do a single step here.
And if you see the nevzlin is at the top of the stack and the next instruction to be executed is called
Arizpe.
So once we execute this call Arizpe instruction, the execution control will be transferred to this
code and eventually the shall code will be executed.
And after the code gets executed, we are going to get a benefit show.
And that completes our Jump RSP technique.
As I mentioned earlier, this is a technique that's commonly used when we have space on the stack right
after overwriting the same return address.
This brings us to an end of basic stack based buffer overflow.
If you remember, we disable all the protections and then we have written these exploits.
If you enable Anex and Asla, these exploits will fail.
We have also used a shell code that's taken from the Internet in the next few modules.
Let's also fix that by writing our own code from scratch.