Welcome back to Advanced Exploit Development.
And in this section we're going to show you how to construct a rope chain using energy buggers moana
dot pie module.
Now from immunity to bugger.
Type explanation, Pomona.
Rap dash start out deal dot dash CP.
No, no.
This will take a substantial amount of time and processing power.
So I am just going to go pause the video until we get to that point.
All right, so we finished creating our Rochester text file.
This is why I told you to use the overview lot, by the way.
So we have a the major rectory for our debugger installation.
You have to run immediate debugger and administrator mode for it to write files.
So let's go into a program files.
Immunity.
Bugger.
And here we will have a file called Rob Chains.
Open.
And if we maximize this.
You can tell that now we have our wrapped chains set up right here.
We have multiple rock chains, actually.
And we have it in different languages.
What we're gonna do is we're going to copy and paste.
The Python one right here.
And there's actually an easy way for us to share files between a non hacked window machine and a Linux
machine.
I will show you that right now.
So let's go to the terminal.
And here we're going to make a director for share which already did see file exist and only use impacted
assembly server.
Cher.
Gaslight.
Cher.
Now from your windows.
Windows are to open up.
Run.
Oops.
Commander excuse.
In type net use the.
Double backslash 1921681221 ten.
That's my kind of little machine.
Backslash.
I mean.
Yeah.
Backslash here.
American police successfully.
And now we're going to navigate to our immediate bunker installation directory.
Let's see.
And then we have our file, Rock Chainsaw Attacks.
So we're going to type copy rob Shane's text to Z.
One file copy.
So go back to your Linux box.
As you can see, we already authenticated and transferred a file.
I'll share.
And we have a text in their name.
Russians star text.
So else.
Rob.
Oops.
This is the old one, by the way.
And I'll share.
Rob, Shane's our text less and go down all the way to Python.
Worse as python right here.
So we're going to copy and paste this.
Into our proof of concept file.
Let's see.
Copy.
Oh, server C2.
Hi.
And then because this is not correct.
Python whitespace formatting.
I want you to.
Decrement each one by two spaces, each per line.
So I'm going to do this manually, but.
I will pause the video right now and have you will restart the video once I'm done.
Okay Welcome back to class
to test your new file type python nida pi c is a strut that's not defined.
So Python got something or.
Well, you made a debugger for yourself and we need to import the struct module and we also need to
import this module.
Python pie.
Nothing happens.
Good surfing is working just as planned.
So at this point, let's see.
Hello again.
So now we can modify our attack code using my previous example that I actually tried before.
You know, long server.
Oops.
You know, near that pi from our new Europe.
She.
And we need to make the following changes.
So for padding, we need to subtract.
The four bites right here.
And we're going to use it by a life of the rock chain, because we are replacing what's going to IP,
which is the four bytes, a VIP with the length of the rock.
So what it's doing is that all of these gadgets right here, we're going to shove all of them right
where we're going to overwrite the IP.
Now, we we covered overriding IP in my previous class introduction to exploit development, but we're
going to replace this IP variable with our ROP shape.
And because of that, we need to adjust our four bytes with the actual life of our rock.
So minus subtract the four length Rob underscore Shane.
And.
We're so skippy.
We now replace that with the rock chain rope under store chain right here.
So let's go give this code a test run to make sure that it's all working.
Let me see if I miss anything.
All right, give this a test run to see if this code is working.
And then we will go back.
So restart a mirror debugger.
You can close this.
We already share the file.
Um.
What is this?
Yes, I know that.
I didn't enter my license.
I get it.
Debug restart.
Play.
And we're just going to verify that the stack is executable again.
And lo and behold, the staff's executable.
I want you to look at something.
If you look and you mean to debugger, notice how, says Khalil, 32, the virtual protect.
That means that at the rob saying we finally made a function call into the kernel 32 dot dl virtual
protect function at which re enables the execution of the non executable bits.
So the non-taxable bill has been removed and we now restored because for before with a system wide dep
enabled like it is now, we stopped that or not.
But now we're able to exclude these knobs and then reach this specific memory address, which then calls
the virtual protect function, which now makes the task executable again.
This is the point that I wanted to make when we were explaining rock shading.