In this video, let's discuss how to use return to Lipsey technique to bypass Anex protection, since
the attack is not executable.
We won't be able to execute Schenkel that we placed on the stack.
So we will have to go with another approach which will execute a command of our choice.
In our case, we want to execute BENCIC and if we can pass this benefits to our function like system,
it will be executed for us.
Now the question is where can we find the function system?
It will be available in the Lipsey library.
Lipsey is loaded into most of the applications and thus even our vulnerable application.
Lord Lipsey now to put it in simple words, our vulnerable application Lord Lipsey Library.
So using the control we have on the stack, we can call system function from Lipsey and we will pass
the string BENCIC as an argument so that businesses will be executed by the system function and we will
get a show before we execute this attack.
Let's understand how system function works.
So we are going to do that by writing a very simple C program.
Let's switch to our virtual machine and let's create a new directory called Return to Lipsey.
I just call it read to Lipsey and it's navigate to this new directorate.
And let's create a simple C program and let's name it system, not C.
Has include a steady lip NorTech.
Int Main and let's close the curly brackets and let's use system function to execute BENCIC so that
we will get a share.
All right, so this is the program.
Now let's compile this using GTC, so I'm just saving the file and let's use Jinksy System, not see
dashboard system.
This is going to be the output file.
There it is.
Looks like we have compiled it.
Now, let's quickly check if regulation by executing this binary.
Look at that.
We got a shell by executing this simple binary with system function.
Now let's exit and let's load this binary in GDP by using GDP space dot slash system and let's disassemble
the main function.
All right.
So if you notice, there is a call to system function here at this address and just before this call
instruction, there is an instruction which makes it pretty clear that something is being saved in order
to register.
You can see that here.
The address from which the data is referenced is shown in the comments here by Julie B..
So let's examine this particular address and see what's there.
So I'm just typing X, slash X and let's copy this address
and let's sit here and look at that.
As we can see here, it is the Venessa string that is being loaded into the idea register just before
the function call to the system.
As mentioned earlier, Intel 64 bit processors past the first argument to the function using the idea
register.
We can also step through these instructions and see what's being placed in the order register at runtime.
So let's type aside, let's type B space so that we can set up a breakpoint at main and let's type and.
Now let's type aside.
Let's type aside once again, one more essay.
Now, if you see this, this instruction is being executed, as you can see here, after executing this
next instruction, something is going to be placed in this idea register.
Right.
So if you check the contents of audio register at this particular point of time, it just contains the
value X one.
So let's type inside.
And let's check the value of ardia once again and look at that, it contains some address which is actually
pointing to this value.
Let's quickly check what this value is.
I'm just copying this and let's open up a new tab and let's type it call and let's use Hex editor.
With that partnership options and look at that, this is the main message string that we have seen earlier,
the string bean message appears in reverse due to the little Indian format used by the Intel processors.
So essentially, we are going to use the same technique when we write down exploit using return to Lipsey
technique, we shall place the argument to the system, function in the idea register and we can override
the same return address with a gadget that pops a value from the top of the stack in Baghdad, the register.
And immediately after that instruction, we will place a pointer to beneath string.
Finally, we will place appointed to the address of system function, which will execute BENCIC because
it is already placed in the order register.
Now let's quickly take a pictorial representation of how our stack is going to look like in OVEREXPLOIT.
As you can see here in this picture, we are going to fill in the Bufford with some junk to start with
until we reach the IP register, which contains the same return address.
And when we reach this saved return address, we are going to override it with a gadget that pops our
value from the top of the stack.
And this value that is being pumped from the top of the stack is going to be a pointer to Binsted string
from Lipsey.
After that, we place a pointer to system function from Lipsey.
So our first object before writing this exploit is to find out the address of system function and the
offset of been a asset string from the Lipsy library.
After placing the pointer to the system on the stack, we will have to override the next six bytes with
a pointer to exit function because once the system function completes its execution, the address of
this exit function becomes the next instruction to be executed.
And we will exit gracefully.
So we will have to find out the addresses of system exit and BENCIC in Lipsey.
So let's start writing this exploit.