All right.
So welcome back.
And since we now finally found our favorite gadgets, we are going to go construct our rock chain.
So to basically in 64 bit exploitation, you need to type something like struct pack, single quote,
little Indian capital.
Q And then your memory address.
And the reason why you're doing that is because lowercase capital Q means double long little Indian,
and that means a eight byte memory address, which obviously we use only up to 48 bits out of 64 bits.
That's six bytes.
So to construct our wrap chain, it must be fed backwards.
So it must be like this.
So struct that pack.
Ox capital q return
struct pack ox capital q pop rti struct PAC lowercase capital Q I mean lower sign capital Q.
So struct pack lowercase capital q.
This call.
Struck that packed lowercase capital q.
Exit call.
So using this, we are going to write our payload again.
So make sure we just copy and paste this back into our exploit box.
And I want to step through the functionality of our program because I want to explain how this works.
So we're going to go back into our exploit.
We can leave wrapper right now
and our exploit.
So we.
And then run Python 3.5 to create our new payload.
Let me see what happened here.
Oh, I forgot to import.
I'm sorry.
Airport cook.
Success.
Let's do this again and I'll exploit.
We exploit that pie, and now we have our new payload so we can help stop it.
Oh, I don't have the hex pumped up, but what we want to do is go back and zoom in to our debugging
session.
So we're going to set a breakpoint or actually we're going to disassemble our main function, which
is me.
Just assemble, underscore me.
And we want to put a breakpoint at the return because here is where it gets the string and ingests it.
This is where it prints out our little challenge, which, as you may have known, was just say Hi,
Bob.
So we're going to put Breakpoint at
Mean plus 60 bytes so we can observe our wrap chain.
Finally, we want to run it with our payload.
So we first have our payload and we hit our first return instruction.
Which is this?
Single step.
Single step again.
Let me see.
I must have done something wrong.
Let me rerecord this.
Aren't everybody.
Welcome back.
So in my haste, genius, I actually forgot to do something that's completely critical.
So I'm going to show you what I did wrong.
So previously, I actually just did a bunch of lines of Struck PAC, Struck PAC, but I forgot to add
it to the buffer.
It was just an honest, you know, an honest mistake.
You know, I'm just like in a rush, you know?
But what we can do now is we can now copy and paste the payload with our drop chain.
So what's going to do is it's going to write into the stack backwards.
All right.
So it writes our exit call and then our sis call, then our pointer to our shell and then pop the shell
variable.
It's an RTI register according to 64 bit.
Calling conventions executes a return.
So that way the stack is aligned and then it will then run the payload.
To better explain this, let's copy and paste the exploit code back into our session.
So exploit phi let's delete all this
python three exploit py unless we have our payload right here and we're going to put a breakpoint.
So new debugger phone dash two and then we're going to disassemble, create, underscore me.
Now the offset to the return is 60 bytes.
So we're going to do is we're going to put a breakpoint at greet me plus 60 and now we're going to ingest
the payload.
So let's control busy and let's observe how the wrap chain works.
So we hit our return in this direction pointer and we have another return right here because it's written
to the top of the stack.
Right?
That's I for single step.
The next instruction.
Now our return is within the instruction pointer.
Our next instruction is Pop RTI.
What are we popping the pointer to the shell.
So single step again.
See, the stack pointer now has a variable binary shell.
So we're in a single step again as I.
And now we have the pointer to Binary Shell and the RTI Register, which is the first argument because
we're basically doing this.
Let me show you.
We're basically doing this system, system by shell.
That's basically what we're doing.
So press continue and you see that it actually creates a child process.
So what's going on?
I'm sorry, what's going on?
So basically we created a child process that runs as route.
However, it forked away and we didn't give it a command, so it just immediately died.
So let's run this exploit without relying on that.
The debugger is actually like a headache to actually attach or catch, run, catch statements and to
debugger.
So we're going to do is tap payload semicolon cat.
We surround this with braces pipe it into volume.
You press enter again?
ID who am I now?
Less route.
Not flag.
Dot text.
Big cat slash fruit fly text.
If you're wondering where I'm getting this these flags from.
I actually got it from a comic book series called Punisher Max, authored by Garth Ennis.
It was actually printed in 2007, and it was a villain named Barracuda.
And one of his lines is, I'm Barracuda.
And therefore, the theme most members find out a little too late before he murdered somebody.
He's actually one of Punisher's greatest and badass villains.
And, you know, like, he's just not someone that you want to mess around with.
But Punisher actually killed him after cutting off his fingers, taking out his eye, chopping off both
his arms.
Setting aside as an exploding vehicle in an M60 dueling battle.
It was crazy.
I don't want to ruin the sport for it, but I highly recommend reading this.
The print I don't think is no longer in print anymore.
But this was the flag when I was making this the petting zoo, DEFCON 702 CTF.
And in the next video, I'm going to show you how to redo this using pone tools.
So make sure to submit your flag in the challenge.