Hello and welcome back to Advance Development, and in this section, we're going to show you how to
seize control of the structure exception handler.
Now, structure reception handlers is like a last resort for Windows applications where if we can overwrite
the stack in such a way that it triggers an exception, then the structure exception handler takes over.
Right now we're going to first test our geologic media player application.
So let's go start geologic media player eight and attach the process.
Make sure to remind me, debugger administrator.
The click file attach.
And it's on the bottom attach.
Now, make sure you step through the exception for shift F nine.
And then Pressplay.
So we're going to try our first proof of concept, four hundred and four a.
On we try, I call my father, we try to call it anything you want.
And then click on list.
Top 40 open.
And we have an access violation.
However, we did overwrite let me maximize this.
Oops.
Let's try this again.
I mean, you better file.
Theologica.
One program.
List.
And let's look at our top 40 and through ufology generated and notice how we overwrote and it's been
converted into Unicode.
Forty one and forty one zero zero forty one zero zero forty one in Unicode encoded applications such
as this, the Unicode, our strain, our malicious string is always prepared with no bytes.
So let's check our structure exception handler Shane.
And we have yet to write anything to it yet, so let's go increase the size of our buffer to five thousand.
And then restart.
It was running it's loading all the steel.
Click on list.
Oh, we have in Python, we try.
Open.
Notice that we have Unicode, a house and all of our registers.
So what you want to do is shift up nine.
Well, actually, first check our structure exceptionality chain.
We have successfully overrode the structural exception handler with zero zero 40 one zero zero forty
one, that's Unicode for two Capital A's.
Basically, what we have done here is overwrite the stack in such a manner that we trigger the structure
exception handler now that we can actually find our Unicode strings of two A's in Unicode format, we
have basically found something interesting where we can supposably we could take control of the structure
except in Handler to run our own show code.
So let's go back to view C.P.U.
And if you were to click on one of these registers like X, right, click follow and you see that's
overridden with multiple, multiple Unicode codas.
So let's pass the exception for shift of nine.
And we can see let's go back to our Essakane.
We have successfully overwritten once again.
This memory address for our structure, an exception handler.
Now we need to verify that we can do this and what we can do is create a cyclic pattern using metastable.
So let's create a cycle pattern.
MSF pattern create life by a thousand to share pattern, not text.
So we take a look at it, share pattern, not text, we have our cyclic pattern and we're going to share
it right now.
So we're going to do IMPAC it sort of rematches block server share dot slash share foder.
Then go over to the window side, let's see that use the double backslash, one or two, one eight one
twenty two one 10 backslash share.
It's already in use.
So we have our pattern, so let's do copy Zee colon backslash pattern, that text to our current directory,
which is the desktop.
Yes.
And let's watch place.
These aids were a cyclical pattern, so controlled open go to pattern text.
Copy all of this.
Evil string equals quote.
And let's regenerate the file.
So let's restart this shortcut to restarting the applications control of two, yes.
Pressplay.
With the click on list.
I want to lower our cyclical pattern.
I want to show you something that's very interesting.
I want to show you something that's very interesting, because when we try to locate CPAC, our reception.
If we try to use this to locate our Chalco buffer from our psyche pattern, notice how this will not
be viable in metastable framework.
It's a quote from this play framework's pattern offset.
Thirty nine year old, seventy two, and it's not going to find any patterns because it's encoded in
Unicode, see no exact match, just looking for a likely candidate.
So we need to use immunity debugger now to walk through the stack and see what it can turn up.
So its mission point Mona, find MSP thus find the most basic cyclic pattern.
And your computer is going to slow down or freeze momentarily, and the reason why does that is because
it may debuggers scanning throughout virtual outer space to basically look for identical pattern.
But if you look right now here before froze, it says it found a overwritten of Unicode cyclic pattern
on address zero four one zero zero thirty six offset.
Five hundred and thirty six a.