All right everybody.
So in this video we're going to be covering fuzzing fuzzing is very similar to spiking in the sense
that we're going to be sending a bunch of characters at a specific command and trying to break it.
The difference is with spiking we're trying to do that to multiple commands to try to find what's vulnerable
now that we know the trend command is vulnerable.
We're gonna go ahead and attack that command specifically.
So a couple of housekeeping items we're gonna go ahead and boot up immunity debugger again.
So we're gonna in a straighter and we're also going to run ball and server as administrator.
So from here on out you can assume that Vulcan server is going to be running and immunity is going to
be running and that we're gonna have it attached.
So let's go ahead and show that process one more time and anytime that you do crash vol and server we're
gonna go ahead and restart it and restart immunity as administrator and reattach.
So there are issues sometimes where if you crash both in server and then you try to reload it with immunity
already open it causes issues.
So it's best to just close out the immunity as well reopen immunity and started again.
So go ahead and make sure everything's running it is in the corner.
OK.
So let's go to our Kelly machine now that we have this out of the way and I've built out a script in
Python that we're gonna use to fuzz.
Let's go ahead and take a look at that script so we're gonna get it.
I call this one dot pi.
You could do that as well.
And if you want to pause the video now and write this out.
Copy this down.
That's fine.
You could also do it while I'm talking if you want to save some time.
So I'm just in go line by line and kind of talk about this code and then we'll see what it does.
So from the top we're just declaring that it's python.
We're going to import a few modules here we're going to import sys socket that way that we can call
out the specific IP import.
We're also going to import sleep that way we can sleep it for a second before trying this process over
again.
So with those imports out of the way what we're really focused on is we're declaring a buffer variable
here right.
So these variables called buffer an inside buffer we have one hundred eight.
We've got this a times 100.
So what we're gonna do is we're going to say while true.
So we're gonna loop this right we're gonna say while true.
I want you to try something.
We're gonna try as we're gonna try to connect to this socket and the socket.
All that is is this a if I need it.
That's your IP before and the SOC stream.
That's your port.
So we're gonna say hey let's connect to this IP address.
Remember this is my IP address from my windows machine that's running Von server.
So going to connect to this IP address we're going to connect this port.
And then once we do that we're gonna send over a trend command.
Remember we spiked the trunk command found it was vulnerable and when we spiked it we looked at the
registers we actually saw this little bit of extra information here.
So we've got this little command that goes after the trend that needs to go in there in order for the
program to actually understand it.
So that's why this has been added here so we say hey send over this message send over Tron and then
also send over the buffer.
So send Tron with 100 days.
OK then close out close that connection.
Go to sleep for a second and then we're going to append to buffer another one hundred days.
So we're going keep doing is as long as there's a connection here we're going to keep sending you buffers
and is gonna get bigger and bigger.
So next time we're going to send two hundred then we're gonna send 300 400 etc. until this thing breaks.
So we're trying to do as we're trying to really narrow down where it's breaking and at what specific
bite size.
So what we're doing here is we're going to fuzz it.
And then once it breaks it should print out an exception that says K fuzzing crash at X bytes right.
So let's go ahead and see what that's going to look like so go ahead and save this file if you haven't
already.
One other important thing we need to do is we need to change the mode on this to execute we'll say change
mode plus X one dot PI.
That way we can execute this.
And just again to confirm we've got immunity running.
So let's go ahead now and say one dot pie
hit enter and you should see the connections coming through here on bold server.
So every time it's doing this is sending a new one hundred bytes.
We can watch immunity for the crash.
The crash should happen pretty quick.
And then once it does you can kill the program because sometimes it doesn't kill itself.
So it's not the best.
There we go.
We posit no more connections.
So let's go ahead.
Go into Cally it controls C and we crashed somewhere around twenty seven hundred bytes.
Give or take OK.
So let's look at the crash.
So again we see the crash came through and we've got a bunch of a sitting here.
We didn't look like we actually overrode the VIP.
That's fine.
We just need to know approximately where we crashed at.
So we'll just call it for even round numbers that we crashed somewhere around three thousand bytes.
So what we're gonna be doing in the next video is we're actually going to be finding where the E IP
is at.
So how we're gonna do that is we're gonna use a tool that's going to create these random not really
random their psychical values that we're gonna send out and then we're gonna say OK where.
What is the VIP value and where does it correspond in specific number of bytes that we sent over.
So remember controlling this e IP value let's go back to it controlling this e IP value is what's the
most important once we can control the C IP value.
We do a little bit of housekeeping in our exploit development process and then we point this guy to
our malicious code and we get root.
So we want to see IP we want to control it.
And in the next couple of videos we're going to learn how to do just that.
So I will catch you over in the next video when we cover finding the offset.