I'm switching to my washing machine and let's clear the screen and let's first copy everything from
the annex entry.
So I'm just copying from Anex and I'm just copying everything here.
As you can see, we have the vulnerable binary, the vulnerable program, and we have the previously
hidden exploit along with the makefile.
All right.
So we have pretty much everything we have now before we proceed further.
Let's go back to the slides once again and let's remind ourselves that ASALA must be turned off for
this exploit.
So let's turn off ASALA.
The reason we are turning off SLR is we are dealing with how to bypass Anex in this lecture.
In a later lecture, we will discuss how to bypass both Anex and ASALA in one exploit.
Right.
So let's only focus on Anex in this lecture.
So I'm just going back to Asnar directly and let's type disable SLR Dot S.H..
So this script is going to disable SLR for us.
Let's also quickly verify if SLR is disabled.
As you can see, SLR is disabled here.
Now let's once again navigate to return to Lipsy directly.
Now, let's start writing the exploit, let's load the vulnerable binary using Jollibee,
and let's set up a breakpoint at Main.
And let's run it, as mentioned earlier, there are a few things that we want to do here.
We want to find out the address of the system function, and then we want to find out the address of
exit function, followed by the address of message to find out the address of the system function.
We can simply type P space system.
So this is going to be the address of system function from Lipsey.
I'm just copying it here and let's pasted in a notepad.
Remember, this is the absolute address.
We don't have to add it to the seabass.
Now, there is another way to get the same, which is X info system.
This output also shows the same address, which is ending with one B for one zero here.
So getting the address of system function from Lipsey is as easy as that.
All right.
We are done with finding out the address of the system function.
The next one is to find out the address of exit.
We can find it the same way we found the address of system function.
Select Type B space exit.
Here it is.
This is the address of exit function.
So let's copy this and let's face it here
in our notes.
Now, we have gotten the address of system as well as exit.
Now it's time to get the address of business edge from Lipsey.
There are few ways to do this.
The easiest way to find out the address of Binsted String is to use string's command.
So let's open up a new tab.
And let's first make sure that we have Lipsey Library available within our working directly, so I'm
just grabbing the Lipsey Library from here.
I'm just copying the location of Lipsey Library.
And let's copy that into the current.
Now, we have Lipsey in the current directly.
Now we can run string's command against this Lipsey library to find out the offset of BENCIC string.
So before that, let's take a look at the help options with strings.
Come on, let's take a quick look at the help.
We are going to scan the entire file so we can use that for that.
We want the address to be printed in hex format that can be specified using Dashty Space X, which is
going to give us the location of the string in base 16.
So let's type.
Let me first clear the screen and let's take String's Dash A to Space X and let's provide the input
file, which is the Lipsey Library, and let's pipe the output and grep for benefit stream.
There it is.
If you notice, we got the offset that we wanted.
So let's copy this.
We need to add this offset to the Lipsey messages, so let's first place this in our notepad.
This is
vintage offset.
OK, now we need to have the best address of Lipsey so that we can add this offset to that base address
and we can get the absolute address of benefit string in Lipsey Library.
So switching back to my washing machine and let's take a look at the output off the map.
Come on.
Once again.
And if you notice, this is the best address of Lipsy.
So let's copy this.
And let's face it here, Lipsey is.
There is another way to get this business address from Lipsey, that is by using the wrapper.
So let's go back to the virtual machine and type wrapper and let's quickly take a look at the help options.
If you look at this, we can load the file by using Dash F and we can actually specify dash, dash,
string option, which will actually look for the string in all data sections.
So let's use this option and see if we can find out the business offset.
So I'm clearing the screen and I'm typing ropa dash dash file lipsey.
This is where we want to search for the benefit string and let's specify the string
slash bin slash S.H..
Look at that, we have got in the offset once again, let's quickly copy this and let's check if it
is the same value that we have gotten earlier using strings come in.
Yes, it is, these two offsets are the same.
So this is another way of getting string offset from Lipsy.
All right.
Now we have gotten pretty much everything that we wanted except for the gadget that pops our value into
the register idea.
So let's use Ropa to find it out.
I am switching back to my washing machine once again and I'm typing rapper and let's load Lipsey Library.
Now the file is loaded.
We can search for our gadgets.
Such space slash one slash let's type idea because this is the instruction we want in the gadget.
So let's hit enter.
And if you look at this, we have gotten a gadget here with this offset.
I'm going to pick this gadget for now.
I'm going to explain how to pick a specific gadget later when we learn return oriented programming.
But for now, just remember, the gadget has to end with direct instruction.
So I'm just copying this offset.
And.
I'm just placing it here once again and remember, this is also an offset, so to get the actual address
of this gadget, we will have to add this to Lipsey Base.
So now we got everything we needed to start writing overexploit.
So let's switch to our virtual machine and start writing this XPoint.