All right, so welcome back to Introduction to Expo Development.
Let me check this course.
Yes, it is.
All right.
So we're going to go for two one, which is basically if you read the write up I have on Google Docs,
it's actually using a system called from the Bend date function.
Let me see if I have the source code.
Open source code.
Oh, there we go.
Yes.
So shut up.
So we're calling the show date function and as has a system level command and it runs then date.
So the vulnerability is that we have to overflow the buffer, take control of the return structure pointer
and do a drop chain to be able to call the this call right here.
So first, I want you to go back and I want you to open the debugger using the debugger to load dash
queue.
So as you can see, we're using Jeff, we're not using we're not using debug or extension anymore.
It's no longer supported.
And I want you to disassemble this function right here.
So disassemble show, underscore date.
And I want you to take note of this memory address right here.
So this is the procedure, a procedural linkage table entry.
It makes a call to system.
And normally, this is what I dragged out of the call.
So now we disassemble this memory address.
Now normally this is your got entry, which is your global offset table entry.
So how dynamically linked a Esler protected bodies work is that it uses a method called lazy linking,
which means it doesn't actually know where the system call is until you run it the first time.
And then once it does that, once you run it for the first time, it resolves the address.
So I know that this is the exact same memory address as this, but in many cases that you'll see out
in the wild, this is not going to be the same.
So be aware that you need to copy the memory address.
That's right here.
That makes the system call.
So let's make this and add an entry to our exploit script.
So let's say attempt to dot pi.
Let's call it a call.
And we also have a hardcoded shell in memory.
So what we want to do is go back to Jeff.
So we're going to use the Jeff features or Jeff actually want to use a Jeff features now.
I'm sorry.
I'm just looking at the write up and just multitasking.
Let's see.
So we're going to look for a search pattern
shell.
Oh, right.
So what I'm press are we're out of control C out of it and then we're on a search pattern.
Shell So there's a lot of things that start with the word shell.
What's relevant is not what's within this outer range, which is actually A or C standard library,
but we go all the way up and burn it, go into the binary range of our initialized binary, which is
going to be this memory address.
If you don't know what I'm talking about, let's go back now and type V map.
So we want to search within this started from this address, any at this address right here.
So we're going to look for a shell function within this memory address range.
So we go up and this is our shell function.
As you can see, the next byte or next to by is going to end F for B.
So this is the beginning of the shell function.
So we're going to take note of this two shell equals this memory address.
Finally, we're going to go into ROPPER.
So we're going to try ROPPER.
All right.
Sorry.
That's the wrong container where you go.
What this work is.
Split the screen.
We're going do ROPPER follow to bone, and we need to look for our final gadget's.
So I want you to search for a pop RTI return, which, as you know from previous 64 bit Colin Conventions.
It starts with the RTI Register, then the R.S. Register, then the register and then the RRB register
for 64 call and conviction conventions.
So we're going to look for search step one return.
When I copy this memory address, that equals this.
And then we're going to use search for pop RTI.
And we have a conveniently a pop RTI return address right here.
Pop RTI return.
So at this point it's just another rinse and repeat kind of attack.
So it's going to be buff equals bytes a times 208.
Remember, take a note of this overwrite return based pointer buff plus equals B bytes 42 that's hexadecimal
for B times eight equals overwrite returns stack pointer, the next bytes overwrite the return instruction
pointer, and that's when we're going to land our option.
So we're going to do is buff plus equals pack 64 RET and if I didn't document this before, what we're
going to do is it's actually the same convenient last thing put on from LB Import Star.
I'm sorry, we're using PO tools now, so it's just another way of saying strut crap, pack little in
return.
Or we could have just copy this memory address right here and just like that.
So our next gadget is buff plus equals pack 64.
Oh, actually, I'm sorry, 64.
This is a 32 bit.
You have to put a cube.
I'm sorry.
So Struck Pat could return.
So in our previous video I said Capital L, capital L just means 32 bit.
And capital Q means 64 bit.
So Capital L is a memory address, a four bytes.
Capital Q is a memory address of 6 to 8 bytes.
Because in 64 bit computing, we don't actually use all 64 bits.
We use somewhere between 48 to 64 bits.
So that means 6 to 8 bytes.
So now we're going to do our pop RTI return address.
Above plus equals P 64.
Shell buff plus equals p 64.
This call.
And then we're right back to the our buffer.
So all it does is to even pipe the payload back into like a text file or something and then just have
it read.
So what we can do is we just call copy all of this.
I'm sorry about the previous video.
I didn't actually document that very well,
but now we're going to open another screen.
So, control, be shift five, then I'll attempt to tie.
And once again, to pop the root shell.
We're going to run the command.
Python three a ten.
Oops.
Python three, the two pi semicolon semicolon, type two.
Once again.
So right now it executed datetime as you can see from our source code of two vol press.
Enter again.
ID who am I?
Route.
Flag.
Text.
And we could have read the flag.
But I am not going to reveal the flag until our very last video, which is going to be the answer for
your quiz.