All right, everybody, welcome back to Base EXPL Development.
I hope you are excited for our first section of the course, which is exploiting glib HTP Damon.
Sorry, I just had a test run.
Clear.
All right.
So within your course, Pat, you're going to have a file called Live HTP Damon.
Right.
I want you to do GDP, Lyd HTP.
Remember to have GDP.
Petten stalled.
And I want you to run.
Run Dashty irritating.
Now, control be shift, double quote, to break the pain into it, to haves and have a vertical pain
or I mean a horizontal bottom.
I don't want you to do it, see?
Echo pipe, Netcare, Dushanbe, local host.
Eighty, eighty.
Post Space Dollar, sign up to Prentice's.
I can now see.
Let's see, what should I do?
Uh prent a times.
Fourteen hundred.
Press enter.
Control see out of it and you will crash the program, control you to close a bottom pain and take a
look at the VIP registered VIP register says forty one forty one, forty one forty one.
As you can tell, it's translate into four hexadecimal A's right here.
Now, this shows that we have a possibility of controlling E IP.
So in order to find the IP, we need to create a cycle to pattern a site with pattern, which is the
land of fourteen hundred fourteen hundred.
This might take a minute.
All right.
Welcome back.
We have generate our cyclic pattern in about two minutes of waiting, so let's copy all this, starting
with the A's.
Now, here's a trick that I use says Redress.
Just using the castle.
Let's see.
What this?
Run nationally, 80 80.
So after Captain Pace of what's on the bottom, I want you to see environment variable name map, string
map, string equals.
Then I want you to do I post Space Dollar, a map, string height, Netcare in the local host, 80 80.
Remote control see out of it to finish the post and then we can crash the problem again.
Control didn't close a bottom pane and we have IP overwritten with this valley.
Ignore the zero X in the front.
Just take note of the value right here.
My display will take care of the rest.
So let's see.
Just copy and paste this.
M.S..
Pattern officer dash queue for copy paste.
And we have an exact match at offset 1048.
Excellent.
So let's exit this.
It's important to note that while you explain this program, then we need to write the proper IP tables
rules, so let's type IP tables.
Gachet input Dashi GCP does nation import 80 80.
Backslash a commission point localhost.
Dashti a drop.
All right.
Destination.
Dashti.
IP tables, dash input, dash IP GCP, destination four four four four four backslash commission point
Dashti lock host Dashner Drop.
All right.
A, let's restart this program again.
From the bottom.
Let's see.
We're going to print 1048 raise.
Plus BS.
Times four plus sees times.
Fourteen hundred, minus 1048, minus four.
And what do we have here?
Let's see.
Control D. in our IP registers, clearly overwritten before BS.
Not to mention that our E.S.P extensive stack pointer repeats 200 times and has CS.
So this is a very straightforward explain.
I like this.