Well, in this video, let's try to understand what is next.
Let's first navigate to our working directly.
I'm currently inside 686 and escort 64 and let's create a new directory called Anex and let's navigate
there to annex the rectory.
Now let's copy the vulnerable binary and the makefile from our jump Artex exploit directly.
So I'm just copying them from
jump out the directly.
Let's copy the Makefile and place it in the current directory.
Let's also copy the vulnerable C file and place it in the current directory.
There it is.
Now we have everything we need in the current directorate.
Now let's take a look at the contents of the Makefile.
So these are the kinds of makefile, this is the same old makefile that we have used earlier with the
option dash the execs stack.
Let me show you what this option actually does to our binary.
Let's use the combined make to compile this program and let's use gdb dot slash vulnerable.
And let's run check sake and hit enter this check comes with Jeff, and if you look at this, Anex is
not enabled and this what happens is Stack becomes executable.
Let's quickly check that.
I'm going to put a break point in the beginning of this program, which is main.
Now, let's run the program so it will hit the breakpoint.
As you can see, the program is paused because of the breakpoint.
Now let's take the command with a map.
So we are seeing the memory map of this current process.
And if you see it has an entry for Stack, if you don't want to view the entire memory map and if you
just want to check the stack entry only, you can just specify that using the map space stack command.
There it is.
Now, if you see this entry, the stack is having RW permissions, which means the stack is currently
executable.
This is what enables us to place the shell code on the stack and execute it.
Now let's go this great recession.
Let's copy the outtakes exploit into the current directly.
Here it is now.
Let's quickly make sure that SLR is disabled.
Let's type Suto, disable SLR, DOD assets, and let's quickly verify if it is disabled, that it is
SLR is disabled.
Now let's go back to the previous tab.
Now let's quickly test it.
This exploit is working fine.
Exploit final dogpile cat and let's pipe it to the vulnerable program.
There it is.
The exploit is working fine.
Now let's quit the shell and let's remove the binary from this current directly.
All right.
And let's quickly make some changes to the makefile.
I'm going to remove this and dash the TAC option from this makefile.
So let's just quickly remove this.
OK, so let's save the file and let's compile this program once again by using the command make, this
should produce a new legible binary.
Here it is.
Now, let's quickly test if the jump are exploited steelworks.
Here is the command that we used earlier.
Now let's get another
look at that, the exploit that just what is now failing after recompiling the program by disabling
the option, dash the exit stack.
Let's go ahead and see what happened with this binary using.
I'm just typing GDP DOT 111.
Let's clear the screen so we can view the screen better.
Now, let's type check once again.
And if you notice, we are seeing a different output this time.
Index is enabled like we did earlier.
Let's set up a breakpoint at Main and let's type run and let's type the map stack and look at that flag.
X's missing from the permissions.
That means the stack is not executable anymore.
And Overexploit is trying to place the shell code on the stack and it is trying to execute the shell
code in a non executable space.
So this is what is causing the problem to our exploit.
In the next video, we are going to see a technique called Return to Lipsey, which will bypass this
limitation to give us a shell.
But in later videos, we are also going to see how to use a return oriented programming to actually
enable this executable flag on the stack.
And eventually we will execute our shell code on the stack, even when an expert is enabled.
I hope you understand how Anex works.
See you in the next video where we are going to discuss a return to Lipsey Technik.