Welcome back to Basic XPoint development in this section.
This is the echo section of the course, so we might be getting into some.
I expect a lot of people to be asking me answers.
Basically, egg hunters is not really that easy of a concept to understand, but I am putting it in
the introduction to exploit development Zero Day Discovery class because I am very confident that I
could actually teach you this.
But if you have any questions, please ask on the form.
So we're going to exploit a service called on server dot execute.
It's basically freely available on GitHub.
Made by Stefan Bradshaw.
So all you need to do is download this.
Directly into your Windows XP machine.
Or Vista or seven or whatever windows you chose to use.
And we are going to try to use an egg hunter eventually against us.
But for now, we're going to go right for the standard development process for exploits.
So I want to open immediately debugger.
We're going to run Bone Server.
And then we're in a press play.
Back.
I tally machine.
Less proof of concept.
Hi.
We found out that this vulnerable server initially will crash from approximately 256 letter A's.
And what we need to do is determine whether or not we can exploit this.
A little thing about egg hunters is that egg hunters are very useful with limited buffer space and unpredictable
shell code landing who God knows what within the buffer.
So 800 is actually a very useful tool in this situation.
For now, let's make sure that the service is running.
So here's a tip like you have to click play until play.
Until it's highlighted.
So Python.
Proof of concept.
We've crashed the program.
We found out IP, as usual, has been overwritten.
41, 41, 41, 41.
That's four hexadecimal A's.
So we're going to.
Follow this and.
And we notice we have a very limited buffer right here.
Let me maximize this.
We have a very limited buffer right here.
I know for sure that it's over 32 bytes, which is why we can fit in our 800 inside of it.
But where else will the show code go then, if we can't put it in here except for an egg hunter?
Well, that's the question.
And we need to first follow the other steps.
Explained Development process.
And I will see you in the next section.