Hello, everyone, welcome to a new video of our binary exploitation series.
Last time we were able to execute a reverse show and we tried a few commands from our neck up connection,
but we had a problem.
The memory address of our message above that has our show code will change every time when we have a
smaller address based layout randomization enabled.
So we need to brute force the memory address.
But before we do that, we need to also find a valid memory address for our string format function.
Because if you remember from before the string for math function, if it doesn't find a valid memory
address, it will crash.
It's easy to do, though.
We can use a system function which the address is not changing.
So if we opened GDB first, let's make sure that our US is Solares turned off.
I mean, turn down, sorry.
OK, now, if this is to run, that means is turned on, if it's zero, that means is turned off.
So far, so good, this child, Dee Dee Dee Dee, make sure his two hours on now before we all break
on, man, I'm running our program.
Let's check P system.
So this is an area that we can use to develop the literacy function.
The system function is using this period so we can use this if we do quit and start again.
And then.
I forgot to turn on this, so.
OK, reconvene on our program.
It's still the same memory address like here, check Jack Samer, so we can use this as a VLADIMÍR.
That's fine.
Now, what we have left to do is to brute force the message Buchmann.
All right.
I already wrote my program here.
So what I'm doing now.
We are going to generate two bytes, the two bytes in the middle, because we know the bite on the right
and the left.
Is there fixed or not changing?
Right.
They are B zero.
And we already said why we are choosing Bezier because if we choose easier, we will jump to the very
beginning of our show code, which it has no bite.
So we have chosen before v0 because of that.
And the last byte is zero zero.
So we need to generate or loop through two hundred fifty five numbers.
Each will be hex byte.
So we have our first random byte here.
We're using the format function to turn it into hex like zero six zero five zero six two zero three
and so on.
And then we go into another loop for our second byte.
Same thing.
We're using the format to change it to a real to an actual hex zero six zero five.
And then we're getting only the number.
We don't care about the zero X, so we're getting the second.
We're we're from the second.
Tudo from the third, I mean, to the last because 012 so it begins from third to the end.
And then we use the hex solidify you funded here from Ben asking for context.
So we're using the Olympics to the function to change it into a real bilic rabbis.
So we are able to send it and then we incremental by one on by two here plus equal.
And then we have our temple address, which is the fixed first byte, this one at the top and then the
two in the middle byte, one by two and then the second fixed.
But then we will have Hexa lefi this time.
This time we need Hextall Figes just for printing it.
That's all for not sending T one.
So we are converting it into a hex so we can print it to the screen using the Vistage outright function.
And then we use this to dissolve that flush because we don't want the screen to keep printing over and
over and over.
Right.
We will get a lot of lines.
So we're just using flush to keep it on the same line.
And then finally we have our payload.
But this time we are using this system address, the one that we have here.
This is the address that we got from the function here from David.
And then our junk from everything the same as before, but the last address, which from before, it
was the message above, we're not going to use this anymore.
We're going to use this to address this one, which is had it has a generated bariatrics address.
Right after that, we send it, use it using to send to function.
And here's the thing.
This is extra part.
So the first thing is when we send it and we get a reversal, how do we know that this byte actually
worked?
Right.
Because there is no way we can do we can know this.
Our program doesn't know.
He will keep trying all the addresses without knowing.
So in order to fix this, I'm going to pickle.
An empty file.
Just to touch you out, OK?
After that, I'm going to.
Open Tsipi dump using Alisson on the port, just filter on port one, two, three, four.
I'm using it for old Yassky and then excuse me and then I will send the output to a file called Tsipi
out.
So if I keep this running like this, it has got zero, right.
So if we check.
If we come here.
And.
Fred, you realize the scale and then keep out.
You right, it's one it's empty now, so if we receive anything, it will the size will be more a bit
larger than be larger than one.
So I'm using this function here, always that stat to see the file disipio kind of checking if it's
larger than one.
If it's larger than one, that means we are we receive something and then we print.
We got Shell and then exit.
Right.
Oh, this should be here.
Why do we have sleep here?
Because the UDP is sending the packets very, very fast enough like DCP.
Please remember this, and we need to sleep at least zero point zero three milliseconds before each
attempt.
If you don't do this, you're not going to success with your with your packets.
I really tried this before and didn't work, but if you do sleep zero point zero three, at least it
will work fine.
All right.
Now let's try.
I'm going to quit here and I'm going to run our program.
Let's let's first check if it's running.
It's not so OK, sort of one, two, three, and then here I'm going to.
First, we need also to listen on Ngarkat.
One, two, three, four.
Uh, I'm sorry, this should be
our local address, so let's leave it here for now and then.
We can start our program.
Oops, we got worse in Europe, need to imported
beef function in.
All right, it's going to take some time if you know it is here we have the first bite on the left.
It's busier.
That's fine.
This is a fixed bite, the very last bite, the zero zero.
Because when we reverse this, it will be the zero zero will be on the left, right, zero zero.
And then the two bites we are generating and then finally the visual.
Now I'm going to keep this running and I will pause the video from now and continue once I get something
right.
Going also to get the Tsipi dump.
Oops, and put it here.
So you can get it, you can see what exactly I'm getting here, so we will like this and I'll pause
the video and I'll be right back.
All right, I'm back.
We got our shell here if you see his address and then we got a shell.
This is not the exact address.
It should be zero zero forty one.
The 30 is not going to be very accurate because it takes like half a second to try again.
And then we have to wait for our DCP to captured one packet like it did here.
Right.
So this half seconds, this 30 will be changed, right.
It's so fast.
It's UDP unless you want to make it slower, like you want to make it safely for one or half second.
But I wouldn't recommend that because it will take longer time.
It took me like, I don't know, like around 15 minutes or something to brute force the address or even
less than that.
So we have a shell here so we can actually try some commands.
That's good.
Now let's actually attach our GDP, our GDB, and
let's let's find the process idea.
First of all, our server.
OK, that's.
And then GDB Dushka.
And then Padget.
OK, now let's find the message, but.
All right, as you can see here, the 14 one is correct here, right?
So the only thing that was is not is the three, because it was it got 20 and then we got our show,
but it took half second for the Tsipi to capture the one packet.
Then it became 30 because it was very fast.
All right, this was the last video of our binary exploitation series, you'll find both the source
code of the C program and the Python script on my get up channel here.
Thanks again for watching and see you in the next video.