Now, let's move on to execution called the goal of this court is to give us benefits when it is run
for this, we are going to use Xixi system.
So according to our seven step process, the first thing that we are going to do is to write a very
simple SI program, which gives us a shell.
So let's switch to our virtual machine and do that.
So I'm inside that electrical cord.
Let's create a new directorate card.
Exactly.
And let's navigate to exactly directory.
And here let's create a new file and let's call it Shinda C.
Has include a studio, NorTech.
Let's type in Maine and let's simply write a system function with BENCIC as its argument.
There it is.
Now, let's compile this program using GCSE, so I'm just using DCC Sherazi, National Chef.
Now let's execute this output file, which is Shell.
And there it is.
As you can notice, we got a shell.
So this program is good enough to get as a shell.
Now, let's stress this file and understand the underlying this cause.
If you remember our seven step process, that's the next step.
There it is.
We want to use Astreus against the compiler program so we can understand what these cards are used in
this program.
Let's exit from the show and let's type Astreus Bash Haertsch to see the health options.
Filtering and tracing are the two options that we are interested in.
If you see the filtering section, we have a flag, which is that to to actually specify an expression
similarly and a tracing we have F using, which we can follow Fox.
So Neshev and Nasheet are the options that we are going to use here.
So let me clear the screen and stress the F to follow the Fox Nasheet to specify an expression.
In this case, I want to specify exactly because those are the scores that we want to track and not
show, as you can notice, in the output.
There is an executive function being invoked.
What we are interested in is the first one, which is the full part of the binary that we want to execute.
Now let's take a look at the main page of Xixi.
I'm typing exit and let's type man to exit the.
If you look at this, as we have seen earlier, there are three arguments.
The first one is filename, the second one is an error and the third one is also an error.
The last two values can be made null to start with and we can just pass a pointer to the string bencic
into the first argument.
Essentially in our assembly program we are going to place the second number of exactly in order X register
and appointed to the full part of business, which goes into Oduye register.
And then we will place null in autosite and we will place another null in at the X register.
One important thing that we need to remember here is this is a file name and it should end with a null
terminated so our benefits should terminate with null terminated.
So let's keep that in mind.
With that, let's begin to write this execution code first.
Let's quit this and let's copy our exit the normal, not Nazeem into the current directory and let's
use that as a template.
So I'm just moving this file exit National Guard Nazim to exactly dot don't.
Let's clear all these instructions so we can write from the scratch.
All right.
So I'm just not going to delete anything else.
Let's quickly save this file and let's find out the Cisco number for Xigris, this call.
So I'm just typing cat user include
X eighty six, underscore sixty four, dash Linux no slash hsm slash uni stilly underscore sixty four
Nadege.
And let's grab for exactly
where it is.
Now if you notice this is called number four.
Xixi is fifty nine.
Now that we have got in the second number, let's go to our plan of how we want to write this shell
code.
Here it is.
Obviously the Cisco number goes into the register IREX, so we will have to place the value fifty nine
into X which is actually zero three be in hex.
Next we will have to place a pointer to null terminated string into the register.
Ardai this can be done by pushing this string onto the stack and placing the value of Arizpe into idea
because Arizpe is actually pointing to this Benetta string which is null terminated.
So Arizpe holds a pointer to benefit string so we can simply copy this Arizpe into ardia.
And that sets up our first argument.
As I mentioned earlier, the second and third arguments are going to be null values.
So we are going to place a null in the Odyssey register as well as at the X register.
Just to reiterate, Binsted should be followed by a null terminated.
So the approach we are going to use here is to.
And onto the stack first, as you can see here, and after that, we are going to push Minnesota String
onto the stack in reverse order.
If you see hitch slash and I.B. slash slash, so that's the order will have to push.
So it will become slash, slash, bean slash S.H. after the push is complete.
Once that is done, we will move Arizpe into another gister so that we will have a pointer to business
with another Terminator into our desire to do this.
We are going to convert all of these characters into their Heggs equivalents.
One way to do that is to use an online service.
So I'm going to use an online ASCII to hex converter.
Here is one.
We can use this ASCII to hex code converter and as I mentioned earlier, we will have to place the string
in reverse order.
So and a B slash slash.
If you notice, we used to slashes after this Nabby string, that is to avoid STAC alignment issues
later.
So let's convert this and copied and pasted in notepad and let's also note down our call number.
And let's write our shall code, let's once again open our execrated a.m. Let's begin by clearing the
attics register, using a guide instruction.
So I'm just typing za oryx, comma, oryx and let's use move RDX, comma IREX and move Oddisee, comma
RDX.
What these two instructions are going to do is the first instruction, which is more RDX, comma RDX
is going to set up null value for our argument trip.
So we are using null for argument here using this more RDX comma Addicks because Artex becomes zero
here and we are just moving that zero into add the register.
If you remember, RBI holds the first argument, Odissi holds the second argument and RDX holds the
third argument.
So we are using this instruction to place this null value in vehicles.
Now that RDX contains the value of zero, we are just copying that into RSA register as well.
So it will set up our argument to.
So out of three arguments for Xixi, we have already set up two arguments.
So we are only left with the first argument, which is appointer to benefit stream.
So let's set it up now.
Let's use Push IREX.
This is because we will have to end our bayonetted string with the null Terminator and currently RSX
contains a null value, so we are just pushing it onto the stack and then let's use move some register
to hold our string message which is here.
So I'm just going to use sixty eight.
Seventy three to have sixty six, nine, six to twelve and twelve.
So let's just use zero X and this value.
So this is going to contain the benefit string in reverse order.
Now what we want to do is we just want to push this value.
So let's use push arbi x so it is going to be pushed onto the stack once this is done.
Arizpe contains a pointer to this string.
So all we have to do is we will have to put that into Oduye register.
So let's use move ardia Qamar Oriskany.
That's it.
Once that is done we can just type Siskel.
But if you remember when you executed this instruction Siskel, it is going to execute this is called
which is specified in ATX Register in this case.
Currently Arrigo's contains zero so let's move.
Our Xigris is called second number into Attic's so I'm just using more irex comma fifty nine so this
should do it.
Let's save the file, let's assemble and link it using Nazan and Aldy respectively.
So Nazem exequatur nazem yashpal exec we dot o f l sixty four.
Now let's use a link to link it exactly.
EG oh dashboard exec we hit enter.
Now let's quickly verify if it has any bytes in the machine code.
Some is going to use for bija dump Daschle.
Xixi dash for internal syntax.
If you notice this machine code we have three null bytes here.
If you remember I have discussed some techniques to avoid null bytes so we can just use one of them
to avoid these null bytes instead of using our more instruction we can use.
Add let's save it once again, assemble it, link it and let's quickly check if we still have animal
bites.
Look at that.
All our null bikes are now cleared.
Now, the next step is to check if the binary is working.
So Lipsius not exactly.
If everything goes well, we should get a show there.
Go now to be able to use this shell code in our exploits, we will have to extract the shell code from
this binary.
So one way to do that is to copy all these bytes one by one.
But as I mentioned earlier, we can use some Linux kung fu.
To extract the usable Shenkar.
So let's use this first link once again, like we did earlier, and let's just copy this.
And let's come back here, exit from this shell, let's start and let's just replace this program with
our Xixi.
There it is now, if you notice, this is going to be our final call, so from here onwards we can use
this Shenkar in all our exploits.
Let's quickly check if this Schenkel is working or not using one of our previously written exploits.
I'm going to use the jump to exploit that we have written earlier.
So let's open up a new tab.
And let's first make sure that SLR is disabled.
So no visible SLR, not essential.
No, let's quickly check.
There it is, a salary is now disabled.
Now let's go back to our SHALL code directly.
Let's go to exequatur directly and let's copy.
The exploit from jump out eggs into the cut the rectory,
so exploit the final thought pill is what we had written earlier.
This is the exploit and this was the same code that we have taken from the Internet.
So we are going to replace this code with the shell code that we have just written.
So let's use them, exploit the final RPN and let's cut it out
and let's use this one.
There it is, if everything goes fine, this exploit should work, even with this shell called celeb's
type exploit Basche final not cat.
Dargavel.
Looks like there is a segmentation fault, I have already tested this.
The reason for this segmentation fault is the shell cord.
What happened was when we used this one liner, it missed one bite from our actual shell cord that was
supposed to be extracted.
So let's quickly use Ovidio dump once again.
And if you compare the shell cord and the bite that you see here, there is one bite missing in the
shell cord.
That is after 62.
We have 69, nine, six, eight, 12.
But if you closely examine the shell cord after 62, we have 69 and 12 and this six is missing.
So to be able to identify these kind of issues, we will have to always do some double checking and
we have to do a bit of debugging in GDP.
So how do we fix this?
One way is to simply companies and add it here after 69.
Another way, if you don't want to do that, is to use another command.
So I have just found another one which appears to be working fine.
So I'm just copying this here.
And let's go back to this once again and let's replace this binary with our exec.
We let it enter.
And this time, if you notice, after 69, we have 60.
That means our shell code is properly extracted.
So let's copy this and let's go back to our exploit and let's edit it once again.
And let's start, you shall court,
and if everything goes fine this time, next slide should work.
So let's quickly check that.
Look at that, that exploit finally worked.
This is how we can create our own channel code and we can use that in the exploit that we are writing,
this completes a full cycle of writing, simple stack based buffer overflow exploit, even by writing
your own shell code.
So that's the end of this video.
See you in the next one.