Buffer Overflow Framework
10 Steps to a shell on OSCP-like stack-based buffer overflows.
The below steps condensed into a table in a word document:
Overview
Once an initial understanding of of how to perform stack-based buffer overflows is obtained, use this template to ensure no steps are missed and commands can easily be copy/pasted.
Refer to buffer overflow external resources for more cheat sheets and the buffer overflow TryHackMe room.
TryHackMe room bufferoverflowprep Task 1 is used as an example in the below steps.
Identifying bad chars with Immunity's Mona (step 5) is the most significant tool I learned that was not covered in the OSCP labs or other common resources.
1. Identify Buffer Size
An example/test script that overflows the application buffer is provided similar to the following:
import socket, time, sys
ip = sys.argv[1]
port = 1337
timeout = 5
prefix = "OVERFLOW1 "
string = prefix + "A" * 2000
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(timeout)
connect = s.connect((ip, port))
s.recv(1024)
print("Fuzzing with %s bytes" % len(string))
s.send("OVERFLOW1 " + string + "\r\n")
s.recv(1024)
s.close()
except:
print("Could not connect to " + ip + ":" + str(port))
sys.exit(0)
time.sleep(1)The application overflows at 2000 characters with the EIP overwritten by \x41\x41\x41\x41 (i.e. AAAA).
2. Find EIP Point
Replace the buffer variable above with the output of the following:
When ran, the application crashes. Capture the value of EIP as 6F43396E.
3. Get Offset
Use the EIP value and find the offset:
4. Get Controllable Char Length
Add "post" = "D" * 500 to the payload to ensure there is enough space for shellcode after the application is overflowed.
As displayed in the stack view, there is more than enough room for shellcode to be placed after the EIP value.
5. Identify Bad Chars
Replace the "post" parameter with a badchar array and run the application.
Remove \x00 from the starting badchars array before testing, as this will always be a bad character.
Use the mona debugger within Immunity to identify badchars by setting the mona working directory, creating a bytearray matching the bytearray used in the above python script, and using the ESP value to compare the two and find discrepancies (i.e. badchars).
Badchars will be boxed in the mona display. Note the subsequent character is always affected and is usually not a badchar. Remove the badchars from the array and retest.
Once badchars are identified and removed from the badchar array, complete this step again to ensure all badchars are removed.
6. Find JMP ESP
Identify shellcode for a JMP ESP instruction as \xff\xe4:
Find safe DLLs without ASLR and other stack overflow mitigations. Run the below command after Immunity is attached to the application but before the application is unpaused.
Multiple suitable addresses are identified in essfunc.dllthat do not contain badchars.
The identified address 0x625011af is used. Place in the python script in reverse as: "\xaf\x11\x50\x62.
7. Generate Shellcode
Don't specify an encoder (e.g. x86/shikata_ga_nai). msfvenom will pick one for you.
8. Add NOPs
Add 10 \x90 nops (line 38, 40) to the payload after the EIP to ESP offset and before the shellcode payload.
9. Listen for Shell
Set up a kali listener:
10. Run the Exploit
Last updated