Stack-Based Overflows - Controlling Execution Flow
In this video I show how to recreate the popular SLMail exploit from scratch!
This video is the first part of a mini-series, so within the next couple of days the next video should be ready and published.
Exploit: https://www.exploit-db.com/exploits/638
Vulnerable Software: https://www.exploit-db.com/apps/12f1a... (This software is intentionally vulnerable and should only be installed inside a virtual machine. In order to recreate the exploit as shown in this video, you will need to use a 32-bit Windows 7 installation. Windows Vista or XP may work as well.)
Windows 7 Virtual Machine: https://developer.microsoft.com/en-us...
Kali Linux: https://kali.org (https://www.offensive-security.com/ka...)
VMware: https://www.vmware.com/dk/products/wo... (You may be able to use VirtualBox as well.)
Immunity Debugger: https://www.immunityinc.com/products/...
Mona: https://github.com/corelan/mona (https://github.com/corelan/mona/archi...)
Python: https://www.python.org/downloads/rele... (https://www.python.org/ftp/python/2.7...)
Background real space image: https://hubblesite.org/image/3862
POC: https://pastebin.com/KP7Qr0kb
Final POC: https://pastebin.com/qgZvaTVY
Topics covered:
Installation of tools inside the Windows 7 virtual machine
Adding a network interface to the virtual machine
Kali Linux Undercover Mode
Python POC Basics (Explaining the Proof Of Concept)
Verifying that our SLMail service is running
Changing the appearance (i.e. font size) of Immunity Debugger
Overflowing the Extended Instruction Pointer (EIP)
Sending a controlled crash string to modify EIP
Searching memory for "opcodes" in loaded modules such as DLLs (Multiple ways)
Little Endian encoding of EIP
The remaining topics such as finding bad characters, generating shellcode, reconfiguring the windows firewall, etc., will be covered in the following video.
Stay tuned and subscribe for more upcoming videos showing actual hacks!
Twitter: @CrazyDaneHacker
Facebook: / crazydanishhacker
Patreon: / crazydanishhacker
Website: https://www.crazydanishhacker.com/