All right.
Welcome back to part three of our reboot for Introduction to Exploit Development Within Containers.
So at this point, we want to perform a jump call command to find a way to land into the center stack
pointer because look at our original exploit code right now.
So we know that the extended stack pointer can hold our buffer of C's and we call it shell code space.
So let's use the command jump call and look specifically for calls that specifically say jump to the
extent of stack pointer because we know it's at least 200 bytes.
I have tried this with the latest version of Metasploit.
So 200 bytes is more than enough to fit shell code.
You can pick any of these instructions right here or here or here as long as it lands at the ESP.
Because in our previous video we dump the extended stack pointer in its location, we dump 200 bytes
and we found out it's more than enough adequate space to fit our shell code.
So let's make a note in our exploit control c.
Go back to our editor
and then we're going to comment this out.
And we're actually going to comment out IP.
So there's actually two ways that you can do this.
Normally what you would have done in the previous version of my course is IP equals bytes, and then
you reverse each byte, including the first one.
So it will be x6f slash hex
c6x04x08.
However, we don't need to do that anymore.
In fact, I'm going to show you a different way because offensive security, you learn security.
And a lot of these people that are on these write ups opt for 32 bit exploitation.
They keep on talking about reversing the bias.
But what they're really trying to get to you is that they're trying to tell you about indianness.
But what we can do now, especially once you get to the drop chain section, this would be very convenient.
What's this?
It must have hit some dumb command IP equals struct that pack single quote lower symbol capital l and
then copy the memory address right here.
So this does the exact same thing as this.
And what it does is that it actually packs it as little.
So this lower sign I'm highlighting right here.
Let me see if I can zoom in.
This lower sign right here is a packet as little Indian and L capital L stands for Long Integer, which
means a four byte memory address, basically.
So let's run our exploit again.
Let me just zoom out.
Control.
C Go back to our exploit so control b z to execute zoom nano exploit that py and then want to clear
all of this out.
They want to control shift C to copy all of this in.
So what I expect to happen is that it's going to take the jump USB call, it's going to crash where
the keys are at because it doesn't know what it means.
And then we're going to run our payload.
Just we just need to make sure that our payload works.
Let me just exit this.
Run peak 80.
83.
Exploit tight control.
See?
As you can see, we have been redirected to the extended stack pointer where the keys are at.
So it did take the jump to the extent stack pointer and this is where we get to have our shell code
placed in.
So wait till our next moment where we will generate our exploit code.
So I'm actually kind of a busy man, but you can actually go into reversing bad bytes or finding the
bad bytes in our previous 2019 edition of our class.
But tomorrow in our next section, we're going to go over how to generate the proper shell code.
All right.
I just made it a little bit of an error.
I actually missed one line.
So what I want you to do is copy and paste the code right here.
I forgot to actually write it into the file, as you can see.
So I missed one line.
But going back to our original development methodology, we're going to crash the program.
So run dash p 8080.
Make sure that your exploit has a new code right here, which is w write the right buffer.
Python three exploit.
Hi.
Now to finish request, we must control C out of it.
And we see a crash.
We noticed.
If you do this, if you go press control B up you'll go to the up to the up pane.
So now press control b z to zoom in and we notice that IP is overridden by four A's.
So previously in our older 2019 version of the class, I said that we're going to use MSF under pattern
create.
You can use either or, but we can also use the pattern create feature within good debugger petta so
we can do this pattern create 1400.
So make sure you copy only what's within the single quotes, and then we're going to update our exploit
again.
So we're going to change this code that out buffer.
Sorry, I got a text buffer equals B remember not forget about your B, all right.
This specifies bytes in Python three and then we copy and paste our cyclic pattern.
Remember, this is called a cyclic pattern, and cyclic patterns map out sections of the buffer.
So we're going to copy our new exploit into our Docker container.
Nano exploit that pi lead everything.
And then save it again.
Run up 80.
80.
Python three exploit pi.
And then control the out of it.
And we're going to find this.
So go back up to the top, pain control Z to zoom in and we find out that IP is written by the strange
screen.
So we can actually use the debugging extensions.
We'll think anew, debug or peda to search for our offset.
So pattern search.
Copy and paste this.
It's quite informative, but what it's saying is that our bass pointer is overwritten at 1044 bytes.
Our instruction pointer is written at 10,048 bytes.
I'm sorry.
My father is just like running some sort of stupid, like, woodworking kind of thing, so he probably
couldn't hear it.
I hope you don't hear it.
And our extended, extended stack pointer is overridden starting at 1052 bytes.
So we need to now verify that this actually works.
Right.
So we need to now change our exploit again to make sure that we can correctly overwrite IP reliably,
which is the extended instruction pointer.
So let's comment this out
and let's make a new variable call overflow equals B A times 1048 and then we'll have another one called
IP equals B capital B times four.
And then we're going to write another variable.
Let's just call it show code space equals B, time C or Python C.
Times.
1048.
Minus four.
So 40.
100 minus ten.
48.
Minus four.
So now our buffer is going to be buffer equals overflow plus IPI plus shell code space.
So let's copy and paste this into our container.
Patrol.
Busy to stop the zoo.
Nano exploit pi.
Restart the debugger dash p 8080 Python three exploit py control c to stop and control z to zoom back
in and notice that we actually correctly found our exact buffer overwrite and it's then a stack pointer.
So if you do something like x/1 hundred x esp.
Hex 43.
Is actually the hex for Capital C?
We can actually calculate how much time or how many C's that we have, but we already printed 100 bytes
so we can do 200.
We have more than enough bytes to put in a basic reverse command shell.
So this covers the end of our IP overwrite.
In our later video we will find a jump call towards ESP because this is where we're going to put in
our knop sled and shell code.