Brainpan 1
Last updated
Was this helpful?
Last updated
Was this helpful?
The following post by anthonyjsaab is licensed under
Reverse engineer a Windows executable, find a buffer overflow and exploit it on a Linux machine.
Notice that this banner is the same one we retrieved from the target machine's port 9999 (nmap output).
When debugging the program, we can discover that the password is "shitstorm", but that does not really help us:
Thus, if we can exploit a buffer overflow locally through this exe, we can do it remotely on the target machine's port 9999 as well.
We will develop this exploit on a local Windows 10 x64 machine. Once functional, we will use it on the target.
Finding approximatively how many chars is too much chars, causing a seg fault:
Going forward, we will use x64dbg its plugin ERC.Xdbg
To know the exact offset, we will generate a non-repeating pattern using ERC and use it as payload.
To double-check that the offset is in fact 524 bytes, we use the following:
We need to check what ASCII characters are problematic. We generate a list of all the possible ASCII characters using:
Then, we send it:
We should check for anomalies using the ERC command:
Note that the address you see in the command is the value of the ESP after sending the payload.
So we found our first bad character: 0x00. Now, we replace 0x00 by 0x01 in the Python code and retry. We would see that there are no more mismatches after 0x00. So 0x00 is the only bad character.
Using the same Python exploit code, but changing the shell code and the target IP, we get a reverse shell:
Even tho a Windows executable is running on the target machine, the target machine is a Linux machine. We should get a decent bash shell to continue:
Created by
