In this video, you will learn how to create malicious shellcode for
root access. I hope you're excited.
So let's dive on in.
Our previous video we will be able to discover the point
address that will allow us to jump to the EIP
register.
So now let's test to see what this is working
for us.
Let's run fall silver like so
with administrative privileges
next let's run immunity debugger with
administrator privileges and then
we will attach the valve application inside of
immunity.
Let's click on file.
attach
select a valuable processo application and select
attach
Before you click on Play click on this icon
like so and simply enter
the pointer address, which we have found in our previous
video like so and click on
Okie.
As you can see the pointer dress followed
by the hexadecimal value specifies that
it will jump us to the ESP register.
Simply press f2 to set a breakpoint
create.
Now the breakpoint is set. Let's head over
back to our cardi lungs virtual machine to modify
our script.
Let's click on the text editor.
Let's click on file. Let's click
on open.
And let's select fuzzle.py like
so click on one.
Great.
Let's click on file.
Save us. Let's call this first 5.py.
And save it.
let's delete our bad character variable
like so
I'll let some modify our Shell Code variable.
We are keeping all of our ease like so
however, we are going to insert.
Our pointer dress. However, we need
to insert our pointer dress in the reverse order.
To do this. We'll open and close quotation marks.
between these quotation marks, we will simply
insert
slash X
AF slash X
1 1 / X
50 / X
62
last one at least we will bite and code
our ease manually like so
will also bite in code.
our pointer dress
will byte and code our payload.
And we will remove the encoding feature from
line 13.
like so
simply click on file
And click on Save great.
Let's head over back to immunity.
Let's close.
Let's meet us on executable.
We'll call this.
files 5.py
create
back on immunity debugger. Let's click on play.
Now our application is running.
Let's open Kali Linux.
And let's execute the fuzz 5.py script.
We'll type python.
fuzz5.py and hit
enter
Oh, I forgot to click play on immunity debugger.
Let me restart alsoever like so
I'll reattach it to immunity debugger.
I will set the breakpoint once more.
And I'm going to click on play.
create
one Kali Lennox. I'm going to execute a false
5 python script once more.
And notice the breakpoint has reached the
application has post.
Looking closely at the
register we can see the pointer address
is now inserted within the EIP register.
And it also indicated.
the ESS funk
Great.
So this means that we are able to actually overwrite
to the EIP register.
The next step is simply to generate a
shell code on takeover the Windows
operating system and gain root or
administrative privileges.
So let's close immunity debugger. Let's head
over back to our Kali Lux virtual machine.
like so
and this time we are going to generate a Shell Code
using msf Venom.
Let's type. Msf. Venom like so
we'll type - p
let's specify.
the windows shell underscore reverse
underscore TCP
will also specify our lhost IP address.
like so
followed by our port number that we listen
for an incoming connection.
We will also specify the exit function which
is red.
The output format I see.
the architecture for x86
and dash be will specify any bad characters.
once you all set
Simply hit enter. This will take a few seconds and
generate the shell good for us.
Not a shell could generated simply copy all the
shell good like so.
Great.
Let's open our text editor.
Let's open our most recent fuzz file.
Which is fuzz 5.py.
Let's create a new copy of it.
Let's call this file 6.
Let's click on save as
let's call it file 6.pui.
click on Save
create
with this grip
Let's insert a new variable.
Let's call this overflow like so.
equals
Let's Open brackets and close
brackets between these brackets will piece our
shell good like so
then we'll manually byton code each line.
Great. So now that each line of the
Overflow is actually manually byte encoded. Let's
modify our Shell Code variable.
Our ears are still biting coded.
The pointer dresses byte encoded as well.
But let's add in some potting manually.
Let's type slash X 90. Let's
ensued. Let's say about 16
of these.
We'll also tighten code or padding.
The padding is simply no operations. It's simply
adds on some space before we can
actually inject overflow.
To specify all overflow. Let's put plus overflow
to call the variable.
Once you're all set simply click on file.
and see if
let's close this.
Great.
Let's make five six executable. We'll
do chmod.
Plus X Plus 6.py. Excellent
One of the problems I had was every time
I generated a new set of Shell Code using the same
msf. And I'm command.
The Shell Code the output was a bit
different for some reason. I was not able to actually get
the review shell. I'm not sure why but if
you regenerate
The shell called multiple times you'll see that you are
getting different iterations of visions of it.
However, after a few tries, I was
able to get a version that works very well for me.
If I open the text editor
this is evolutional shell who that works
perfectly on my system.
So if you don't get it on a first try you might have to
generate a Shell Code a few times and try different
versions.
As you can see the Shell Code it
is still place within the Overflow.
On each line is byte included.
That's the only difference from the previous school that
I have executed just a few seconds ago.
With a previous code we used the same syntax, but
it did not work. However, I regenerated a
few more and this one actually works for me.
So I'm going to click on file.
I'm gonna click on Save.
next
I'm going to start.
the net cutlets now once more
I'm gonna type NC -nlvp.
for for
Hit enter.
I'm also going to open a new tab.
So I can execute the python
6 fuzzgrip, but before
I do so, I'm gonna head over to my Windows machine.
I'm going to launch the valve application. Azus.
create
gonna head over back to khalila Knox.
and currently
we can see the net cut listener is listening for
an incoming connection.
and now I'm going to execute the Python 3
fuzz6.py command
like so
the script executed
and on a Windows machine it shows waiting for
client connection. Let's check our net
card listener.
And look at this. We actually have a reverse connection
that is originating from our Windows
machine back on to Kali.
And currently we have access to
the windows terminal.
If I type who am I?
We can see.
I am running as the user.
if I type dir
I could view the directory listing for this
folder.
So currently we have keen review shell
within the system
During the course of this video you have little to generate militia
shulk Hood using msf. Venom and create
a p-lude to compromise a vulnerable application
that is running on a Target system.
In the next video, we'll be starting the introduction of section
6. I hope this video has been informative
for you and thank you for watching.