phillips321.co.uk

So I’ve for a while needed to learn how to exploit a service using things like NOP sleds and so on. I decided to follow this great tutorial here but wanted to make my own notes.

First off you’ll need the following:

• Windows XP x86 SP3 machine
• Immunity Debugger
• mona.py – place inside PyCommands folder of Immunity
• Freefloat FTP Server – the target we will be attacking

Background – The MKD command of the FTP server is vulnerable to a buffer overflow, we will use this function to exploit the service.

Ok the first thing to do is test that Freefloat FTP is working, load it up in Win XP and perform a quick FTP connect to it. Now close FreeFloat FTP by clicking the unload button.

Okay, now load Immunity Debugger and open the FreeFloat Executable

Freefloat will now load into Immunity in a paused state. To Run click either the play button, Debug–>Run or press F9.

Now that FreeFloat FTP is open and accepting connections we will attempt the buffer over flow using some simple python code:

This should cause Immunity Debugger to pause due to an access viloation due to trying to execute code at memory address 41414141(AAAA), this can be seen in the top right EIP 41414141 It’s crucial to note that both ESP and EDI have been over written by our string of As as we’ll be setting the EIP (instruction pointer) to use one of these locations later.

Now what we need to try and doing is figure out which of these’s 4 A’s wrote to the EIP location, we could try something like:
aaaaAAAAAAAAAAAAAAAAAAAAAAAAAAA…. and then
AAAAaaaaAAAAAAAAAAAAAAAAAAAAAAA…… and so on but this would take ages. (upto 250 attempts)

Step in mona and metasploit.

The first thing we need to do is generate a string of length 1000 using metasploits pattern create tool to create a pattern that mona can use to find the exact locations within memory:

We now need to use this string as the value passed for the directory to be created. Restart FreeFloat FTP service inside Immunity Debugger using Ctrl+F2 followed by F9 OR Debug–>Restart followed by Debug–>Run

Running this code against FreeFloatFTP will once again cause the service to lock up, we now use the following command !mona findmsp
The findmsp command will (taken from https://community.rapid7.com/community/metasploit/blog/2011/10/11/monasploit)
look for the first 8 bytes of the cyclic pattern anywhere in process memory (normal or unicode expanded)
look at all registers and list the registers that either point at or are overwritten with a part of the pattern. It will show the offset and the length of the pattern in memory after that offset in case the registers points into the pattern
look for pointers into a part of the pattern on the stack (+ shows offset and length)
look for artifacts of the pattern on the stack (+ shows offset and length)
query the SEH chain and determine if it was overwritten with a cyclic pattern or not.

What need need to take from this is the following:

The offset of 247 means if we use the following our B’s will be written into the EIP (note: we’re still keeping the string length of 1000).

Restart FloatFTP and go back to the CPU window c or Alt+C

When we inject this it should only write BBBB (42424242) into the EIP:

(here I have issued the command d esp and then scrolled up a bit to see what i’ve injected)

So what this means is instead of BBBB we can replace them with a pointer to a location in memory, specifically memory that we have written to, in this case we will use ESP.
To find this pointer we use the immunity command !mona jmp -r esp
This might take a second or two but once it’s complete open the log window by click the l (Alt+L)at the top of the screen

We should now see that many DLLs listed, any of these will do, all here are windows DLLs but it doesnt matter as this is only a tutorial (the DLLs might be in different locations on other operating systems or service packs)

In this example we will use the SHELL32.dll to return to our injected code (note the push exp # ret)

We can try our exploit again with the following values for BBBB:

Note: we are referencing the mem location in reverse byte order due to the Little Endian architecture of the CPU. We are also still keeping our string length to 1000 to prevent tripping a different possible exploit
Restart FloatFTP and now inject the new string with the modified pointer.

Now all we need to do is generate some shellcode and add that the the string. Do do this we will first generate some shellcode using msfvenom, when doing this we need to ensure that bad characters are not used. This tutorial will not cover identifing the bad characters but for now just accept them to be \x00 \x0A \x0D:

Now we need to insert this code into the string but at the same time we’ll ensure it still remians at 1000 characters long:

Note: before the shellcode here we have inserted a nop sled (the 30 \x90s), what this basically does is tell the insturction there is No Operation Performed here and to move to the next line in order to pad the payload out a bit.

This leaves us with the resultant exploit code:

And here’s a demo video:

In order to take things further you could create shell code with a reverse https connection your attacking box: