- [Instructor] So this is the strategy
for exploiting buffer overflows.
Your first goal is to control the execution flow.
The best thing that you could ever see is that
when you run a fuzz test case
and you see that the program crashes, and it crashes at
0X41414141 ... and for those of you who may know
or may not know, that is the ASCII value for all A's.
So if you're putting a bunch of A's into a buffer,
then 41 is the A and you can actually see that
it tries to execute code that is located at 4141 and so on.
So what you have to do first is when you've done a crash,
now you need to figure out where in that buffer
the instruction pointer actually is.
You know, where is it in memory?
Because I'm gonna override a buffer
that I may not know the length of.
You may not know what else is in memory,
maybe after that buffer.
So you might have to overflow more
to get to that instruction pointer,
and a tool that is provided by Metasploit
is called Pattern Generate, and Pattern Offset.
And that will create a pattern for you
that you can put into your code, your payload,
that will show you where in that offset
the instruction pointer actually is.
And then once you have that,
then you can place favorable address in there
to be restored in the instruction pointer
when the function returns.
And then, in that case, you could actually jump
into code that you control, like the buffer itself.
And also, your goal is is you don't wanna crash the program.
So maybe after you're doing your exploit,
and you're doing your work, you wanna return back to
the code that was legitimately supposed to be running.
So in this case we're running main,
and so of course when main exists,
then we're just exiting program.
But, in other cases, you may be several functions
into the stack, and you wanna return back
to the legitimate place you're supposed to leave off.
And so you may need to do some fix-ups on the stack
to fix the problems that you made when you exploited things,
so that you can return to
the legitimate function and keep going.
And uh, an example of this is,
let's say you have a web server.
Let's say you're running Apache,
and you found a buffer overflow
and some part of a patch here,
some program that Apache runs,
and then you wanted to keep that up
because you don't want the administrator
to notice that something was broken and went down,
so you would want to clean that up
and make sure that you can continue on.
So we've talked a little bit about buffers
and the information that you can put in before.
We talked about maybe using all A's
and having that show up in your saved instruction pointer.
Or you want to use very well-defined payloads
that are called "shellcode".
And shellcode does what it says.
It's something that if you run,
it gives you a shell, and it helps you
with exploiting these vulnerabilities.
And it's all very platform and OS specific.
So, if you're running Linux on x86, you're going to
have to know that you're going
to be running against that kind of system.
If you're trying to execute something against Windows,
and you try to use shellcode for Linux,
you're probably gonna have a bad time
and it's not gonna work,
and you probably will crash the program.
And in the case of shellcode for Windows,
Windows is very picky about the shellcode that you can use,
and typically you won't haul the system directly.
You'll use libraries that are in memory.
And so there are shellcode patterns, so to speak,
that you can use from Metasploit,
and there is a command called "msfvenom"
which we'll go into, which allows you
to generate these payloads to do certain things.
And normally what happens is, you don't know really
ahead of time what you wanna exploit.
Maybe you don't know what data is on a server,
so what you want, is you really want a connection
that gives you a shell, that gives you like,
if you're running bin/bash,
or if you're running cm.exe on a Windows machine,
you wanna have that run and then connect it
to a socket that will connect back either to you,
or just open a port.
And in the case of where you open a TCP port
on the victim's side, that's a bind TCP shell code,
you need to listen on a port and then connect to it.
And that's not very useful if
the machine is behind a firewall,
because the firewall could block that connection attempt.
So, to turn it around, we can actually make
a system called "home" back to the attacker.
And so you've got a victim process,
the process actually connects out
to the attacker through firewall,
and that is just a reverse TCP connection.
And then in some cases where you have smarter firewalls,
you actually have to tunnel
that connection over certain protocol.
It could be http or https,
and there's even some dns shellcode.
And then once you have that connection,
then you perform the command.
It could just be to run a program like a shell, or a cm.exe.
And then if you want some flexibility to that shellcode,
you can use "Meterpreter".
And Meterpreter is a whole suite of shellcode
that you could stage that allows you
to do things like capturing the desktop,
you can capture camera information ...
So if you wanna see what's going on in a room,
or if you wanted to even send uh ...
You can even play sounds and do things like that,
find out what processes are running.
So it's almost like a little mini operating system in itself
that all happens within a process.
So here's how to generate shellcode.
This is an example using a utility called "msfvenom".
I'm running msfvenom on my kali machine,
and I'm using the payload "linux/x86/exec".
So I'm actually going to ...
This is the code that if it runs by the CPU,
the CPU will actually invoke the command /bin/sh
which is the orange shell.
There are certain characters that I may need to avoid.
In this case, I'm doing a stored copy, right?
So I would want to avoid a character return or a space,
and then I would encode that using
an encoder called "Shikata Ga Nai"
which is fairly popular.
The only thing is, it's 32 bit the last time I checked.
Maybe at the time of publishing
it'll be different, but it is 32 bit.
And then we're just showing this payload.
So that actually is the shellcode
that you would put into the buffer,
and then when you jump with your saved VIP into this,
you'll actually run this code.