Basics
PRACTICE ! PRACTICE ! PRACTICE !
Last updated
PRACTICE ! PRACTICE ! PRACTICE !
Last updated
We have the Kernel at the top(1111111111's) and we've got Text at the bottom(00000000's) and in the middle lies the Stack
Inside a Stack - We have the ESP (Extended Stack Pointer) sitting on the top and the EBP (Extended Base Pointer) sitting in the bottom and in the middle we have the BUFFER SPACE
So basically the BUFFER SPACE fills up with the user input characters and it's gonna go downwards the Stack - as it fills up
Normally, the BUFFER SPACE should properly be sanitized so that when a bunch of A's is getting filled up in that space - It musn't cross the BUFFER SPACE and disturb the EBP
Incase of a BUFFER OVERFLOW, what happens is when the user input crosses the BUFFER SPACE and disturbs the EBP - It immediately goes down the EBP and disturbs the EIP (Extended Instruction Pointer) as well - EIP is also called the RETURN ADDR a.k.a ret :)
Once when the bunch of A's disturbs the EIP / Return address we'll have an error saying Segmentation fault - The EIP is the most interesting register as it has the control over the flow of execution in the program, So once we get hold of that EIP register, it's easy to pop a shell on the box :)
Method to find a vulnerable part of a program
Kinda similar to spiking, we are gonna flood the user input by sending large amount of characters and see if we can break it :)
If we do break it, the next step would be finding at which character the program crashes (ie finding the offset for that bunch of characters)
And now we use that offset to overwrite the EIP with our payload to pop a shell :)
Once we have the EIP control, we'll have to find some bad characters and find the right python module to exploit the overflow
This is the final step where we generate the malicious shellcode to get a reverse shell on the box, more specifically we are gonna point our EIP to our shellcode and gain R00t
Victim Machine - Windows 10
Vulnerable Server - VULNServer
Attacker Machine - Parrot OS
Victim Machine - Immunity Debugger
