Hello again.
Welcome to part two of A Hunters.
And this time we're going to generate ourselves cyclic pattern so we can locate exactly where we are.
Just about to overwrite IP.
So.
NSF Pattern Score three 956.
Copy and paste this up there.
This is commonly known as a cyclic pattern because like I said in earlier videos, this cycles between
every.
Four bytes, every four characters.
And we're just looking for the moment where we're about to overwrite IP as usual.
If you guys have watched the other videos beforehand, you already know what's going on.
So let's just restart the debugger.
File.
Run vulnerable server.
Double click.
From concept to.
That's not working.
That's because you need to play one more time and we get this value.
The value is 63, 41, 33, 63.
I think you guys already know what to do with this.
But basically we are now going to use an offset to locate the section where we're about over IP.
So it's 63.
41, 33, 63.
And we have an exact match that offset 74 Earth Hunters.
This offset value is going to be very, very important in their development process because it's going
to we will eventually have to perform a short jump to reach our egg hunter.
To be able to activate the egg her heart, allow it to scan virtually address virtual outer space.
So let's just verify this member standard exploit development process that this actually works.
Sober a change you will strain.
I'll have these files available for you.
Eagle strain equals A times 70 plus B times four plus C times 256.
Minus four -70.
All right, let's restart the process.
Double click play.
Python proved to play again.
And we verified that we found 44 inches 42, 42, which is basically four half decimal BS.
I'm pretty sure all of you have already done how this works, but now we are proving to be able to hijack
execution by just giving a little immunised that has been reverse, then readdress to something like
GSP within the program.
Restart this.
Mobile phone server.
Toklas play.
And you use the command.
MONA Jump.
Dash r gasp.
This will take a while.
All right.
Click on View a top log.
And we are going to look for a job construction that does not have solar, does not have a safe structure,
reception handler does not have non equitable bit, which means you're able to bypass SLR and data execution.
Prevention.
Now, remember, this is a Windows XP box.
Windows XP never had these working protections.
Not until Windows Vista started being released.
They have to have outer space layout randomization.
So out of all of this, you can just use any of these.
But I'm going to choose the first one.
And I'm going to copy the clip for the address.
And then let's use CPU again.
Minimized to see a better.
And we're going to.
Go to or just go to go to expression.
Don't click on this looks.
Double click to add a break point right there.
And we're going to see if we can hijack the execution.
So let's make a value.
ESG equals.
So let's take a look at that.
That was in little India in the memory interests of 62, 5011, F in little Indian, it would be F.
11 5062.
So we're going to replace the BS with junk DSP.
And let's try to find the concept again.
Proof concept again.
So.
Here.
Press play.
My phone.
Of two.
We hit our break point, as you can see.
We're going to step into this one right here.
That's two buttons away from the play button.
And now we landed where our Caesar at?
Now we will continue to do things such as brute force and the bad characters for information.
We already did this before and the only bad chapter was in no bite.
There is nothing else you should be worrying about.
But for the general exploit development process for exploiting water ability isn't one of our applications.
You must always focus on or bad character analysis.
But I will tell you right now that the only bad chapter in this program is no.
Which is.
There.