In this video, you will learn how to use immunity debugger
with the monoscript to find Bad characters
in your code.
Before we generate shell cool to exploit
the vulnerable application or the software. It's important
to discover if there are any bad characters
simply because one generating
Shell Code good and bad characters are created
automatically. However, we can use the immunity
Boggle with the monoscript to help
us find Bad characters.
firstly let's head over to this PC like so
let's open the local disk and create a monofolder
as shown here with this
monofolder. It's currently empty.
next let's execute the wall
server application like so
great.
Now, let's run immunity debugger.
And let's attach the valve process onto immunity
debugger.
Great this time. We are not going to click on Play. We
are simply leaving the application on pause.
Now we can use the monoscript to help us generate
or find Bad characters within this
particular application.
to do this
Let's type. Our commands in this column on the
bottom left hand corner of immunity debugger.
Let's put exclamation mark like so
Mona
space
followed by the command called config like so
Dash SED
space working Fuller
space
c
colon
slash
Mona like so
hit enter.
Great.
This command simply says any configurations
that we are going to do. Let's store it
within the monofolder within our C drive.
Next to generate all bad characters. Let's delete
this command like so
let's use a new set. Let's do exclamation Mona.
Let's specify byte re
like so
followed by a space with -
common c p b
then we'll tell Mona to exclude all
the zeros Force simply because
zeros are bad characters. Well specifically zero
zero to do this. We'll specify
open quotations like so slash
x 0 0
close quotations unident
and as you can see, it has generated or bad
character code for us.
To change our view let's click on see.
Great.
Let's verify if all bad characters are created.
Let's settle back to our
File Explorer
let's click on this PC.
Let's click on our C drive and let's
click on Mona and greet. Now. We
have a text file called battery. Let's open it.
And here you can see our list of Bad characters
is generated already for us. Excellent.
Now let us close immunity debugger.
like so
let us rerun all silver application.
Next let us run immunity debugger and
reattach all silver obligation on
to immunity.
Let's click on play.
Great.
Before we head over to our Kali Lennox virtual machine,
let us copy or barred characters.
simply highlight all of these like so
right click and copy create
Let's head over now to Kali.
On Kali Lennox. Let us modify
our previous python script.
To do this. Let's click on the text
editor.
Let's click on file.
Let's click on ubon.
and let's select fuzz3.py like so
I'll click on ubon.
Great.
Firstly let's click on file.
Save us. Let's call this
fuzz4.py.
and see if
now let's modify.
Let's delete line 5.
and let's call a new variable but
character Bob Char for short
let's put an equal sign.
Open Rockets.
And let's piece.
Our bad characters that we have copied.
from the monoscript
That's right. Click.
and select piece
Lastly let's close brackets.
excellent
So currently we can see all our Bad characters
Are being specified?
With a new variable called bad char.
excellent
Let's rewrite a new variable called shell
good like so.
Let's specify.
2003 is
which is our offset value like so
let's also add Four B's.
like so
let's add our bar chart
variable at the end.
Great.
So the purpose of the script?
Is it will make a connection to the application
that is running on our Target Windows
machine on Port 9999.
The payload will execute Tron.
Followed by these special characters followed by
or shalcode. Our shellcode will
consist of 2000 and 3 is
Followed by four bees and all
bad characters which are these across here?
Let's click on file.
Let's click on Save and we can close this window.
excellent
now let's make
fuzz4.py executable
Let's do chmod.
Let's specify plus X.
fuzz for the py and hit enter
Let's head over back to all Windows machine.
And currently we can see that immediately buggers
running and wall silver.exe application
is running as well.
When you're ready, let's execute our new
script.
Let's say Python 3.
First 4.py and hit enter.
And notice with any second or two. The application
has crashed.
As shown on the bottom left hand corner the access
violation.
message occurred
Let's be a little more closer tension to the
actual registers.
Once again, we can see the eex register.
Is written with ease?
the EBP register is also
written with four is
The EIP register it is written with Four
B's.
To find a bad characters within our
code or return our script.
We can simply select the hex dump or
we could observe the values in the hex dump.
To be specific. Let's select the ESP register
like so
let's right click on it.
And now let us select follow in dump.
Currently if we look at a hex dumb values
for the ESP register. We
can look for any sort of characters. That
seems to be out of
place.
For example good characters have a
proper sequence such as 0 1 0 2
0 3 0 4 0
5.
A bad character is simply character that does not
fill or does not belong in sequence. If you
recall we have excluded the
zero zero characters, so we will not see those.
This process is sometime a bit time-consuming.
Simply because we have to manually go through the
hex dump section of immunity debugger
and check for any sort of Bad characters.
Simply because you need to identify each and every
and all bad characters within the
hex dump whenever performing any sort of
buffer overflow. So any application
once you have identified them you will then need to write down
all of these bad characters simply because
we need to take note of it when creating our
Shell Code.
So now that you have learned how to find Bad characters the next
step is to find the right module.
Order I component within our
vulnerable application to be exploited.
During the course of this video you have learned how to find Bad characters
so that you can exclude them when generating your
shellcode.
In the next video, you will learn how to find the right module or
the right component within the vulnerable application
that could be exploited. I hope
this video has been informative for you and I will see you in the
next one.