Let's see if we're recording this.
We're recording.
All right.
Welcome back.
So we know that we crashed.
We can go back to Von.
We can still run the bugs before our payload.
Or we can just press R and the control C out of it.
And now we need to find the base address for the C Standard Library.
The easiest way to do this is type V map.
Sorry, too many amps.
Your C scanner library for Ubuntu, which is the bunch of 2004 version that I'm using.
This Dr. container is located here.
What you want to do is take copy and paste this and save it as your base address so we can use a new
debugger or feature called Set Set.
Dollar sign base equals this memory address.
The fact you want to print it, print it out.
You can actually just do something like print, hex copy and paste that minus dollar sign base.
Which is the distance between this section and this section.
Remember this, because this is actually a much more convenient method than the write up that I wrote
on Google Docs.
So what you want to do is edit your exploitation script right now.
We already know we can overwrite the return instruction pointer at 216 bytes, so we're going to comment
this out.
If we're going to write lib C based address equals this value.
Now we need to find.
Our shell function within this application, which means that actually searches through all the modules.
So ji to be bet petta I'll have to do the type fine signal quote then shell.
This is the absolute address of Ben Shell.
So what you do is that since we save it as a base address, you just set another variable set abs for
absolute and save it as that.
If you want to find the offset, offset is like a relative virtual address, but in Linux it's a distance
between the very top of this memory address that's located for the standard library and the actual distance.
So you can do a relative virtual address that's a Windows term, but it's called an offset in Linux.
And you can actually print down the distance the offset.
So it will be ABS minus base.
This valley right here is the offset distance, so we can actually add a variable in our exploit for
our rock chain.
So we go back to our ID and then we can type shell equals loop C base address plus this memory address.
The next gadget you want to look for is assist call.
So you want to go through this key system.
We found the absolute address of this.
And to save time, we're going to do print packs.
This address, minus dollar sign base.
Which is this offset.
So we're going to type this call equal of flip sea base address, plus this address.
Finally, we need an exit call.
So pe exit.
We have this absolute address.
And we're going to do P slash X.
This address, minus dollar sign base.
Call Seabass address, plus this NAMI address.
Now, I want you to find the other parts of your rock gadgets, and we are going to be using ROPPER.
Let me see.
Yes.
ROPPER And I want you to use ROPPER against this specific shared object file, which is like a Linux
version of a doll.
So we're going to do control B shift by to make another terminal bash.
ROPPER.
This C library.
Oops.
Sorry.
Proper file.
Let's let it load.
My guy was taken a while.
Finally.
So first we need to do is top RTI returns so search death one pop RTI because the way that x 64 college
convictions work is that it requires you to execute to send the first argument into the RTI.
What we're actually doing is that we're setting the show variable to bind show in the Lipsey library
as the first argument in our in the RTI Register.
For one, those will be different.
I will make another video.
Explain the 64 bit column conventions, which is the main difference between that and 32 bit exploitation.
So we have the pop RTI equals live C base address plus this offset.
Finally we need a return because in 64 bit exploitation you need to properly align the stack.
Otherwise the show code will just break.
So we are going to look for search dep one rect and we find one at the very conveniently right here.
So we're going to do ret equal lip see base address plus.
Here.
I think that will be enough for this module.
And then in later modules we'll show you how to construct a proper rock chain and exploit this and create
our shell.