0

I am working on an exploit for a ctf-challenge and could't find any hint about my problem. My steps so far:

  • I could successfully overwrite EIP with an "jmp esp" address and jump to my shellcode.
  • I have determined all "bad-chars" which will cut my shellcode. There are none ;)

The problem is, I have only 44 bytes of space for my shellcode and this is not enough for my shellcode. Since my egghunter can't find the rest of my shellcode, I assume it's not written in the memory. The OS is Windows 7 x86 without SP1.

Is there any way to expand the space for my shellcode or to exploit the application in another way? Thanks in advance.

SynTraX

Improve this question
3
  • Actually the application is just a server which is vulnerable to buffer overflow in a specific command send over a specific port. There is no authentication available. With "other request" you talking about other commands? I have fuzzed the application using spike on all other available commands and even on random commands. There was just this one buffer overflow. The goal of the application is to execute own shellcode. Another point: It's not necessary to run the application on Windows 7. Windows XP is possible as well. I have exact the same issue on Win XP as on Win7. The .text section in wh
    – user17243
    Commented Aug 26, 2016 at 11:34
  • 1
    The other commands might not be exploitable, but that doesn't mean they don't store data after you send them commands. Try sending your exploit shellcode to these commands, and your exploit containing the egg-hunter to the vulnerable command.
    – s3c
    Commented Aug 26, 2016 at 13:24
  • @user17239: s3c is right, I was about to advise you to code a egg-hunter, this is the way to go.
    – perror
    Commented Sep 28, 2016 at 18:18

4 Answers 4

Reset to default
2

Do you have tried to combine different commands? First you send the reverse shell(with egg marker) with a another command and then the vulnerable command with the egghunter. You have to search for a command that keeps the reverse shellcode in memory after the execution of the first command so that the egghunter can find the egg. Vulnserver: GDOG puts the reverse shellcode in memory and KSTET sends the egghunter. https://bogner.sh/2016/04/the-hard-life-of-exploit-developers/

Improve this answer
1

You can check for other fragmented overflows but, I recommend you to check if your egghunter works first. Another thing is bad-chars are not standard for all situations, check receiving function and search for special bad-chars.

Some options:

  • Send other data to server and try to find them with your egg hunter (as @s3c said)
  • Use ret2libc and ROP chains to open backdoor (add user, set bash to listen port, download & execute..)
  • Exploit developers and malware writers developed lots of other application for little spaces using self-modifying code and compression techniques
  • Overwrite PLT and function pointers for further information exchange

And lots of other methods depending program semantic and implementation.

Improve this answer
0

It's hard to comment without more information. It could be that there are other requests that store content in memory, which you can then look for later using your egghunter. Alternatively you could consider another attack, for example if the service supports auth, use th 44 bytes you have to patch out the auth check to always return true, etc.

Improve this answer
1
  • M, wasn't paying attention, Win7 likely won't allow you to change program code on non writable sections, you'll have to check if this is the case for the specific program, depends on what the code pages were marked as during compile time.
    – s3c
    Commented Aug 26, 2016 at 8:57
0

If you are able to store a file, say a dll, your shellcode could load said dll. See MSDN on DllMain

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.