All right, everybody, welcome back to exploit development class.
And in our first section, we're going to be exploring live FDP.
Damon 1.2 And I want to show you something where we now created a proof of concept called First Try.
We're not going to be using bash commands anymore.
This would be too cumbersome.
So what we're doing is we're writing our own payload into our local directory payload, our text.
We're in a pen opposed to it.
Where to send in 1048 A's for bees and 1000 minus fourth 1400 -1048 minus four sees.
We're good.
Then going to send the payload into our listening service and let's see that it actually works.
So gdb training run esp 80 python four strike control set exit the crashes.
Analyze the crash.
We are controlling IP.
Perfect.
All right.
So now we're going to try to find a jump to ESP instruction because note that the ISP let's close the
bottom when took note that the ESP extended stack pointer is showing a pattern of see therapy's 200
times.
As well as overflowing in these sections right here.
So it is possible that we can actually set in reverse shell, which actually are longer than bind shells
and see if we can have that run.
So this is a remastering my class basically to make a better quality class.
And we're going to let's see.
First we need to find a jump USB obstruction.
So jump call.
And our first jump ISP instruction is right here.
Control shift.
See to copy that.
Q to quit Nano first tried it by.
Jump speed instruction, and we're going to overwrite this with the little Indians version of it.
What's the little Indian Eyes version of it?
Well, we're reversing every two bytes, so be backslash x6f backslash x cc backslash x04 and note how
it's only seven digits.
So you need a 10 to 0 to the eight backslash x08.
So let's see that we can actually hijack execution.
Let's actually make this cleaner, you guys.
Let's see.
Jump up.
Jump on.
I'm sorry.
Backslash x6f backslash x cc backslash x0408.
It's always important to write clean code.
So if we can hijack execution, then I see as a lens in this job PSP.
It's going to hit our seas and that means it won't be able to access our seas because all it contains
is gibberish.
So let's see.
EDB cheat gdb lib hdp demon run sp 8080 control b shift double quote to split into horizontal panes
python burst tried API crashes.
And we have an illegal instruction.
And our access staff point is pointing out our fees.
So this is where we're actually going to toss in our reverse shell.
And we're going to see.
Wow, that's huge.