Exploit Development 2018 ####################### # VMs for this course # ####################### https://s3.amazonaws.com/infosecaddictsvirtualmachines/Win7x64.zip username: workshop password: password https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip user: infosecaddicts pass: infosecaddicts You don't have to, but you can do the updates in the Win7 VM (yes, it is a lot of updates). ##################################### # Quick Stack Based Buffer Overflow # ##################################### - You can download everything you need for this exercise (except netcat) from the link below https://s3.amazonaws.com/infosecaddictsfiles/ExploitLab.zip - Extract this zip file to your Desktop - Go to folder C:\Users\Workshop\Desktop\ExploitLab\2-VulnServer, and run vulnserv.exe - Open a new command prompt and type: ---------------------------Type This----------------------------------- nc localhost 9999 ----------------------------------------------------------------------- - In the new command prompt window where you ran nc type: HELP - Go to folder C:\Users\Workshop\Desktop\ExploitLab\4-AttackScripts - Right-click on 1-simplefuzzer.py and choose the option edit with notepad++ - Now double-click on 1-simplefuzzer.py - You'll notice that vulnserv.exe crashes. Be sure to note what command and the number of As it crashed on. - Restart vulnserv, and run 1-simplefuzzer.py again. Be sure to note what command and the number of As it crashed on. - Now go to folder C:\Users\Workshop\Desktop\ExploitLab\3-OllyDBG and start OllyDBG. Choose 'File' -> 'Attach' and attach to process vulnserv.exe - Go back to folder C:\Users\Workshop\Desktop\ExploitLab\4-AttackScripts and double-click on 1-simplefuzzer.py. - Take note of the registers (EAX, ESP, EBP, EIP) that have been overwritten with As (41s). - Now isolate the crash by restarting your debugger and running script 2-3000chars.py - Calculate the distance to EIP by running script 3-3000chars.py - This script sends 3000 nonrepeating chars to vulserv.exe and populates EIP with the value: 396F4338 4-count-chars-to-EIP.py - In the previous script we see that EIP is overwritten with 396F4338 is 8 (38), C (43), o (6F), 9 (39) - so we search for 8Co9 in the string of nonrepeating chars and count the distance to it 5-2006char-eip-check.py - In this script we check to see if our math is correct in our calculation of the distance to EIP by overwriting EIP with 42424242 6-jmp-esp.py - In this script we overwrite EIP with a JMP ESP (6250AF11) inside of essfunc.dll 7-first-exploit - In this script we actually do the stack overflow and launch a bind shell on port 4444 8 - Take a look at the file vulnserv.rb and place it in your Ubuntu host via SCP or copy it and paste the code into the host. ---------------------------Type This----------------------------------- cd /home/infosecaddicts/toolz/metasploit/modules/exploits/windows/misc vi vulnserv.rb (paste the code into this file) cd ~/toolz/metasploit ./msfconsole use exploit/windows/misc/vulnserv set PAYLOAD windows/meterpreter/bind_tcp set RHOST CHANGEME-TO-YOUR-WIN7-IP set RPORT 9999 exploit --------------------------------------------------------------------------------- Day 1 Homework: Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of everything that we have covered so far. Make the subject of the email "First Name - Last Name - Exploit Dev Day 1 Homework" (ex: Joseph - McCray - Exploit Dev Day 1 Homework). Also be sure to name the attached file "FirstName_LastName_Exploit_Dev_Day_1_Homework.docx" (Joseph_McCray_Exploit_Dev_Day_1_Homework.docx). NOTE: This is what is required in order to receive your certificate of completion and CPEs. --------------------------------------------------------------------------------- Day 1 Challenge: Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of creating a working exploit with WinDBG as the debugger, and using any 2 of the following exploits covered in the links below: http://www.whitelist1.com/2016/11/xstack-overflow-1-exploiting-slmail.html http://www.whitelist1.com/2016/11/xstack-overflow-2-exploiting-freesshd.html http://www.whitelist1.com/2016/11/xstack-overflow-3-exploiting-minishare.html http://www.whitelist1.com/2016/11/xstack-overflow-4-exploiting-blaze-dvd.html http://www.whitelist1.com/2016/11/xstack-overflow-5-exploiting-free-float.html http://www.whitelist1.com/2016/11/stack-overflow-6-exploiting-aviosoft.html http://www.whitelist1.com/2016/11/stack-overflow-7-exploiting-microp_52.html http://www.whitelist1.com/2016/11/stack-overflow-8-exploiting-crossfire.html https://windowsexploit.com/blog/2016/12/29/windows-exploit-slmail Also be sure to name the attached file "FirstName_LastName_Exploit_Dev_Day_1_Challenge.docx" (Joseph_McCray_Exploit_Dev_Day_1_Challenge.docx). NOTE: You can download WinDBG from this link: First download and install Microsoft .NET Framework 4 Client Profile from: https://www.microsoft.com/en-us/download/details.aspx?id=24872 Download winsdk_web.exe from the below link. https://www.microsoft.com/en-us/download/details.aspx?id=8279 Follow next steps for installation from this link: https://github.com/corelan/windbglib --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- Day 2 Homework: Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of everything that we have covered so far. Make the subject of the email "First Name - Last Name - Exploit Dev Day 1 Homework" (ex: Joseph - McCray - Exploit Dev Day 2 Homework). Also be sure to name the attached file "FirstName_LastName_Exploit_Dev_Day_2_Homework.docx" (Joseph_McCray_Exploit_Dev_Day_2_Homework.docx). NOTE: This is what is required in order to receive your certificate of completion and CPEs. --------------------------------------------------------------------------------- Day 2 Challenge: Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of creating a working exploit with WinDBG as the debugger, and using any 2 of the following exploits covered in the links below: http://www.whitelist1.com/2016/11/xstack-overflow-1-exploiting-slmail.html http://www.whitelist1.com/2016/11/xstack-overflow-2-exploiting-freesshd.html http://www.whitelist1.com/2016/11/xstack-overflow-3-exploiting-minishare.html http://www.whitelist1.com/2016/11/xstack-overflow-4-exploiting-blaze-dvd.html http://www.whitelist1.com/2016/11/xstack-overflow-5-exploiting-free-float.html http://www.whitelist1.com/2016/11/stack-overflow-6-exploiting-aviosoft.html http://www.whitelist1.com/2016/11/stack-overflow-7-exploiting-microp_52.html http://www.whitelist1.com/2016/11/stack-overflow-8-exploiting-crossfire.html https://windowsexploit.com/blog/2016/12/29/windows-exploit-slmail Also be sure to name the attached file "FirstName_LastName_Exploit_Dev_Day_2_Challenge.docx" (Joseph_McCray_Exploit_Dev_Day_2_Challenge.docx). --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- Day 3 Homework: Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of everything that we have covered so far. Make the subject of the email "First Name - Last Name - Exploit Dev Day 3 Homework" (ex: Joseph - McCray - Exploit Dev Day 3 Homework). Also be sure to name the attached file "FirstName_LastName_Exploit_Dev_Day_3_Homework.docx" (Joseph_McCray_Exploit_Dev_Day_3_Homework.docx). NOTE: This is what is required in order to receive your certificate of completion and CPEs. --------------------------------------------------------------------------------- Day 3 Challenge: Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of creating a working exploit with WinDBG as the debugger, and using any 2 of the following exploits covered in the links below: http://buffered.io/posts/myftpd-exploit-on-windows-7/ https://windowsexploit.com/blog/2017/1/8/exploit-easy-file-sharing-web-server-v-72-remote-seh-based-get-request-overflow https://ketansingh.net/pwning-with-seh-based-buffer-overflows/ Also be sure to name the attached file "FirstName_LastName_Exploit_Dev_Day_3_Challenge.docx" (Joseph_McCray_Exploit_Dev_Day_3_Challenge.docx). --------------------------------------------------------------------------------- Day 4 Homework: Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of everything that we have covered so far. Make the subject of the email "First Name - Last Name - Exploit Dev Day 4 Homework" (ex: Joseph - McCray - Exploit Dev Day 3 Homework). Also be sure to name the attached file "FirstName_LastName_Exploit_Dev_Day_4_Homework.docx" (Joseph_McCray_Exploit_Dev_Day_4_Homework.docx). NOTE: This is what is required in order to receive your certificate of completion and CPEs. --------------------------------------------------------------------------------- Day 4 Challenge: Send Ivana an email ivana{a-t}strategicsec{d-o-t}.com with a word document that contains screenshots of creating a working exploit with WinDBG as the debugger, and using any 2 of the following exploits covered in the links below: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2016/june/writing-exploits-for-win32-systems-from-scratch/ (DEP Bypass section of this blog) Also be sure to name the attached file "FirstName_LastName_Exploit_Dev_Day_4_Challenge.docx" (Joseph_McCray_Exploit_Dev_Day_4_Challenge.docx).