Hello again.
Welcome back to Basic Exploit Development Egg Hunters.
And today we're going to show you how to generate bogus shout out to see if we can find another buffer
for this egg hunter code right here to work.
Remember, we already resolve the issues where they kind of would not run because we jut back 70 bytes
for after right after our jump ESP instruction.
So that way we always land in this egg hunter and this will hunt for our egg, which is built in great
speed.
W00t.
So right now we need to locate a second buffer to see if we can actually find anything.
What you want to do is generate a cycle pattern again.
Of a thousand bytes just to make sure.
We already have that cyclic pattern right here.
Okay.
We will add a new cyclic pattern.
And then we're going to use a separate command in this volunteer application so that we can figure out
what is going on.
All right, so let's call this sheltered.
And then we're going to create another command.
So articles talking to us, talking on the score.
I'm not so a good fox dream.
And then we're to see if we can find this.
And what tools?
Cheetah like must show code.
Best architect make sure to always use to Prentice's IP address is always a string and of course always
an integer.
I received 24 of us and a man.
One that's not close.
Save that.
Let's just take a review of the code.
So remember, we're trying to send this to locate a second larger buffer that we can fit our shell code
into, and then we want the egg hunter to find it.
So let's first just test that we can actually see this that all 1000 bytes of it would actually fit.
So this time we're going to look for try a new command and one of libraries for a burger.
And it's going to find a cyclic pattern that we just generate aspect shock code.
So let's close out this.
You start?
This terrible server.
The two accounts that began.
So.
Find a bona fide amnesty.
Let me maximizers.
So we did locate another section of the buffer or open the program itself that has a thousand bite length
right here.
So we know that somewhere else in this program, we actually have a way of 800 to reach it.
So go back.
Now if you concept.
And let's make a show called
Woo Woo plus 1000 days.
Remember, what is our egg?
The egg hunter scans virtual outer space for bytes at a time until it finds a double instance of the
egg.
Why not a single day?
Well, the suns and moons align the correct way.
You might run into the situation where, right within memory, it would have been just a single vote.
And then your egg hunter would mistakenly try to execute it, causing the execution to be diverted.
And you won't get a shell.
That's why they use two eggs.
Let's see if I'm doing our thing correctly.
All right, let's detach the debugger.
Oops.
I mean debugger.
File server.
Darren go to.
Our speed instruction at a breakpoint by clicking at.
Hi.
We had our break point.
Step into it.
Short jump.
To our egg hunter.
And let's put a museum up for a bit.
Let's put this.
Yes.
Put your breakpoint in a second.
Command S.A.S..
And keep incrementing.
Skip over here.
As you can see from the right, this is how the country is constantly incrementing.
So press play to jump over to this section right here.
And look, our is right there.
Within the index register so successfully located eg.
And then it was have to execute it, which is now the A's.
And now we can put our malicious code inside where these A's are at.