---
description: PRACTICE ! PRACTICE ! PRACTICE !
---

# Spiking

### Don't Forget to . . . . .

* Disable all your **antivirus** applications&#x20;
* Disable Microsoft Windows Defender's Real Time Protection etc - So, that we don't have any issues while developing our **exploit** :)

Firstly, first let's start the **vulnserver.exe** and our **Immunity Debugger** as an Administrator User !

Now, Let's attach the vulnserver's process to the debugger and run the program, Meanwhile let's connect to the vulnserver from our attacker's machine and check the available options :)

```
nc -nv 192.168.0.104 9999
```

> By default, the vulnserver runs on port 9999 - If we want a different port we can simply assign the port number while running it&#x20;

Once we connect to the server, we find many available options but how do we know which command in this server is **vulnerable** ?

* This is where **Spiking** comes into picture, we write a simple spike (.spk) script which iterates through the option and crashes the program which can be seen via the **Debugger**&#x20;

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2F9rkfYzNoQB7N6ddgcWPG%2FScreenshot_20230210_134035.png?alt=media&#x26;token=a875ae44-2cbd-4666-930e-bec1a3029e7c" alt=""><figcaption></figcaption></figure>

* These are the available commands in this vulnerable server, so lets start **Spikinnnnn'**
* The tool which is going to automate the iteration part, considering our spike script is called **generic\_send\_tcp**

The syntax is very simple :)

```
./generic_send_tcp host port spike_script SKIPVAR SKIPSTR
```

* Let's write a script for a non-vulnerable command such as **STATS**&#x20;

```
s_readline();
s_string("STATS ");
s_string_variable("0");
```

* And a vulnerable command such as **TRUN**

```
s_readline();
s_string("TRUN ");
s_string_variable("0");
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2Fbrju47yBepmisVrydCRt%2FScreenshot_20230210_135806.png?alt=media&#x26;token=6cfd8ef7-8bb6-492f-a5c7-872b075d96b9" alt=""><figcaption></figcaption></figure>

This confirms that the **TRUN** command is vulnerable - So let's start developing our **EXPLOIT** :)
