[MUSIC LOGO]
Cross-compiling exploits.
In this video, we will be taking a look
at the process of compiling exploits, Linux exploits,
as well as cross-compiling Windows exploits on Linux.
So in certain cases, exploit code will be developed in C,
C++ or C#.
And as a result, you will need to compile the exploit code
into a portable executable in the case of Windows
or into a binary in the case of Linux.
Now, it's very important to note that in the previous video,
we covered the process of modifying and running
an exploit that was developed in Python.
One of the cool things with Python
is that I don't need to compile a Python code into a binary
or executable in order to run it.
However, in the case of C or C++ or C#,
I actually need to compile it into a portable executable
or binary in order to run it.
Now, you might be asking yourself, well,
what's compilation and what's cross-compilation?
Cross-compilation is the process of compiling
code for a platform other than the one performing
the compilation.
Now, typically, during a penetration test,
you're primarily going to be working from a Linux
system, more specifically, Kali Linux
or any other penetration-testing distribution.
As a result, you will be in situations
where you will need to compile Windows exploits on a Linux
system, and that is why this process is
referred to as cross-compiling or cross-compilation.
If you're just compiling a Linux exploit
on Kali Linux or a Linux system, then that
is known simply as compiling.
So as a penetration tester, you'll
need to have the skills necessary to compile exploit
code developed in C. There is no way of getting around it.
And again, it really doesn't have
to be pertinent to an exploit that will essentially
provide you with initial access to a target system.
It could be a privilege escalation exploit.
Irregardless of all of that, having a good understanding
of how to offer to compile exploit code that's been
written in C, C++, or C# is very, very important.
So this video doesn't have a lab environment attached to it.
The reason for that, again, it really comes down to the fact
that there's a lot of variability when it comes down
to cross-compiling Windows exploit code that's
been written on C, on Linux.
So I'm just going to be taking you through a few examples,
and I'll be explaining the tools required
to perform the compilation and cross-compilation in the case
of Windows and Linux as well.
So I'll just switch over to my Kali Linux VM,
and we can get started.
So I'm back on my Kali Linux VM, and I've already
identified the exploits that have
been written in C that I'm going to compile and cross-compile.
In the case of the Windows exploit,
I'm going to be compiling a VLC Media Player exploit
that was written in C.
Again, we're not going to be running it.
We're just going to be taking a look at how to compile it.
And I already have the exploit DP links opened.
In the case of Linux, we're going
to be compiling a very popular privilege
escalation exploit that, again, takes advantage of the Linux
kernel.
It's called Dirty COW.
So I'll be covering the compilation process
for both Windows and Linux.
Now, in the case of Windows compilation on Linux
or cross-compiling a Windows exploit on Linux,
you require a few tools, one of which is mingw-w64,
which as it says right over here,
is a free and open source software development
environment to create Microsoft Windows portable executable
applications on Linux.
And it can easily be installed on Kali Linux
by running the following commands.
So I'll just open up my terminal here,
and we'll get it installed by saying sudo apt-get install.
And we want to install mingw, and that is w64.
And we'll hit Enter.
Now, I already have it installed.
So I don't need to go through that process.
There we are.
And in the case of compiling C code or Linux exploits,
you need to have the new C compiler installed,
which again, can easily be installed by saying
sudo apt-get install GCC.
I'll hit Enter.
I already have GCC installed.
But it looks like I have an update.
So I'm just going to update my version of GCC here.
So I'll give this a couple of seconds to complete.
So we have both mingw-w64 installed as well as
GCC installed.
So we can actually take a look at how to compile
the Windows exploit first.
And I'll just clear up my terminal here.
And I'm currently working within my Desktop,
and I've created a folder called Exploits.
So let's take a look at this exploit right over here.
So we can see that it's written in C.
And of course, that's quite easy to tell.
Irregardless of what version of Windows this is targeting,
we're just going to be focused on the compilation.
So it's a relatively simple exploit.
And in terms of compilation, we can
compile either a 32-bit version of the exploit
or a 64-bit version.
And I would typically recommend compiling the 32-bit version
of the exploit, as it'll run on both 32-bit systems as well
as 64-bit systems.
But of course, you have the ability to change that.
So I can download it directly from the ExploitDB website
or I can utilize searchsploit to copy it over.
So I'll just do that instead.
So I'll just run the searchsploit command.
And the name of the exploit here is VideoLAN VLC.
So I'll just perform a quick search for it.
So searchsploit VideoLAN, and we can just hit Enter.
And you can see we have quite a few.
So let me just further filter out the results here.
And I'll also say VideoLAN VLC.
This is SMB.
And the one that we're looking for here is the C exploit.
So that's 9303.c.
I believe that is the case here.
If we take a look at the EDB ID, that's 9303,
and it is EDB verified.
So what I can do now is, again, just copy it
with searchsploit to my current working directory.
So I'll say searchsploit -m, and 9303 is the EDB ID.
And hit Enter.
And that's copied the incorrect one.
So let me just get rid of the one it just copied right now
because I typed it incorrectly.
So the one we want to copy is 9303.
There we are and it looks like we already have it there.
So yes, I'm just going to overwrite it.
So there's the C file.
So again, if we inspect the C file-- now,
I just want to highlight something very important here.
In the case of exploits that have been written in C,
if the exploits have been well-documented,
they might contain information regarding
how to compile this specific exploit in regards to the mingw
compilation instructions and arguments
that you need to provide.
However, in this case, this exploit
doesn't have any information regarding
how to compile this particular exploit.
So we will need to use the default compilation
options or the default compilation syntax.
And in order to compile this exploit written in C,
we will start off by compiling the 64-bit version first.
So I can highlight that.
So we'll use the i686 min.
We'll actually use w64 because we're compiling 64-bit.
mingw-w32 GCC, and yeah, that's the one we want to use.
And we then specify the C code itself.
So 9303.c.
And then we can then output it into another file.
This is going to be the portable executable.
And in this case, we can just call it exploit
or something very basic.
So I'll just hit Enter.
And if it doesn't give you any error messages,
the compilation was successful.
So if I list out the contents of the directory,
you can see that that exploit was compiled successfully.
And we now have exploit.exe, which we can then
run against the target.
So that is how to perform Windows cross-compilation
on Linux.
And it really is very simple.
Now, as I said, in some cases, you may find a few errors.
And that will come down to the actual compilation arguments
that you need to provide.
Now, if you want to compile it for 32-bit systems,
you can just go ahead and type in the following command--
I'll get rid of that there, and we can then
run the following command-- so i686.
And we're going to be using w64 mingw-w32, essentially
the same compiler but with one difference.
So let me just type that in correctly there.
mingw-w32, and that is we're using GCC.
And we then specify the actual exploit itself.
And then we can output this into a file called exploit again.
And we now need to specify that this
is for 32-bit systems or 32-bit versions of Windows.
So that can be done by saying lws2-32.
And we hit Enter, and that compiles it.
It compiles the 32-bit exploit.
So if I list out the contents of this directory,
you can see we have exploit.exe.
So we have been able to compile both
the 64-bit portable executable and
the 32-bit portable executable.
So I'll just get rid of the compiled executable there.
And we can take a look at how to compile Linux exploits that
have been written in C.
So I'll just navigate to my browser here.
And we'll take a look at the Dirty COW exploit.
So again, as you can see, this exploit is written in C.
And one of the things I want you to take note of
is that this particular exploit has fantastic documentation,
in that it provides you with compilation instructions
and the arguments that you need to specify
during the actual compilation.
So you can see we have the lcrypt option specified as well
as -pthread.
So again, if we would have just run GCC and specified the C
file and output it into a Linux binary,
we would have gotten an error.
And thanks to the author of this particular exploit,
the actual compilation instructions and arguments
required to compile it successfully
have been provided to us.
The author also provides information
regarding how to execute or how to run this particular exploit.
So we can download it directly or we can utilize
searchsploit to copy it over.
So I can just search for the exploit manually.
So I'll say searchsploit.
And we can then say Dirty COW.
And it really doesn't need to be case sensitive.
And the one that we're looking for
is this one right over here.
That's the privilege escalation exploit.
So that is 4839.c.
So I'll say searchsploit -m, and that is 40839.c.
And we don't need to specify the extension.
We just hit Enter.
And again, because the compilation instructions
have been given to us, we can go ahead with the compilation.
However, for this exploit, you have the ability
to modify it based on your own parameters,
as you can see here.
We have a few variables that allow
you to change the username.
And of course, this is not really relevant to this video.
I'm just showing you an example of a really well-developed
exploit and the fact that it contains
really good documentation.
Furthermore, C code is actually quite easy
to read in terms of understanding what's going on.
So again, we really don't need anything else,
apart from the actual compilation instructions.
So we need to specify or utilize GCC.
We then specify -pthread, the actual exploit itself.
We then output it into a binary that we can essentially
specify whatever name we want and then lcrypt.
So what we'll do is we will say GCC -pthread, -pthread right
over here, and then the actual exploit itself,
which is 40839.c, and then we output this into exploit.
And again, this is going to be an ELF binary, which
means it can only be executed on a Linux or Unix system.
And then, we need to specify the final argument here,
which in this case is lcrypt.
So we'll say lcrypt.
And we can then hit Enter.
And if we don't get any errors, the compilation
is completed successfully.
And if we list out the contents of this directory,
you can now see we have the Linux binary or ELF
binary called exploit, which we can execute on Kali Linux.
But again, it's not really applicable to our distribution
because this is a privileged escalation
exploit for Ubuntu primarily and a few variants of Debian.
But extremely powerful.
I just wanted to highlight it because of the fact
that it's one of the, at least in my experience,
one of the most well-developed and documented
exploits out there, especially in the context of C.
And again, it's been made so that you can actually
modify it and configure it based on your own requirements
and the environment that you're working on.
So yeah, that's compiled successfully.
And we have successfully taken a look
at how to cross-compile Windows exploits that
have been developed in C on Linux
as well as cross-compiling Linux exploits that
have been developed in C.
Now, one additional resource that I want to showcase
here is the GitHub repository by Offensive Security
called ExploitDB bin-sploits.
This is a GitHub repository that essentially contains
a list of precompiled binaries, more specifically,
Windows binaries and a few Linux binaries as well.
And again, the reason this is provided
is primarily because in certain cases
cross-compiling Windows exploits on Linux
may actually enumerate or may not be successful
and may bring up a lot of errors.
So in that case, again, you can always
rely on this vetted source in terms of precompiled binaries,
in that you know that they don't perform anything
else that they're not supposed to do in terms
of their functionality.
So again, you can essentially navigate or specify one
based on the actual EDB ID here.
So you can click on any of them, and they're actually
archived so you can just download them,
and you'll have the precompiled binaries available.
And you don't have to go through the cross-compilation process.
However, as I said, it's very important
that you actually know how to actually compile exploits,
both Linux exploits and Windows exploits,
as that is something that you'll actually run into quite a bit.
And once you start progressing with your career in penetration
testing and you start writing your own exploits,
you will need to have the knowledge required to actually
compile your own exploit.
So again, this is something that's quite important to know.
With that being said, that is going
to conclude the practical demonstration
side of this video.
So that concludes the fixing exploit section of this course.
In the next section, we'll actually take a look
at bind and reverse shells.
And we'll get an understanding of what
a reverse shell is, what a bind shell is, how to set them up.
And we'll also be exploring Netcat in depth
and getting an understanding of how it works
and why it's so powerful, primarily because it is a tool
that you'll be using a lot during penetration
tests and one that has stayed a constant over the years.
With that being said, I'll see you in the next section.