Buffer Overflow
Buffer Overflow notes for Windows 32bits in order to pass OSCP exam!
Windows 32 bits
Stack-Based
For that task we are going to use a Windows 7 x64 with Immunity Debugger and mona.py installed.
Mona configuration
!mona config -set workingfolder c:\mona\%p
Fuzz to find the vulnerable input
fuzzer.py
import socket, time, sys
ip = "10.10.95.202"
port = 1337
timeout = 5
buffer = []
counter = 100
while len(buffer) < 30:
buffer.append("A" * counter)
counter += 100
for string in buffer:
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(timeout)
connect = s.connect((ip, port))
s.recv(1024)
print("Fuzzing with %s bytes" % len(string))
s.send("OVERFLOW1 " + string + "\r\n")
s.recv(1024)
s.close()
except:
print("Could not connect to " + ip + ":" + str(port))
sys.exit(0)
time.sleep(1)Crash Replication & Crontrolling EIP
exploit.py
create a pattern: /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 600
And add the output to a payload variable and exploited.
take notes about the EIP and search the offset:
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q EIP
Check adding BBBB value to retn variable.
Finding Bad Characters
Find the characters that are not accepted on the payload. (REMEMBER FILL THE EIP)
!mona bytearray -b "\x00"
And add the output to the payload variable (without the offset)
Finally compare the binary file with the stack frame specifying the ESP.
!mona compare -f C:\mona\oscp\bytearray.bin -a <ESP>
Repeat the process adding the new bad characters found until the results status returns UNMODIFIED
!mona bytearray -b "\x00\x07\x2e\xa0"
Finding a Jump Point
Find all "jmp esp" on the system !mona jmp -r esp -cpb "\x00\x07\x2e\xa0"
Remember: Don't Forget to put the BAD CHARS founded.
Put the adress on the "retn" variable. If the EIP is the same as ESP you success at jummping to ESP.
Generate the Payload
We will generate the payload with msfvenom, (DON'T FORGET TO PUT THE FOUND BAD CHARS)``
Copy the generated payload ant integrate it into the exploit.py
Prepend NOPs
We will need some space in memory for the payload to unpack itself, if we added a padding before to match the beginning of the payload with ESP add another 16 NOPS.
padding = "\x90" * 16
Linux 32 bits
Ret2Libc (Localy)
For that task we are going to use a Kali with gdb-peda installed:
Running the binary with GDB
Notice that we get a message in GDB telling us that the the process was detached after a fork from the child process. We can fix that by setting the following commands in GDB.
Finding the offset
Create the pattern
Create a randomized pattern in order to find the offset with the EIP value.
Find the offset
Run the binary with the pattern.
Once we have the EIP we will search the offset value with the pattern:
Check results
Now run the binary with a randomized offset and a controlled EIP like 'BBBB'.
And finally run the binary with the payload
Check Security
With gdb-peda :
To check ASLR you can check the following file on the target machine:
Checking the results:
0
OFF
OFF
1
ON
ON
2
OFF
OFF
Finding Addresses
- libc.so.6
- system
- exit
- /bin/sh
Create the exploit
This is a template:
Explotation
Finally we just need to transfer the file to the target machine and executed
Stack-Based (Remotely)
Same as Ret2Libc we need to control the EIP. When we successfuly control the EIP we need to check which security is enabled:
We can see that PIE is enabled which stands for Position Independent Executable. This means that the memory locations will change every time you run the application. This makes exploiting buffer overflows harder. However, in that example of BoF there was a DEBUG parameter that gave us the location of the buffer overflow-able field.
Socket Re-Use
Instead of spawning a reverse shell that maybe give problems to us with bad characters we can re-use the open socket.
The following shellcode works to re-use the socket.
Fitting the exploit
Finally we just need to fit all parts together and make the exploit:
Example pwntools
Last updated
Was this helpful?