So when we talk about finding the offset we kind of talked about in the last video we're going to be
looking for where we overwrite the IP because that's what we want to control.
Now lucky for us there is a tool already out there that will help us do this in this tool is provided
by Metis play framework.
It's called pattern create.
So in our Kelly machine we're gonna go ahead and just get that set up.
So we're gonna do is we're going to see a user share Metis boy framework tools exploit pattern create
OK.
Now we're gonna have to give this a couple switches actually just one for the first one.
We're gonna give it a switch of L for length and the switch Val we're gonna say three thousand so why
three thousand.
Well if you remember the last video what happened was we found somewhere around twenty seven hundred
bytes is where the villain server program crashed and then I said hey let's just make it even three
thousand it'll be nice.
This is where it comes into play.
So we're going to take three thousand bytes and we're gonna hit enter here.
What's gonna happen is it's going to generate this crazy psychical code here that we're going to actually
have to send into immunity and Vulcan server.
So you see all this jumbled stuff all we're gonna do is just take it and we're gonna copy it and then
we're going to modify our script that we created earlier just a little bit and I've gone ahead and done
that.
I'm going to show you what that looks like.
So let's go ahead.
I called it to the PI if you want to modify your one dot pi and make it easier from the last video and
then I did a little test here just to make sure it worked.
But what we're gonna do is we're gonna paste this value into here but first I want to cover this script
so removed some things wrong with the time because we don't need it.
We saw the import cysts in socket.
We don't need it like a wall loop anymore.
We can just say try and we're gonna do the same connection and just try and the connection make sure
we connect that address and then we're gonna send this offset.
Right.
So I'm going to go ahead and paste that value into here.
You can go ahead and work on getting the set up.
What we're gonna do is we're gonna send this value in the word to close connection.
If for some reason we cannot access it then we'll throw an exception and say air connecting to server
and then we'll exit out.
So what we're gonna do is when we send this in we're gonna get a value on the E IP so we're gonna see
that the program crashes and then the value in the IP is going to come back and then we're gonna use
a tool we're going to say hey okay.
Medicinally I found this value on the IP.
What is the offset.
So we've got this pattern create right now and then we're gonna have pattern offset here in a second.
So let's go ahead and get this saved up once you're ready.
Go ahead hit save same thing again what we're going to need to do is we're going to change the mode
like we did last time to execute on to that pie.
And also we're gonna need to get immunity running and bone server running.
So I'm going to do that really quick here.
It should look like this hit play.
Make sure we're running in the bottom and then go ahead and fire off that script OK.
Should there an exception.
Right away and you see now that we have this try and command that came through with our values that
we sent right to the cervical value goes to the A's it crosses over the EVP down the IP even comes through
the ESB right.
So what we're doing here is we have completely overwritten everything.
We've gone too far because we've crossed this ISP.
But really what we're interested in is this e IP.
We want to be able to control this value.
So we see this value in here is 3 8 6 f 4 3 3 7 right here.
This is what we need and we're interested in.
So let's see how we can make this value of use.
So if we come back to the screen and let's just tab up a couple and we'll go here and just backspace
what we're gonna say is instead of pattern create all we're gonna say is pattern offset.
We're gonna give it the same switch of L and we're gonna say three thousand but one thing we need to
add in here is a switch of Q and that's for our finding.
So our finding was 3 8 6 F as in Foxtrot 4 3 3 7.
And now if we hit Enter here and we did it right we should find a pattern offset meaning that somewhere
inside of these three thousand bytes it found this pattern and it relayed back to it.
So if you see here we actually do have an exact offset match at two thousand and three bytes.
This information is critical because that tells us now that two thousand three bytes we can control
the E IP and that's exactly we're going to do in the next video we're going to look at the IP and see
if we can control it.
So we're going to try to overwrite it with very specific bytes and see if those bytes show up.
So let's go ahead and move on to their.