In this video, you will learn how to use immunity debugger
to help us find the right component that
we could exploit within our vulnerable
application. I hope you excited. So let's
iPhone in
finding the right module simply allows us to look for a specific
component or a library file such as
a DOT dll file that has no memory protection
within the vulnerable application that we are
targeting.
We can use a Mona module that we have previously copied
into the program files of immunity debugger.
So to get started let's
restart all server on reattacher
to immunity debugger
let's run Vol server as administrator like
so
Next we'll execute immunity bugger
with administrative privileges.
Great now it's time to attach the wall server
application. Let's click on file.
Attach and now let's select the
Vol server process and simply click on
a Dutch this time. We don't need to click on play. We
can simply leave the application in its pause mode.
To see the list of Mona modules. Let us simply enter
a command within immunity
debugger.
Let's do exclamation mark Mona.
Modules like so and hit
enter.
This will show us all of the modules that
is possibly exploitable or
that can be compromised by us.
We are simply looking for something that is associated
with Volvo.
Specifically, let's look in the version column.
For instance, we can see version module name
and path.
We simply need to look for something that belongs to
the wall server application.
If you look closely we can see that this
Particular component which is e SS
f u n c.
Dot dll this is a library file
and notice that each
of these columns shows that it
is false. This means that there is no sort
of memory protection that is applicable to
the ESS F. UNC dot dll
component. This is great.
Now that you have found a vulnerable component within
the application. Let's head over back to Kali
this time. We need to find something called the
opcode or the operation codes that will
simply allow us to jump directly into the
ESP register.
By jumping into the ESP register those will
simply enable us to jump directly to a memory
location in which we can inject our militia Shell
Code that you will learn about in the next video. So let's
head over back to Kali Lennox.
Once you're on your Kali Linux virtual machine simply open the
terminal
we will use a special, Metasploit.
We'll use a special component from Metasploit,
which is called the nazim shell.
To use a Shell. Let's type msf. Like
so Dash and Asm.
Underscore shell and hit enter.
Now we can use this particular component to
Simply allow us to convert Assembly Language
into hex.
Most importantly. We are trying to find the jump
address.
within the registry
let's type g m p
to specify jump and where do we want to jump to the ESP?
That's it. Enter.
create
as you can see it has provided us with ffv4 which
is simply the jump code that
we need.
Now that we have a strong code. Let's head over back
to immunity debugger.
now let's use
the jump code to help us find a specific
memory location.
Let's delete this command.
Let's type exclamation Mona like
so
find
- s
and between our quotation marks, we'll specify the
hex value of FF.
e 4
To do so we'll specify slash X
to represent hexadecimal.
Who specify two characters FF?
Will put a slash X again.
I'll specify the other two characters, which is E4.
After we'll specify Dash M. The
specify the specific vulnerable module,
which is e SS f
u n c dot dll like
so
simply hit enter.
create
As shown on the screen there are nine possible pointers.
Each of these pointers will provide
us or give us the capability
of finding the return address within the
memory when the program is executing.
To put simply we'll need to test each of
these pointers within this column.
However, let's write down the first pointer.
Which is 6 to 5 0.
one one EF
practically speaking in a real situation will need
to write on each of these and test them individually.
before we restart
let's click on this icon.
Which simply allows us to specify a jump
location?
Let's enter the pointer address, which
is 6 to 5 0 1 1 AF
like so and click on Okie.
If you look closely we can see we have found
that particular Point address. We have
seen the hexadecimal value FF E4
and specifies to
jump to the ESP register.
Let's press f2 on our keyboard simply ensure
you select the jump ESP location with
a pointer dress.
And press f2 on your keyboard.
Now you can see the pointer dress is now highlighted.
This will both shows the exact jump ESP
location. Plus it will allow us
to set a breakpoint on this particular
spot.
Once a program reaches here, it will stop executing.
Let's click on play.
Create now, our application is
running.
The Next Step it is to generate our militia
Shell Code and compromise the target
system.
During the course of this video you have learned how to
use immunity debugger to find it vulnerable component such
as an exe or even a
DOT dll file within an application, which will
simply a low us to exploit and compromise
application and also gain access.
In the next video, you will learn how to create malicious Shell
Code to obtain administrator or even
root access on your target system. I hope
this video has been informative for you and I will see you in the
next one.