Hi, everybody.
Welcome back to Basic Exploit Development, and we're going to get started with our assault mail module.
Now, before you do that, I want you to try to do a command.
While you're running the pop three server.
So go to start.
So products.
So mail.
Right click on a sample configuration and run as administrator.
Click Yes Control.
So the port is open and I want you to type the command net show will actually go back to start clicking
all programs.
Accessories command probe run as administrator.
Yes.
I want you to try the command.
That show firewall set up mode to disable.
Command has finished excessively.
This disables the internally built firewall so we can contain for our penetration test of that's all
male and go back to your the distance.
And type in the IP of your.
Let's try to net cap to it.
Net cap Dushanbe.
One, two, two.
What's it say.
122, 61, 25.
Yes it's running it.
Try for 110.
Yes.
It's running.
Good.
Now go back because everything's working now so we can just flood the system for our buzzer.
And run immunity.
Bugger.
Right Click Run administrator.
Yes.
File.
Attach.
Saw by name.
So now.
And then because it's paused.
Press play.
Now go back to your calculus machine, and I want you to take down the script.
Yes.
Gimme some of that buzzer.
So this is going to increment the buffer of a.
So we're going to send to it by 200 characters each time it sends to it.
As you can see, it just sends the string of A's to our target IP address at four 110 and then it quits
the session as soon as it attempts to send the string, because that means that program has not yet
crashed yet.
So let's run this.
Let's see.
How many times do we need to do this before it crashes?
Now there is a weird quirk about the song.
See now the problem, right?
Somewhere within the 2700 range to the 2900 range, a small crash.
Finally we see a crash.
So let's go back now.
Because of the way that we wrote, the python code is actually somewhere just over 2700 bytes that crashed,
not 2900.
If you look at the script.
Because with just a touch of buzz.
When I send it to Stan it out.
But it doesn't actually send out a buffer to 100 days.
Now, go back and I want you to look at something very, very, very interesting.
Notice that the extended instruction pointer, IP says 41, 41, 41, 41.
This leads to the possibility that we might be able to hijack execution of this program if we replace
this with something like a jump DSP call or jump index.
It's a very interesting situation.
And if we go to the extent of Steph Pointer and following, dump your notice as written by hexadecimal
letter S, that's X 41 zero by 41.
And we have some buffer space to play with.
So this is the first section of -- Mill and we are going to continue to work on this until we build
a successful proof of concept exploit.