Okay, everybody, welcome back to Exploit Development.
We're about to start our most exciting part of live damon the exploitation process.
And I already tested a show called before, so it works.
But let's just review the MSF beat on Paleo Generation script.
So we're going to run MSF that I'm dash P controversial connect back to local health port 444 format
python eliminate the bad character 09080d 22 and three F and then platform Linux architecture x86 encoder.
Now let me talk to you about encoders because encoders are basically a very important part of our show
code.
Now, you would be under the assumption that the can be obvious and generated.
You'll be on the assumption that MSF venom generates raw assembly show code.
That's further than the truth.
You think you c you need to protect your encoder because within the first 16 bytes of the shell code
it actually encodes your assembly codes and operands to force move mover execution to get back to get
passed with no mitigation measures.
So in order to prevent this from being overwritten, we need to add a knop sled, which is a knopfler's
is basically zero by nine zero.
It does nothing except serve as a shield for the rest of the shell code.
If you overwrite, let's see zero by B right here.
The show code breaks.
So you need to add a protective not sled so narrow first try.
Let's copy this.
And then notice here that we have 16 knobs non operation, no operation to protect the shell code.
Now we don't have to worry about the seals anymore because as we previously discovered, the buffer
is so large and this program so easily exploitable that we have a mass of length, just a stick in our
shell code.
So we don't have much of an issue here.
But once we go into a hundred years, we will tell.
We'll talk about limited buffer space, but that's a different section of the class.
So what I want you to do is run that command, which was
a massive venom dash p linux x86 shell versus TCP.
O health equals local health.
L port is 4444 format is python by bytes.
Remember there are six of them 090a0d, 22 F and three F platform is Linux.
Architecture is x86 and the encoder is Shikata Adonai, which I believe means all is lost because at
the time that this encoder came out, there was actually no mitigations against it.
And then we gave it the variable name show code.
So let's see.
The earth is correct.
So we overflow.
We overflowed our application with a post request of 1048 of a job instruction construction with a protective
buffer of 16 knobs to protect our shell code, which is 95 baseline.
So clear the new debugger and run esp 8080.
Split your screen in that cat.
This is to catch a shell and that cat and be all people for four.
Split the screen again.
Python.
First try the pi.
Control through the exit out of it, and we get a Kinect in a shell.
So this doesn't look like a shell by normal circumstances.
But to verify that it's a shell type, who who am I?
Heidi, you named.
Congratulations.
You have just passed the first section of the course which is live HDP day and 1.2.
And you have just gained a route level shell within a 32 bit image of Carole Lennox using live HP Diamond
1.2.
Thank you for your time and get ready for the next section, which is all male 5.5 that is a Windows
exploit, so you will need a Windows XP vista or seven with so email install.
Please refer to the installation videos.
Thank you for your time.