OK so now we're gonna try to override the VIP so in the last video we discovered that the offset was
at two thousand and three bytes.
What that means is there's two thousand and three bytes right before you get to the IP and then the
E IP itself is four bytes long.
So we're going to try to do is overwrite those four specific bytes.
So as always go ahead and get your immunity debugger running with Von server attached.
When you have that let's go ahead and hop right into Kelly Linux.
This should be a pretty short video so we're gonna do is let's go ahead it is g edit the last script
that we wrote which was to the PI and we're gonna modify this together so we can do here is we can just
delete this offset variable because we don't need that anymore and instead we can just write shell code
here and we'll switch out this offset variable to Shell code and then let's go ahead and set this equal
to a Times 2003 plus B times for so let's make sense of this real quick we're replacing what we sent
before to find the offset with the shell code.
Now the shell goes nothing but A's and B's right now but it's gonna get malicious in a minute.
So what we're doing here is we're sending two thousand three A's.
Why.
Because that's where the E IP starts.
So byte 2004 starts the E IP so we're doing is we're sending a bunch of A's but we want to make sure
that we don't overwrite the E IP with A's and have no idea if we're correct or not.
So remember A's or 4 ones B's is gonna then be for 2.
So in theory we should see 4 2 4 2 4 2 4 2 on the VIP when we overwrite it.
So let's go ahead and just fired this guy off.
I'm going to save this and you could save it as Dot three if you want obviously to keep it dot to to
make it simple.
And then what we're gonna do is to that pi remember if you did make it a new file go ahead and change
the mode.
And since we have Vulcan server running and attached to immunity to debugger we should be able to fire
this guy off and it should break the program.
So we have paused down here access violation grade.
OK.
So let's talk about what happened here.
So you see the x try ran through bunch A's.
Were you seeing that EVP for 1 4 1 4 1 4 1 Good came through.
But look here the EIB is for 2 4 2 4 2 4 2.
Now we only sent 4 bytes of B's and they all landed in the IP.
Guess what.
That means we control this e IP now.
So from here it's pretty smooth sailing.
We've got a couple of housekeeping things we got to do in terms of finding bad characters and finding
the right module to send this to.
But once we do that we're gonna generate some show code we're gonna point this e IP here instead to
that return address that's going to be malicious and then we're gonna gain root.
So hopefully this makes sense.
Again just to reiterate we have controlled the IP and now we're going to start to get malicious.
So in the next video we're going to talk about finding bad characters.