Hello again.
Welcome back to Rob chatting and we finally re-enable that non executable bit to be shut down.
We disable DEP in our previous section as you can see right here we bypassed all the knobs with enough
for executing and we call it virtual protect.
So what we're going to do now is generate our shell code to generate our shell.
So we want to use command MSF venom dash p windows mature critter reverse TCP our host my attacking
machine 4444 eliminate just an all by access function equal thread format python.
So let's copy all of this.
Now.
No new.
Well, actually, let's give it the variable.
Shoko.
Sorry.
Let's just regenerate this again.
So just copy the show code.
Now new
insert the show clip right here and then we're going to modify our payload again.
So let's just go back to my previous notes.
And we're going to change.
Let's see.
I'm going to change the padding string from the subtract one, which is the break right here replaced
after a shoutout.
So if the length of our show goes a minus or backspace on one line of show code and for the break,
we're going to enter show code right here.
I hope I'm not going too fast for everybody.
If I am going too fast, please review the videos or just please add a question to on Udemy on the discussion.
And now let's start.
MSF Council.
Years Miles high handler.
Its payload windows mature for reverse TCP.
Site Host 0.0.00 as a session of Show Missing
Run Dash J and let's restart.
You mean debugger again.
So click on debug restart.
Yes.
Press play.
And Python.
Python knew that pi.
Press play again.
And we cut we created a mature procession.
Keep pressing play.
An execution will drive her to the show.
Sessions such as this one.
How?
Let's see if we can run a command system.
Cashed up.
Excellent.
So we just covered rock chaining.
This is a very, very simplified version of rock chaining.
I actually prefer that you guys understand the intricate details of how rock chaining works, and there
are plenty of resources that I will show you later.
Links on how rock chaining actually works because this is basically easy mode rock chaining disabling
DEP by using Mona's rock module and before Mona, before MSF rock, which is another Metasploit tool
that was used to create rope chains, we had to manually craft our rock chains and it was basically
like finding it was like navigating one of those paper mazes that we had when we were in elementary
school for pencil.
We had to call specific gadgets in a way where it would take us and align our stack pointer to where
we want to call virtual protect to shut down DEP.
So thank you for your time.
This is the end of the rope chaining module and please see the additional resources I will be adding
on rock chaining.