All right everybody let's get started with spiking.
So before we get started we're going to do a couple of housekeeping things.
First I want you to disable your Windows Defender.
Real time protection if you have that enabled.
So it looks something like this where you should turn off this button right here.
We're doing that because villain server will actually be blocked by windows defender if you try to run
it and then run anything malicious against it.
So good on Windows Defender for picking this up.
This is more recent as I've taught this in the past and never used to.
But now it does.
So we're gonna make sure that we turn off this real time protection and then we're gonna make sure that
when we run our programs today our immunity debugger and we run our own server that we're running them
as administrator.
So let's go ahead and first get our Bolen server running.
So remember I told you to extract that to a folder.
Here's my vote and server folder.
I'm going to right click on this and I'm just gonna run it as administrator.
So now that I've got that running it should look something like this.
And we're also going to run immunity as administrator.
So we're going to do that because if we don't it's actually not going to see Volm server running as
administrator and be able to access it.
So we need both running as admin and the other reason is for vulnerable running is adamant is when we
get the shell on this we're actually gonna end up as a route automatically.
So we just want this in the most simple terms so bring immunity over here.
And now what we're going to do is we're going to go over here to file and we're gonna say attach and
if you scroll down you'll see phone server right here and you go ahead and set attach on that OK.
In the bottom right corner you see that it says pause or we're gonna do is just hit start over here
this play button up top and now it should say running.
So if you're running then we are good to go.
So now we're going to dive into our Kelly Linux machine so I'm in a command prompt and Cally Linux and
the first thing I want to do is connect to Von server and see what it is.
So by default Von server runs on port nine nine nine nine and you need to know the IP address of your
Windows machine that it's running on.
So once you know that what we can do is use a tool called Net cat we'll use a switch of envy.
We're going to do a connection here and we're just going to say the IP address.
So Vine is one dot 90 and then the port that you're going to connect on which is 9 9 9 9 OK.
So you should see the screen that says Welcome to vulnerable server type help for help.
So it's saying help in all caps are going to do that.
All caps and then we get this list of valid commands so it looks like Volm server takes commands based
on what you enter right.
So there's stats command our time our time etc. So the primary command that we have been focusing on
is this trend command.
Now when I've taught this in the past I've left out actually how to find this.
So I wanted to teach in-depth how we're going to find that train itself is vulnerable.
So we're going to do something called spiking with spiking does is we're going to take this command
one at a time we'll say like stats we're gonna say Hey stats I might throw a bunch of characters at
you and see if I can overflow that buffer that we talked about in the previous video.
So do we overflow the buffer does the program crash.
If it does then we know hey stats is vulnerable if it doesn't.
Maybe it's not vulnerable.
We'll move on to the next one.
So I'm gonna show you what a non-renewable one looks like and what a vulnerable one looks like.
And we're gonna look at stats and try and for that purpose so when we spike we're gonna use a tool called
generic P and it's going to look something like this.
Let's go ahead and control C or actually we'll just type exit out of this if we can
and then what we're gonna do is we're going to use is called generic center DCP Let's type that in real
quick.
OK so here is the usage for this.
You're going to need the host.
We know the host of 1 9 2 1 6 8 1 Ninety.
You're gonna need the port.
We know that you're gonna need a spike script and then you're gonna need these script variables here
which we're just gonna leave at 0.
So this is what the usage should look like but we need this spike script.
So let's go ahead and talk about that first.
So I've already gone ahead and pre written it.
It's very very simple.
So let's take a look at it and get it.
So first we're going to look at stats.
So we're gonna have stats that speak for spike so we're gonna do is we're going to read the line then
we're going to take a string and the string is stats.
Remember that's what we had here the stats command.
And then we're just going to send a variable at it.
Okay.
And then when we spike this we're gonna send variables in all different forms and iterations.
So it might send a thousand at a time than twenty thousand at a time than five at a time.
It's just looking for something to break the program.
So that's what spiking is.
We're gonna send all kinds of different characters randomly essentially to try to break this part of
the program.
So now we're getting into specifics here.
So if you can imagine we've got the stats that Spike.
We're also gonna have the trend that spike in the trend is going to have this trend command here.
So if you're following along make sure that you type this out just how I have it just these three simple
lines go ahead and save it as STAT STAT spike and what we're gonna do is we're going to send this.
So again we're going to say generic send TGP and then we know the host is 1 9 2 1 6 8 1 Ninety.
The port is 9 9 9 9.
Despite script is stats stats spike and then we're going to stay zero space zero now we've got immunity
running right now over here.
If you have multiple screens you can run it on multiple and kind of watch what happens.
We hit Enter here it's going to just be running through this.
This is running you can see that it's taking commands but nothing's really happening we'll let it run
through all the way just to make sure
and so you're going to see a little bit of a different action when we do have something vulnerable.
So we're going through.
Looks like we're connecting.
If we look at villain server you can see that we're actually connecting to the client here and then
disconnecting from the client as we send these commands over so I'm going to go ahead and just kill
this for now.
We can take control see doesn't look like it's vulnerable in a real test we let it run all the way through
but I'm telling you now it's not vulnerable so we'll just save a little bit of time.
So now let's take a look at the Tron spiking again should look the same but you should have a trend
that spikes similar to this.
So if you want to go ahead and type this out and we have this trend command here so when we send this
Spike Milligan to tab up twice and change this to Tron
and then again we have to make sure immunity is running you see it's running in the corner.
We're gonna go ahead and hit send on this and immediately immunity starts blinking.
What happened.
We have paused over here.
There's an access violation when executing.
Okay let's go ahead and just kill the processing colleagues.
We don't need to keep sending all these.
So your own server has actually crashed.
You're not seeing an error message because it's being held up by the the immunity debugger if we were
to actually detach or on pause this then volunteer would crash.
So we've hit a violation.
This is really good.
This says hey something's vulnerable here.
And if we look at the registers we can kind of get some information.
So one of the information's that we're picking out is OK we're seeing this trend command center right
and we're sending this trend command in with a bunch of A's.
So imagine this going into a buffer space right.
Like we talked about before.
OK we're sending this command a in a perfect world the trend command or this this at all Phil into a
buffer space right.
All these days.
Well what's happened here is that it's actually filled over.
So if we look at the BP remember the base register right.
You see 4 1 4 1 4 1 4 1.
That's just hex code for four A's.
So we've got these here these four bytes right.
And we've gone actually over the e s p as well.
Bunch of A's here OK and we've gone over the e IP.
So now we've overridden everything.
Remember when we talked about the last video the E IP is the important factor.
If we can control this e IP we can get malicious and pointed to something malicious.
Right.
So that's what we're going to do in the next couple of videos.
So I've showed you how Tron itself can be spiked and found in the next video what we're gonna actually
be covering is how to fuzz the Tron command with a python script.
So that way you can kind of feel out how this process is done in another way called fuzzing.
So it's gonna be very very similar when we send a bunch of A's in it might feel like a little bit of
a repeat lesson but we're gonna build out a python script to do that.
And then once we do that we're going to work on finding this e IP location because once we control that
again we can inject malicious code.
So step one done.
I will see you in the next video for fuzzing.