Immunity Debugger - !mona suggest

Question

I have been going through some tutorials for exploit development that use the !pvefindaddr command to help with creating unique patterns and discovering the offset.

I know that mona has replaced pvefindaddr - but from what I can see in the examples I am following the !pvefindaddr suggest command gives you an exploit suggestion in perl, while !mona suggest basically writes you a metasploit module.

I looked at the options with:

!mona help suggest

And there don't seem to be many options available. Is it possible to get suggest to offer you exploits written in any format other than a metasploit module? I couldn't seem to get pvefindaddr working in immunity - I'm assuming it doesn't really work anymore as mona has replaced it, so I wondered if mona had any flexibility?

I tried asking this in security stack exchange and was pointed here!

Answer 1

mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form.

pvefindaddr already suggested a payload layout based on that information, mona takes things one step further. In fact, it will attempt to produce a full blown Metasploit module, including all necessary pointers and exploit layout.

This is probably partially because in order to function, the suggest command uses the findmsp command which requires a "Metasploit pattern" (hence the name "find msp"), a textual pattern that uses a sequence of characters in a way that never repeats the same 4 bytes offset, making it extremely easy to identify the offset of each part of the pattern. This pattern is extensively used in the Metasploit Framework to ease exploit development.

This command will automatically run findmsp (so you have to use a cyclic pattern to trigger a crash), and then take that information to suggest an exploit skeleton

There are a few things you can do:

1. You can always carve out the code out of the Metasploit module, or rewrite it in a different language (such as perl).

2. Use the findmsp command directly (as mentioned, suggest internally uses it to get the information needed for the exploit), it will provide you the details of affects memory regions, pointers, registers and so on, so you could build the exploit yourself.

   At crash time, simply run findmsp and you will get the following information:

   • Locations where the cyclic pattern can be found (looks for the first bytes of a pattern) and how long that pattern is
   • Registers that are overwritten with 4 byte of a cyclic pattern and the offset in the pattern to overwrite the register
   • Registers that point into a cyclic pattern, the offset, and the remaining size of the pattern
   • SEH records overwritten with 4 bytes of a cyclic, offset, and size
   • Pointers on the current thread stack, into a cyclic pattern (offset + size)
   • Parts of a cyclic pattern on the stack, the offset from the begin of the pattern and the size of the pattern.

   In all cases, findmsp will search for normal pattern, uppercase,lowercase, and unicode versions of the cyclic pattern.

3. Finally, pvefindaddr is probably not working with your version of Immunity Debugger because it's newer that versions supported by pvefindaddr. Since it's now deprecated it is no longer updated with newer releases of Immunity Debugger. You could fetch an older version and use that instead.