Hello everyone.
This is Stephan and in our last lecture we embarked on a thrilling journey where we took our theoretical
knowledge and transformed it into hands on practice.
Now let's delve into what we accomplished, learned, and practiced.
So in our previous lecture, we focused on generating an assembly program, which we will use that in
this lecture as a shell code.
And our goal was to witness the culmination of our efforts by creating an executable program that embodies
the technique we have been mastering.
So now, um.
We will generate our C code and I will explain that line by line.
So that's a no.
Yeah.
Main dot c here or shell code dot C here.
Or let's actually make it exploit dot c dot c x.
Let's rename it to C here.
And now we will firstly include the include the stdio here and input output and include the string here.
And these are the headers we want to use in our C program.
And we will create an integer main.
So in this main we will firstly use create our unsigned unsigned character code here.
So this is going to be our shell code.
Which we will.
Turn the stack exploit into shell code.
Now with our.
Uh, famous, uh, objdump here.
Uh, so let's actually, instead of writing it, uh, it should be somewhere.
And, uh, as I was, as I was, as I always do, I will, uh, share it with you.
Uh, here.
So.
This is here.
So objdump amp Intel.
Hello.
Here.
So in this hello we will change this into our stack exploit.
Exploit here.
And that's it.
So this is our shellcode.
Now we will copy this and let's actually turn this.
So our stack when we run this we are seeing a.
Output where we are printing the malware injected with stack method, we actually use this stack method.
As you can see here, we moved, passed, moved, passed, and so on.
So I explained this in a previous lecture here.
And now let's turn to exploit dot c.
So we will copy this shell code into here and end this here.
And that's it.
Now we will print f the shell code.
So print F shell code length here length.
And this is going to be.
And here add integer.
Integer.
After that strlen.
Uh, the code here.
Yes.
Actually, let's change this to shell code.
Yeah.
Shell code here.
Shell code.
And that's it.
Now, what we're going to do is we will let's first create this function here with red, as we always
do for this shell code executables and uh integer here.
Yeah.
Integer.
And after that?
Yeah.
I will use another braces again with empty and we will use our shell code here.
And now we will call this function read.
And that's it.
So this code starts with a necessary include directives for standard input output and string manipulation.
Here and here we define an array named shellcode to hold our shellcode at the shellcode, which represents
a sequence of machine instruction and should be inserted with the double quotes here.
And also we have this main which is this is the main function of our program.
It acts as a starting point of execution.
And here we have printf.
So this line prints the length of our shellcode array using the printf function.
So and the str Len function calculates the length of this shellcode array.
And we also have the ret here.
So this line defines a function pointer named read.
So the pointer is initialized to point to memory address of this shellcode array, effectively creating
a callable function from the shellcode and read here.
This line calls the function pointed to by the read pointer, and in a sense it executes the shellcode.
So with our C program ready, we move on to the compilation and execution phase.
Now we will do that with a terminal here.
So we will GCC actually did we created this.
Yeah.
Exploit dot c.
So gcc f no stack protector protector.
The exact stack here and exploit dot c.
That's it here.
So this command compiles a C program.
This, uh, f stack protector and the X stack are used to disable the stack protection and allow execution
from the stack.
And now we will run this here, and that's it.
So.
Running this command executes our compiled program.
As a result, the shellcode is executed and we observe its behavior.
So with a successful execution of our C program, we achieved a significant milestone.
So we have applied our special task technique to generate, inject and execute shellcode.
So this practical experience reinforced our theoretical understanding and sets the stage for even more
advanced explorations.
And congratulations everyone on a job well done.
So in our next lecture, we will continue to expand our horizons as we delve deeper into the intricacies
of shellcode and exploit development.
My name is Stephan and I'm waiting for you in the next lecture.