In this video, you will learn about various spiking
and forcing techniques.
I hope you excited. So let's dive on
in.
To get started with spiking and Frozen. Let's ensure the
Windows Defender Firewall is this evil
and also the Windows Defender antivirus real
time protection?
Simply click on the Windows icon like so click on
settings.
Then select update and security.
next simply click on Windows security
and here you can see the virus and thread protection simply select
it.
next select manage settings
and ensure the real-time protection is off.
Additionally, you can see the firewall on network protections also
disable from our previous video.
Great.
to get started simply open the valve
silver Master Fuller like so
And let's execute the valve server using
administrative privileges.
simply select right click
and select the option to run as administrator.
and simply select run
and also see like yes.
So currently the application is running with administrative
privileges excellent
next let's run immunity debugger
with administrative privileges as well.
simply select
and choose option run as administrator.
Click on yes.
And here we go, we have immunity debugger running
with administrative privileges.
Next we need to attach.
the Vol server Services onto immunity
debugger
to do this simply click on file
select attach
and now we can see a list
of applications that are running on our Windows operating
system.
simply select Volvo like so
and then click on a touch.
Great.
Once the application is attached. It will be pause
automatically with an immunity debugger.
to run the application simply click the play
button like so
another application is running in real time.
Now let's head over to our Kali Lennox
machine.
Great.
simply open the terminal like so
let's start a netcard connection.
To our Target system targets is
some being a Windows 10 virtual
machine.
Firstly let's grab the IP address of
our Windows 10 virtual machine.
simply open the command prompt and type
ipconfig like so
right now all virtual machine. It's 10:30
one 40.
On our cardi long switching machine, let's type and see
- Envy.
followed by the IP address of our Target
system
a 999
simply because wall server listens
automatically on Port 9999.
Hit enter.
And great.
Currently we can see we have established a session
and we have received a welcome Banner that
says welcome to vulnerable civil.
And to help for help, so let's do that.
let's type help like so
all Upper Keys and press enter.
Right now it shows all the commands are accepted
within wall server.
However, we're going to take a look at which of
these commands actually vulnerable so
we can check our time
and you can even check Tron.
Let's type exit.
Create firstly. Let's attempt.
A technique called spiking with spiking it
simply allows us to determine if a
specific component or a command of
an application or a service is vulnerable
simply by sending malformed data
into that specific application.
For instance. There's a lot of commands that are
supported on Fall server. For instance.
We have starts our time L time
ezron E1 Tyrone.
So we will test a few of these on determine whether
we have any sort of security issues
with any of these commands.
We can use a built-in tool called generic sand
TCP to do our spiking.
simply by hitting enter on this command we can see the usage
which says
generics and TCP. We need to
specify an IP address of our Target
the port number.
And we need to create a spike script.
we can skip variable of 0 and
if we enter another zero, it will simply send malformed data
into the application and determine
whether any sort of breakage will actually
occur.
To create our spikescript. Let's open
our text editor like so
our next let's enter the following
commands.
Line 1 will simply really line
line 2 will simply send the r
time command into the valve server
application.
Line 3 will simply send random malformed
data into the application to determine what
a breakage will occur.
So this script will simply allow us to test each
command that is supported on the
wall server, but we are going to try the rtime
command.
to save this simply click on file
Let's click save us.
And we can see that in this same directory.
Let's call this R time.
Dot S P key like
so and now click on Save.
Great, so all script is safe.
Let's close this.
to send this bike across to
Val's River
Let's press up.
To get back our generics and TCP command.
Let's specify the IP address of our
Target system.
like so
that specify
The port number let's specify our
spy script.
followed by two zeros
unident
currently we can see it is sending randomized and
continuous malformed data
into the application.
If we switch back to immunity bugger.
We can see the information has been written across and
it is being received.
Let's head over back to Kali Lennox.
Let's press Ctrl C to stop it.
This application will run continuously for a
few minutes, but it will not detect any sort of breakage because
there are time command is
not vulnerable.
So now let's modify our script.
Let's try Tron instead.
Let's open the text editor once more.
Let's click on file. Let's click click on open.
Let's select the rtime.spk file
and select coupon.
This time let's change the command.
to t r u n Tron like
so
let's click file.
Save us.
And let's call it Tru n
dot spkey like so click on
Save.
Great.
Let's check immunity borrower to the two men.
What are our application is still running or not?
And it is excellent.
So back on to Kali Lennox.
Let's press up a couple of times.
Now, let's change the script that we are going to use
for spiking.
This time it's our tiron or transcript.
We'll put two zeros at end.
and
For you to see this properly. Let me readjust my
windows just a little bit.
Great.
So now we can see Kali Lennox.
I'm gonna also see our immunity
debugger.
Let's press enter.
On Kali Linux and see what happens.
And notice that a
script is continue to run.
but on immunity debugger it pause
application and it is
telling us a security violation has a good
let's stop the script on Kali logs by pressing control
and C.
If you notice on immutable, it says
access violation.
when executed 4 1 4
1 4 1 4 1
furthermore
if we look at the registers, we can
see at the eax register.
the ASCII information shows strong
slash dot coolant slash
on a lot of these
the ESP register also shows is
The EIP register shows 4
1 4 1 4 1 4 1
what does this mean?
Well, let's head over back to Kali.
And we'll open our web browser. Let's switch
hex to ASCII.
Let's click the first link.
Let's enter 41.
414141
great, so we enter
The values we saw on immunity debugger as a
hex value and let's convert it to ASCII.
simply click on convert
so therefore four one is
equal e
and there are four e's.
Let's head over back to immunity debugger.
So we can see that some type of violation actually happen.
I want this happens immunity debugger
pulls the application from running.
Simply because a Tron command we use it
to send a lot of ease into the buffer space
of memory of the valve application.
Also notice on the register.
the E BP which is extended buffer
pointer also contains is
and the EIP the extended instruction pointer
also contains is to
so now let's close immunity debugger.
like so
since application has crushed
the applications no longer running
Now, let's run all silver as administrator.
Next let's run immunity debugger
as administrator.
And next let's attach Vol server
onto immunity debugger.
excellent
simply click play
to run the application in real time with an immunity debugger.
Great. Let's head over back to Kali Lennox.
Now. Let's click on our text
editor like so.
We'll create a python script that will be used to send
fuzzing information into the application.
As you can see it is using Python 3,
it will create a socket but we
are injecting 100 is into the
application.
It will connect to our Target system, which is a Windows
operating system on Port 99999.
And if you recall during the spiking.
We saw the Tron command.
We also saw slash dot cool on slash and
Then followed by the list of ease. However, we'll
be injecting 100 is right
after we are specified trunk command.
Great.
Let's click on file.
Let's click on save as
and let's call this file.
fuzz1.py like so
and click save
greet
Let's open our terminal.
Now that we are save our python script. Let's make it
into an executable.
simply type chmod
like so plus X
fuzz 1.py and
hit enter create.
I'm going to minimize or make my car lyrics
window a little smaller.
So we can observe what is happening on immunity debugger
on our Target system and we
can also observe what is happening on our cardi lungs
virtual machine.
when you are already execute the script simply type
Python 3 like so
we'll type fuzz 1.py and
hit enter.
Great after a few seconds, we have
seen at immunity Boggle has four star application as
shown on the bottom right hand corner, but
on the bottom left corner, we can
see there's an access violation.
If we look at the eax register,
we can see the ASCII characters that
send the Tron command followed by the
special characters and then a lot
of ease.
Now let's head over back to Carly quickly.
Let's press Ctrl + C to stop the script.
And notice it says a crush has happened at 600.
On your system you might have a different value but this
values really important. So let's take note
of it because we will need this value in the
tombling to offset. So let's
record the value before closing of
this prompt.
During this video you have learned how to use spiking and
you have also understand the need for performing fuzzing.
In the next video, you will learn how to determine anyone
discover the offset value. I hope
this video has been informative for you and I will see you
in the next one.