In this video, you will learn how to determine where the
offset exists and how we could leverage it.
I hope you're excited. So let's dive on
in.
In our previous video you have learned how to perform spiking and
Frozen in this video. We will
take a look at finding the offset value the offset
simply helps us determine where
exactly the crashes actually happen within memory
and we can leverage a control
of the EIP register which is
simply the extended instructions pointer register. We
can use it tool on Kali Lennox, which
is from Metasploit and this tool will allow us
to generate specific patterns. Then we
can use these patterns injected into the
buffer and we could determine way exactly the
crashes actually happen.
So let's get started simply open the terminal
like so and let's use the pattern
create tool from a display.
Then we'll type - common L. And
if you remember in the previous video my
crush actually happened at 6,100 bytes.
Now, let's increase it a
little more so we can get a better idea on
where the crashes actually happening. Let's increase
this to let's say an even
number so I will increase it to 6600 or
6,600.
Simply hit enter.
And as you can see, it generated it long list
of patterns.
Simply copy all the patterns from your
screen.
like so
and now let's open up our fuzz1 python
script.
Let's click on a text editor.
Let's click on file.
Let's click on ub1. I left select or
false one python script.
Great.
We are going to modify this file and let's
create a new version of it. Simply click on file.
Save us.
Let's change the name the false 2.py
like so and click on
Save.
Now, let's modify our script a little bit.
Let's delete line 5.
And let's replace it with offset.
equals
Open quotation marks simply paste your
set value like so.
and close quotation marks
screw it on Photo. Let's remove our y
Loop like so
and let's adjust exception.
Great.
Next let's make some modifications to our
script.
A line 11. Let's replace the with buffer
with offset.
and now
let us remove.
lines 15 online 16 like so
Lastly let's modify our print
command.
Great.
simply click on file
And click on Save excellent.
Let's make first to executable.
simply type chmod
Plus x + 2.pui.
Before we execute a script. Let's restart
all server on our
Windows machine and reattach it
to immunity debugger.
Now let's click on file.
attach
and let's select the volsovo.
process and click on a touch
Lastly let's click on plea.
Great. So the application is running.
I'm going to open Kali Linux, but I'm gonna
sort of scale it down so we can see both Kali
Lennox and Immunity debugger
running at the same time.
Great.
Now, let's execute fuzz2.py. Let's
type Python 3.
First two dot py like so and
hit enter.
And notice the application has pause and
there's an access violation which are good.
This simply means the application has crushed.
Let's be closer tension to the registers.
Notice, the eex register is
filled with ASCII characters strong followed by
/.colon slash and
the patterns of ease.
the ESP register
also contains the ASCII characters which indicates
the patterns also written to the ESP register.
Next look in closer we can see the
EIP register is written with a
value. 386 F
4 3 3 7.
Let's record this value. This value
will be very important for us to help determine whether
or set actually exist within
the patterns.
Let's close immunity debugger like so.
Let's head over back to our Kali Linux virtual machine.
Let's use another module within Metasploit,
which is called pattern offset.rb.
next let's type - common l
followed by
the crash value which we use before which
is 6600.
Followed by Dash common Q common cue
simply allows us the indicate or
specify the EIP value with an EIP
register.
simply enter the EIP value like so
and hit enter
Great. Currently the pattern all said
that RV script indicates the exact match of
where the crash actually happened is at 2003
bytes.
This information is very important to us simply because
it will allow us to control the EIP
register within the valsilver application.
Now that we know the exact match of the
offset, let's attempt to override the EIP register.
The thing is the EIP register. It
is 4 bytes and Link and we
know the offset value is 2003 bytes.
To do this. Let us modify our existent
python script
Let's open the text editor like so.
Let's click on file.
Let's click on ubon.
and select fuzz2.by
On this python script, let's create a
new version of it. Let's click on file.
Save us.
Let's call this fuzz3.py.
and click on Save
great.
Let's make some modifications to all python script.
Our first modification let's delete this entire
or set value on its contents.
Great. Let's create a new variable.
let's call the Shell Code like so
we'll specify equal.
Open quotations Mark a close quotation
marks.
a series 2003
which is where the crash actually happened.
Then we'll add 4 B's so we'll
say Plus.
Open quotation marks place the B
and close the quotation marks.
asterisk 4
so this shell could it will generate two thousand
and three is
and afterwards it will generate four bees.
Next let's modify line 11 where
it says peel loot. Let's change the
word offset to call our new variable shellcode.
like so
once you're all set simply click file.
And let's click on see if great.
Now, let's close our text editor.
And now let's head over back to our terminal.
Let's head over back to our Windows machine.
And run the ball server and reattach
it to immunity debugger and then we'll execute our
new python script.
Next we will click on file.
attach
and we'll select all server process.
And now we'll click on plea.
Great.
I'm going to upon Kali lanox on the side.
like so
and this time I'm going to type chmod.
like so
then I'm going to type Python 3.
phase 3 Dot py
and hit enter
and notice the application has crush on
immunity debugger.
The application pause and we have received an access violation
when executed for to
four to four two four two.
Let's look at a registers once more.
the eax register contains all
these
the EBP register also contains 4
is
simply because e in ASCII is
represented as four one and hexadecimal values.
Looking at the EIP register we can
see 42, which is simply the
B and there are four B's with an EIP
register.
This means we now have control of the
EIP register. The next step
is to simplifying any sort of Bad characters
when we are generating our shell good.
In this video you have learned how to find all set
value.
On in the next video, you will learn how to find Bad characters.
I hope this video has been informative for
you and I will see you in the next one.