Everyone, welcome to this new video, uh, in our software exploitation.
Series of videos, so in this video, we'll take an application and, uh.
A local client application, and we'll exploit it, but before I do that, I just wanted to explain
maybe one important thing to keep in mind is when it comes to exploiting applications or software,
we have three, I would say, especially when we are talking about, uh.
Applications or software, uh, running on the user side, not anything related to the kernel.
OK, so the way we can exploit them.
It's three ways, in my opinion, maybe I missed some one of them, but I think there are only three.
So one of them is by, uh.
By exploiting the client, so exploiting exploiting the client.
OK.
And this is a local exploit.
So what happens in this case is you target the client application and you exploit it.
For example, a user running, let's say, a multimedia application, you send them a malicious file
which gets opened by that multimedia application and you take advantage of a vulnerability in it.
And that's what today's video is actually going to be about.
Or let's say you send them, uh, let's say a word document or a PDF document and they open it with
their application.
And you take advantage of that or let's say take another example where you.
The.
Use, for example, let's say.
Uh, what do we have like?
I think those are all those pdaf worldreader, uh, maybe like an image processor or an application
that opens an image any any.
Client application that could be targeted on the local side, we'll call it like a local exploit.
OK, sir, they are targeting the client application this way now.
Exploiting the client could be done locally and it also could be done remotely.
What does that mean?
So we could also do exploiting.
Declined.
OK, but this time it will be a remote exploit.
How is that happened?
So this one, let's say, like we said, multi-media application, right, we can do that.
We can say like a word processor.
Or let's say a PDF reader or something like that.
These are all options now in this case.
Think of it like this.
Your client goes visit to visit a malicious server.
So now it's kind of a remote exploit.
Again, your client is now doing the visits or you are visiting a site or a server or another location
and your application gets exploited.
So this is what you will let's say an example, could be like the browser if you browse, let's say
some evil website, like browsing through an evil website that will happen or maybe connecting, because
this is also going to be an example later, connecting to an evil IP server with.
With your typical of the client, so your activity is the client, that's it's a client application,
that's true.
But it's getting exploited by visiting that remote site or that remote server.
OK, so I would like to call it on a remote exploit for a client application.
I could be wrong, but I like to call them that way.
And finally, exploiting, uh, exploiting the service or the process or the application, let's say,
remotely.
So this is completely remote.
OK.
And an example of that, like exploiting the.
Uh, let's say a running server running a server or running like running, let's say a Web server.
We will see some of these examples actually.
So the server is running on a remote computer or on a remote system, and you remotely are able to send
some crafted data.
And that data gets, uh, that data takes advantage of.
A vulnerability in that application.
OK, and exploits that application for you.
OK, so these are the three ways of exploiting these applications.
Again, I'm not talking here about any kernel level stuff here.
We are just talking about applications in general.
So clients could be divided into two local and remote local multimedia work PDF, anything like that
remote.
It's when your client application is actually visiting an evil site or a naval service or an e-mail
server or anything connecting.
Who an evil.
Service.
OK.
This is when this happens and here we are also running.
Running a service like service, running remotely the service, yep, good.
So these are all could be considered like.
Client exploit the different exploitation methods will cover most of them, by the way, I think we
are going to cover, if not all of them, actually.
OK, so these are just some notes to keep in mind.
So today, our.
Our example is going to be on an application called View Player.
It's a multimedia application.
OK, so we'll play it.
It's a multimedia application.
We are going to.
So it falls within this category.
OK, so we are going to see how we can exploit this on on this window system.
And this is going to be for demonstration purposes only.
You will see what I mean by that later when we move in through the the explanation and the demonstration.
So we created this and this is, by the way, all of this is on my GitHub, so you can find that this
is version two point four nine.
So make sure you have this one.
There could be, uh, other versions vulnerable, but this is the one I'm going with.
So we'll use this code to create this bad.
And three, you find them.
Three, your file is, let's say, uh, the file, which which is supposed to contain a playlist, but
it's actually not going to contain a playlist.
It's going to contain some junk data to exploit and take advantage of a vulnerability in this application.
OK, so code is very basic.
We are going to create three thousand bytes of ace, put them in this payload called, uh, put them
in this payload, which is called actual payload, then open this file in right mode and then write
this payload into the file and then just close the file.
So that's all we are doing.
OK, and here, if we press at five.
It will create a file for us.
We could even write.
By the way, maybe, uh, print, uh, file created.
Success.
OK, so we can do that just so that we know it's done.
OK, so we now have this file and now what we can do is go to the application and open the file and
see what happens.
So as you can see here, something's going on and the application crashes great.
So it seems the application is vulnerable and actually it is.
I know it is.
But again, the idea here is to explain these concepts and techniques.
Not like to find a zero day in these applications, so let's get our debugger and start playing with
this.
So let's get the debugged.
OK, and load our application.
And yet, here it is, you need to navigate the location.
Just hit OK for these for now.
And we have our application running, so let's the let's run it.
Stop the application from within the debugger, OK?
And then from within the debugger.
Go load that file, which is about, uh, playlist.
Let's do that.
My system needs a reboot, I think, uh, yeah, so open, let's see what happens so we can see here
the application paused and it's saying access violation when executing forty one, forty one, etc.
And that's because there is no other called forty one forty one forty one four to one.
Now we can see E.S.P was overwritten with AZ.
We can see Eddi has some ace pointing here.
We can also see Essiac excuse me, also got written with some A's here and we can look, if we look
at the stack based on E.S.P, this is the top.
We can also see that we have a lot of a written word on the stack if we also go to the dump.
We can see these are all A's written, so we have a lot of ways we can see here, there is a lot of
them being written work on on the system, on the stack.
So we managed to crush the application.
We managed to take control of some registers, and we also managed to take control actually of IP,
which is very important for our exploitation.
So what what does that mean?
It means we do have control over, let's say, a register or IP directly.
So it's a it's a vanilla buffer overflow.
That's what this is really.
And that's why we have direct access to it.
Now, our problem here is.
In the previous example or in the previous videos, which we went over, uh, we kind of knew how much
bites that we need to write in order to reach this location or to overwrite on IP.
In this case, we don't.
So we are now going to introduce another tool which will help us in that way.
I know we may be mentioned moaner in the last video, which was again, which is created by Peter from
the current team.
But in this video, let's take another advantage of Mona and see how we can use it.
So what we need to do is we need to figure out how many bites I need to write on top of the stack in
order to overwrite my return address.
What does that mean?
Maybe I can, like, draw a basic graph and, uh, I must paint like a basic figure to explain the idea.
So if we get this and let's say this is our stack.
OK, so let's consider this is our stack and let's know, I want this here and now.
Let's say let's consider maybe this is where our just to make things easier.
Let's say this is where our return addresses and let's put return here.
So you're right.
OK.
So I'm.
Yep, that's it.
So this is our start and this is what our return address, which is the one that we want to overwrite
with.
Wait a minute, let's use another car, so, yeah, we want to overwrite this with what?
With those A's, right.
We want to override it with zero x forty one forty one forty one forty one.
So we want to overwrite this with this value or we did actually override it with this value.
But we want to find.
What is this location that I need to overwrite with this family or how how far is this from the top
of the stack, for example, or what is the offset that I need to.
Add to the stack in order to reach this location, so we are looking at the.
Here, how many bites do I need to write?
OK, how many bites do I need to write?
In order to what, override the return address?
OK, so let's say you are going to start writing from from here.
Let's say from here you are going to start writing.
OK, how many bytes do you start writing from here all the way down to override these four bytes?
How many?
We don't know.
We in it sometimes it's not easy to calculate, like just manually like the case we did in our test
example.
That was a basic example.
So it was easy to calculate.
But in this case, we need to find another way to do that.
And thanks to researchers such as Peter, that was that's now easy to do to do so if we go and like
Romona.
We'll get the help about all of this, that, uh, this is, uh, all the commands that you can use,
everything here I'm going to just set I want to make sure what I said to my desktop, OK, I'm going
to delete this just so because these were used in the previous video or maybe for my students in class.
So I'm going to do that, delete that and now generate some data again.
But before I do that.
Let's make sure we have our working directory or working folder working order set correctly, so we
have users user one, I think mine is user one.
Let me just double check.
Yet I will use that one and, uh, then we have to stop.
Yeah, let's go.
OK, and then we have Miller.
OK, so we are just to make sure all valid parameter is C users test a new value parameters the same.
So it means we already had that.
I just wanted to make sure.
Great.
So what are we going to do now?
We are going to use the model command.
OK, and we are going to use the pattern, create a command with it.
So we want to create the command pattern so we can either do like this pattern and then create and then
say three thousand we can do.
Is that three thousand.
Yeah.
And say three thousand, we can either do that or if you don't want to, you can just type.
That's also similar to talking patriot.
So now pretend that it's going to it's going to create that pattern, which is now stored in the monitor
directory.
Where is this?
Uh, yet let's go to our desktop.
OK, now one thing about this is let me open it.
What is this and why are we going why are we using this and why are we making this?
So this tool will create a pattern where no or by contiguously after each other will appear twice in
the sequence of bytes again.
The idea here is we are going to create a sequence of bytes depending on the size you provide.
We said three thousand and there will be no four contiguous bytes similar in the same pattern.
So it's going to be unique within that pattern.
Any four bytes within this pattern will be unique.
What does that mean?
It means when I'm going to go and.
Going to drop those bytes from here, start overwriting those four parts that get that get written here.
Those are going to tell me what is the offset from the beginning until this location.
Again, we are going to throw those for those those bytes into the stack.
And now those four bytes, which we will be seeing in IP in the in the debugger.
Those are going to help me identify how much is how much pies do I need to reach this location.
So what's the offset, in other words, to reach this location?
OK, that's why we are going to do that.
And now, again, what it tells you tells you do not copy this because this is truncated.
It's not the full pattern.
The pattern is actually in the in the money directory.
So that's why we created it this way.
OK, I like to usually create copies of this so I can later on, uh, go back and imagine my sequence.
What what did I do first?
What did I do second, etc..
So I'm going to do that and now I'm going to work on exploit one.
I'm going to copy these three thousand bytes.
OK.
And I'm going to replace this.
With the three thousand bytes.
OK, so now we can close this, we don't need it anymore and now we can, uh, run this again, let's
restart our application because it's already crashed because we we crashed it.
So let's restart that.
OK.
And let's head.
OK, OK, OK.
And.
Let's start the application.
OK.
Let's create this fight so hard to fight.
Belgrade successfully.
Now let's go back and lodge the application.
And.
The file, see what's going to happen.
OK, so we open.
Great.
So, again, the application process or has an access violation, it.
You can see that here, right.
And you can see that there is some value now written where any IP, which is some four bytes.
Now, what we can and you can see here again, these are the some of the bytes that were our part of
our patent.
So we can see those ESP Scott overwritten with them.
We can see that on the stack.
These are the bytes really are mean nothing.
So what we are going to do now here is copy this so you can do that.
And now, instead of putting create.
We will use pattern offset, so pattern of that and just give it the the value is for right now we can
run it.
And what it says, it says that this pattern so these bytes, these parts are H seven B, H in hexadecimal.
And it says these four bytes, which is the H seven B, H, are found in cyclic pattern at position
10, 12.
What does that mean.
It means that we need.
Right over here, 10, 12 whites.
OK, we need to right over here, 10, 12 whites in order to overnight reach this upset.
OK, so if we ride 10, 12 bites, the next four bites are going to be our return address again, if
we like 10, 12 bites.
OK, from the beginning then to the four immediately after that are going to be our return address.
Good.
I'm not good in designing in these drawings.
I know I'm bad, but I hope this explains the idea.
So good.
We have that.
Let's see if this is true.
So let's start the application again.
But this time we'll update our code.
I like to, again, make things step by step and go one step at a time.
It might take some time, but at least we can learn, we can understand what's going on by doing a step
at a time.
So let's do to the T.Y., OK?
And now this time, let's do this and let's multiply this by 10, 12.
Well, let's fill this with what?
Let's fill it with the A's.
Sorry to one.
So we have 10.
Twelve of and then after that, let's put in the IP, let's see if we can really put any IP, what our
Furbies so 42, which is the best for B, we had four of those.
Right.
So now we'll have our if we go back here, we are going to overwrite this with, uh, let's say let
me delete this, because now it's not the same.
OK, so we are going to override this with AIDS.
These will all be AIDS here a A and then A, then A like that, a, etc..
OK, and so on and so forth.
And then we want to override this, these four bytes.
We want to write them with the BBB.
OK.
It will be overwritten here.
That's what we want to achieve now.
OK, good.
What we want to do next so we we got there is we got the BS and now we need to just pad the rest of
the, uh, the payload because the payload was remember, the payload was three thousand.
That's when we managed to crush the application.
So if we just send this, we are probably not going to crush the application.
So we are going to do calculations a dummy way.
But later on in this video series, we'll show other methods how to do this.
But for now, again, I'm going to use a dummy way.
So please, if you are watching this, I still know how to calculate things.
Maybe a couple of, uh, uh, basic calculations.
I still know that.
But, uh, again, I want to use the basics here and then we'll move to other ways later on.
So for now, what I'm going to use I'm going to do pad one, for example, and I'm going to pad this
with C actually I'm going to pad it with just see, because there's a reason I don't want to send a,
uh, slash xixi.
I will explain that later so we can actually just do X 43.
Yep.
Let's do that.
And then we are going to pad this with the rest of what.
Of the payload.
So let's get our calculator.
And see, what do we have, so we have three thousand, right?
Minus 10, 12 and then minus four.
So we have one nine, eight.
For left of bitts left, OK, we have one nine eight four bytes left, so let's do that one nine eight
four bytes left, OK?
And yeah, let's do this, we don't need anymore, but we need to do now is we need to add the all payload
so we have IP and then we have had one.
And the reason I named it part one is just because later on we might need other pads.
So let's do that.
And let's add another thing here to print.
So, uh, let's say payload length.
Equals and then let's add the line of payload so that we can print that and make sure we are on the
right side.
So let's run this.
Payload length is six, nine, six, eight, why is that?
Named.
How did, uh.
See, I told you, I'm bad at math.
What's going on here?
Uh.
De de de de de de de de de de de la.
Uh.
So, Jonkers, this.
Then we have IP.
Yeah, this should be.
What's her computer?
Let's check.
I'm missing something.
You know, Glenn.
Oh, I know what.
OK, OK, let me change this.
This is being calculated, let me just maybe.
This is, by the way, OK, OK, this is no, this is the reason why I found it.
I forgot to add the slash here.
OK, this is taking this as three bites, it was taking it had three bites.
OK, my mistake now it should be three thousand.
Yep, I told you, I have the basics of calculation's good, so let's continue then.
So, yeah, my math is still working then great.
OK, so what do we do now is let's open the application and what should happen now is we should see
for BES any IP, so let's make sure we have full PS any IP, otherwise they are.
My math sucks like people say so.
Yep, we have the uh, four B's.
Any IP.
Uh.
I can see here.
OK.
And we can see the E.S.P was overwritten with the CS, so it seems our our payload anything, this is
also one good thing to keep in mind so we can see that our payload on the top of the stack.
Got now overwritten with the C part.
So what does that mean?
It means we now have control over the IP.
That's true.
And now if we want our Chalco to work, we added at least part of the payload y because this part is
the one that, as you can see here in this case, got overwritten on on the stack.
So we if we add our payload here, not that, by the way.
Not that.
I mean, the other bytes were not on the stack there.
But the way the way we want to exploit this is by jumping to ESPN.
We can see ISPs pointing to our C, so we need to.
Right, something we need to write on in that area, so if we.
If we ride in the seas area, we will achieve our exploits, so let's update this again and this time,
no.
Reader while.
OK, so what are we going to do now, let's restart the application.
Yes.
And.
I thought, OK, OK, OK, uh.
Start the application, so what do we need to do now, what are we going to do now is we we need a jump
up because we saw ESPs pointing to the top of our stack.
Now, again, this is just for demonstration purposes.
This will not work on Windows 10 because like I said before.
Uh.
The addresses will be different and all of that, I will explain also more about that later.
But for now, let's just pick from our A.l.
OK, let's pick from here and address, which is jump up and just use that.
But this will not work if you reboot your computer, and I will explain more about that later on, but
for now, we just want to do this for demonstration purposes.
OK, so let's now modify this.
With our so let's remove this, all of it, and let's modify that with 34 y, because this is little
endian then and then we have B, C and then we have X 77.
Yeah, I'm not going to do the same mistake again.
So I forgot the X.
OK, so we have 34, 10, B, C, 77, so this is where our jumps up and now let's replace this actually
with Knob's, so we replace this with knobs just so we can jump into that no operation.
We have a breakpoint here, so that's good.
Let's go back to the beginning and now.
Let's create our payload.
So all good.
Everything is working correctly.
Let's go and now load our.
Uh, but by.
OK, so let's do this.
And that.
OK, so we can see the the debugger post where at the break point, that's why it's saying post and
you can see it's pointing to our ISP address because we overwrote.
Where is it?
Where's my my fancy diagram.
We overload this.
Lets me to.
Yeah, we overwrote this actually with what we overvoted with this address, we overwrote this with
this address.
So here now we have.
Zero zero.
OK, now we have this address.
OK, so we we overrode that, and that's why now it's up the jump E.S.P, if I hit a seven to, like,
continue, we will be jumping over into where ever ESPs pointing.
So if we go to S.P. and if we like follow in dump, we can see this is where he is pointing to our knobs.
So we go back here f7 we can see now we are anywhere in the north so we can now slide all the way in
the north and then if we had our Chalco there, we can execute our great let's modify our code at our
Chalco or what you can do sometimes just for let's say.
To make sure things are working correctly, I usually would like to add.
Uh, a software break point here, let me add to that.
Uh, from directly from the code.
And let's start here, uh, let me update this, so I'll call it number four.
So this is for the Kidwai here and here, what I will do is I will add, let's say, four of them.
OK, and I'm going to call this No.
Not one.
OK, I'm going to add four of them are we have a lot of space, but what is enough?
We can do that and then I'm going to add my pad one equals then I'm going to do, uh, I'm going to
do the XY and I'm going to multiply this by also for.
And actually, let me call this bullet point, great point.
Yep, and I'm going to add.
My dad won, and I'm going to do the, uh, I'm just going to send.
She's in there or maybe more not, I'm going to just send sees for now and then multiply this by.
So we have all of these have all of these the breakpoints.
So we need to subtract from this one, uh, eight bytes.
So that means we have seventy six.
Seventy six left.
OK.
And now if we run at five we should create our payload but oh we missed eight.
Uh oh yeah.
Because we didn't add it here.
Good.
So we have junk then we have IP then we have.
Not one, and we have break point and then we have had one, yeah, that's why we missed those eight
bites.
Three thousand.
See my calculations still working good.
So let's go back here.
And let's try to load our payload.
And before we do that, let's just add a breakpoint here.
Just to make sure we we actually jump in there, but also the code we made now will actually create
a breakpoint.
So once we land on this, this is actually also breakpoints.
You'll see.
So if I do now, uh, f7 going to jump.
Uh.
What did I do?
Oh, I didn't load the file yet.
Oh, OK, sorry.
So we load the file.
But that but we are at the jump.
If I hit that seven, we are now at the knob's.
Even if you hit nine, by the way, look, what's going to happen is going to get stuck.
We're at the interrupt.
OK, so this is a break point or an interrupt, which will interrupt the execution.
So now we can control that or actually we know that our code jumped into the knobs and then slide it
into the interrupt so we know we can control that.
Now, let's just update our code with some fancy shall code, so.
Yep.
Remove that.
And.
OK.
OK, OK.
And.
Head Start now, I'm going to call this.
Number five for the UI.
And let's do some modifications again, so we have the knobs, you have the IP, we have the knobs where
we are going to land, then we are going to remove this.
OK, we don't need it anymore.
What we can do is, uh, let's see.
We need our code, so our cell code.
Should be here so we can add let's bring the shall code.
So let's get the Chalco here.
I've already made those, and so let's use this, which is for the calculator for now and then we'll
add something else so we can replace I'm going to put the Chalco that not just so I don't need.
And I think this is, uh, ninety nine bytes we've check now.
So let's do some updates to our code.
Let's see, what do we have here?
Sorry.
Uh, let's just so we can we can see more so we have the junk, we have IP, then we want the corporations,
then we want our show code and then we want the pazzo.
This is ninety nine point, so this is correct, then it means, uh, where does my calculator.
So it means one nine, uh, seven six minus ninety nine.
So we have one eight seven seven.
One 877 let's check.
The good thing is our this one will will show us how big our payload is, let's just make sure we have
everything right, that we have a chunk of the offset, the VIP.
We have our knobs, right.
The four knobs.
Then we have a shell called.
And then this is no longer used by this, I'm going to delete that right.
We have our knob's, then we have our we can even just right here, Chalco just for.
The sake of understanding and the.
Making things easier for you if you want that, so we can add this also at the end, so we have junk
IP operations, then we have our Chalco, then we have our path.
Let's make sure this is three thousand bytes because I don't remember if this OK, so it's not three
thousand, but it means this Chalco is actually for it's missing four bytes.
So it's not really 99.
It's one of three.
This is one of three I like to write that down usually just so I know how big my code is, so we need
to remove three more bites from here.
So this will be one eight seven three.
And now if we create our payload, we should have 3000 flights are what did I do wrong this time?
Uh oh, OK.
Actually, we need to.
So it's one it should be a two one.
Right.
What did I put you on?
So, again, we have our 10 12, which is the offset.
We have eight four bytes, which is for the IP.
We have four bytes here, no operations just to slide there.
And then we have our cell code, which is one of three bytes, and then we are filling the rest of the
buffer with these CS or I'm going to fill them with no operations also.
So the rest of the buffer is going to be filled with also operations.
Let's run it again.
Three thousand bytes.
Great.
Let's now go and execute our application.
So.
We.
Open, but before I do that, I want to also add the breakpoint here, because I keep forgetting that
it could.
So we have a break point.
And now we can go.
And load the bed file open, we are at the John PSP.
OK, so if we hit F7, we are at the knob's right now.
We are not.
This is where our Chalco is.
We are not going to like step into one step at a time.
We might do that later, but for now, I'm not going to do that if I just hit a five.
Then we should have there's a problem here.
Well, then probably we have some bad character in my show called.
We probably have a bad character in my childhood, but that's for another lab for now, what I'm going
to do is.
Let me see if I run this from.
Outside the.
Uh, the debugger will come, we'll explain this in another video, but for now.
Let's just see if this is working, OK?
Uh.
Oh, so we have something wrong going on.
So maybe we have a bad show called.
Let me see here.
We have this all worked out correctly.
I'm going to add maybe eight points for now, I'm going to turn this back to seventy seven.
One.
And see.
We will be testing this more or some similar example later to see where is the because there might be
a attack on this one, I really don't remember.
But it should be working.
OK, so we need to we need to add more and more operations, probably when we jumped, we jumped into
those four bites and the since the shell, it comes immediately after that, it didn't work.
And I would explain, by the way, why?
Because this is because of the.
Let me just go back here quickly.
Let me just go back here.
Get some coffee.
And it's because of.
Let me start this, OK, start.
OK, OK.
And let's get this on, OK?
Go back and now run.
And run the application.
And if we open.
Again, I know what the problem is, is because of the Chalco this immediately after that, so let's
go here just to show you Jump E.S.P.
So now, because this these operations here, actually they will overwrite some of the, uh, the payload
itself.
I I'll explain what that is and how it works.
These are floating point operations which are used to get PC.
Uh, I will explain those, but this is the basics for now.
And I don't want to make things complicated, so I will get back to this.
But now when we jump, we are not jumping into, let's say.
Anywhere here and this is not going to overwrite these because that is still some space and now if I
hit a nine, it should work.
Our calculator is working.
Exactly.
Let's modify our code, so this is working great.
Let's modify our code with a reversal just so that we can have fun, UI and I already have also created
the diversion, so I'm just gonna replace that.
So we have the revolution and the length is three, eight, nine.
So we need to check that.
So I'm going to do that.
Wait, wait, wait.
Did I save this as another one right here?
So I'm going to do this silkroad and this one is we said hash.
Three, eight, nine.
And we need to update these numbers now, so.
Oh.
So what do we need to do here?
Let's go back to our calculations.
I want to.
I calculate this an easier way for you guys.
So we do and 12 plus.
Uh, four plus eight plus.
Uh, 10, 12, plus four, plus eight, plus three, eight, nine.
Then we get this value and if we subtract.
Three thousand will get one five eight seven, so we need one five.
Eight, seven.
Let's just double check it.
And let's save this now, let's run this to make sure we have three thousand bytes.
Oh, we are missing.
Uh, the only thing twenty one bites.
So is this wrong then?
Uh, twenty one bites.
This makes this.
Uh, one.
Six.
Zero eight.
Is that right this time?
Again, one six zero eight letters in great.
So this is where our Chalco, so this is a controversial.
Let's get our threat system.
I already have everything set up here so we can use this command, which is going to create the front
load the console with the handler, set the payload, set my, uh, localhost IP, the part which the
actual code is to connect to and the exit process and then run.
So if I just do that to create my Liselotte.
OK.
Um, OK, so the listener is now running, as you can see, we said the all the configurations.
Now if we go back, I might do a video about Peter's this later, but yeah, for now, we'll, uh.
We do this.
So what do we need?
Yeah, we need to exploit the application, so if we go we'll play.
Ah, OK.
And this time if we load.
The.
The bad backfill.
We should see something happened and here we go, we can see that we have, uh, a shell on on the system
so we can do make Directory A. or actually just echo.
Hello.
Well.
And to low.
The.
OK, so just to double check and we can see that great, so we have access to the system and we saw
how we, uh, exploited that now.
How did I generate the Chalco?
Those were some of one of them was explained in the previous video, the most exploited one.
I will explain that in another video.
But I think you already have there's already a lot of videos out there and a lot of resources.
But I would also do that in an later video.
How to generate that, actually, maybe I can just show it to you now.
What is it?
Yeah, here it is.
So this is how I generated that payload.
And it's three, six, eight, that's why when we did the calculations, we did it wrong.
We did.
I thought it was three.
How much did we see the payload here?
All this is three six eight three, six, eight, so that's why our calculations were wrong.
So, yeah, this is how you can generate this.
I must venture minus P that the shell, the localhost where it's going to be connecting to the listener,
the part where it's going to be listening on and the exit function and then the encoder which I'm using
to encode the bad characters and remove them, minus if I want it in C format and minus P to specify
all the bad values, the bad characters.
And again, we will explain more about this later.
So you need to do then copy this into your code.
And as you saw here, this one we can see we have access to that system by the IP config.
You can see this is my IP address, my windows, and if I check over here.
You can see it's the same IP address.
Good.
So that's it for this video.
I hope it was good or useful.
And we'll see you in another video.
Thank you.
And see you by.