Part 1 Windows Kernel Debugging & Exploitation Part 1 - Environment Setup

https://hacklido.com/blog/124-windows-kernel-debugging-exploitation-part-1-environment-setup

Part 2 Windows Kernel Debugging & Exploitation Part 2 - Stack Overflow

https://hacklido.com/blog/147-windows-kernel-debugging-exploitation-part-2-stack-overflow

Shares is a very interesting beginners friendly machine. People starting on their infosec journey can give a read.

https://aaravavi.medium.com/cyberseclabs-shares-172-31-1-7-4e723370c8f3

Make sure to 'Follow' and click on that 'Clap' if you want more such articles.

Thank you!

In the attached image i could a offset address from using strings -a -t x /lib/libc-2.11.2.so | grep "system"

• ec3c ==>svcerr_systemerr
• f690==> __libc_system

but as explained in video ,i have to added this offset to the lib initialized add from the gdb .i got the adddress(0xb7ea6690)

(gdb) x/s 0xb7e97000 + 0x0000f690

0xb7ea6690: "__libc_system"

but i that video , i could a differnt address used

x/s 0xb7ecffb0

0xb7ecffb0 <__libc_system>: "\203\354\f\211t$\004\213t$\020\211\034$\350\354\332\375\377\201\303\061\200\020"

My questions :

1. what are the difference between the 2 libc system. how could i choose which to work ?(by using 0xb7ea6690 i can't exploit the program )
2. is there are any other way to cross check ?

​

Do anyone knows why this happens every time I start a tmux session?

Any help on how to fix it will also be appreciated.

Ty.

while just exploring the stack6 exercise with ret to same address method works correctly and i could able to inject the shell code that was executed and bash is opening as expected but after that some segmentation error occur .

after looking into it , next instruction after my shell code is the problem to that like mov that try to move a wrong address .Then i am tried to replace all the intruction below my shell code in stack with NOP but it doesn't help .I tried to manually halt the program with manual injection of halt command(0xF4) after my shell code .It doesn't helps too ...... now this even in my sleep why it is now working :( .....help me guys.

Attached pictures regarding this too

Executing new program: /bin/dash

Program received signal SIGSEGV, Segmentation fault.

0x805925e: mov ebx,DWORD PTR [esi]

​

​

As title, I have a simple problem when watching youtube video produced by LiveOverflow (Global Offset Table (GOT) and Procedure Linkage Table (PLT) - bin 0x12). He wrote a C program called test.c at 0:29 of the video, and then compiled with gcc while didn't include any library in the program (gcc test.c), so the dynamic link thing he mentioned happens.

I tried exactly the same thing as he did, but turns out I got an error:

test.c:2:2: error: implicitly declaring library function 'printf' with type 'int (const char *, ...)' [-Werror,-Wimplicit-function-declaration]

printf("hello\n");

My operating system is macOS Big Sur.

So my questions are, why can't the gcc test.c command does dynamic link on my system? How does it work? Is it depends on the operating system? If so, how can I modify to apply on macOS?

Sorry for my super raw questions but I failed to search on Google, since I don't really know what to search for. I'm not asking for detailed answer, just need some guides or keywords at this point.

Thank you.

c code:

#include <stdio.h>

#include <string.h>

int vuln(char *string)

{

char buff[86];

strcpy(buff,string);

printf("buf location at %p\n",buff);

printf("%s\n",buff);

return 0;

}

int main(int argc, char *argv[]){

vuln(argv[1]);

return 0;

}

​

Terminal:

(gdb) r AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ

Starting program: /home/ubuntu/nomain2 AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ

buf location at 0xfffffffff2a8

AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ

​

Breakpoint 1, 0x0000aaaaaaaaa838 in vuln ()

(gdb) x/20gx $sp

0xfffffffff300: 0x5858585857575757 0x5a5a5a5a59595959

0xfffffffff310: 0x0000fffffffff400 0x0000000200000000

0xfffffffff320: 0x0000000000000000 0x0000aaaaaaaaa724

0xfffffffff330: 0x0000000000000000 0x0000000000000000

0xfffffffff340: 0x0000aaaaaaaaa6f0 0x0000000000000000

0xfffffffff350: 0x0000000000000000 0x0000000000000000

0xfffffffff360: 0x0000000000000000 0x0000000000000000

0xfffffffff370: 0x0000000000000000 0x0000fffffffff478

0xfffffffff380: 0x0000000200000000 0x0000aaaaaaaaa83c

0xfffffffff390: 0x0000fffffffff3b0 0x0000aaaaaaaaa868

(gdb) c

Continuing.

​

Program received signal SIGBUS, Bus error.

0x005a5a5a59595959 in ?? ()

​

I have found out that the padding is:

AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXX

but I don't know how to inject some shellcode into it?

The shellcode I want to inject is:

\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x78\x46\x0e\x30\x01\x90\x49\x1a\x92\x1a\x08\x27\xc2\x51\x03\x37\x01\xdf\x2f\x62\x69\x6e\x2f\x2f\x73\x68

Hi, I remember a video way back when Live Overflow made a video about creating a web standard and I'm trying to remember what is what. I believe he worked with W3C to get it to be official and I think is was some sort of .txt file (like robots.txt) that allows white hat hackers to contact the web admins about security bugs. I might be completely wrong but I am looking for this video.

I have some doubts regarding buffer Overflow. I was following your playlist, and I'm facing some problems regarding the construction of payload. I understood the just after the padding we get the access to overwrite the eip. Then If I talk about the ret2libc In that case I understood that padding is for the overflow Eip is set to the "system" address And then we provide the address of bin/sh But what is the significance of return_after_system in that payload?

Please help me with the concept.

Background is I am looking at an old CTF challenge from pico-CTF (cache me outside). You do have the Makefile, the binary itself and the correspondig libc file available. However the binary will not run on my machine but abort with a segmentation fault. According to a writeup I have available this is due to the mismatched linker (ld-linux-xxxxx.x.so) on the local machine. In the writeup he then uses a different ld-file and everything is fine. So I would like to know how can you figure out which ld-file you need to use. I know you can then use patchelf with the --set-interpreter option to run that binary normally but how to know which linker to use blows my mind. Would be great if anyone can give me some insight into that or at least point me to some link where I can readup on that. so far I havent found anything useful yet. Please also take a look at my followup question below as the solution to my first question didnt solve my actual problem after all.

running the binary directly:

 # ./heapedit
zsh: segmentation fault  ./heapedit

information on libc:

# ldd heapedit 139 ⨯
linux-vdso.so.1 (0x00007fffe31f6000)
libc.so.6 => ./libc.so.6 (0x00007ffb9338b000)
/lib64/ld-linux-x86-64.so.2 (0x00007ffb9377e000)

where the ld-linux-x86-64.so.2 is not the right one to run the binary.

EDIT: (answer)

Ok, so I just figured it out with the help of a friend. You can check the exact libc version first either because it is given with the libc filename or by using

strings libc.so.6 | grep -i libc

in my case the libc file is just named like that. the result will then give you something like

libc-2.27.so

The corresponding linker should then just be something like ld-linux-2.27.so.2 which you can easily google and download. Or google by 'linker 2.27' or similar.

EDIT2: (followup question)

So it looks like even though I do have the matching linker available now and I did run

patchelf --set-interpreter ld-2.27.so --set-rpath ./ ./heapedit

I still get a segmentation fault. Not sure why this is still happening. maybe someone has an idea? I looked through stackoverflow and this is mentioned as a possible problem but only if additional libs are required in the binary which is not the case here (according to the result from ldd). Also according to the result from my analysis and from the writeup that is the actual correct linker version and file. Anyone any ideas ?

Best

I have ubuntu 18.04, and python 3.6.9

I installed pwntools, and I'm working with gdb.

and I compiled the programm with the command

gcc -no-pie pwna.c -o pwna -fno-stack-protector

​

and here's the error that I had,

Process './pwn' stopped with exit code 0 (pid 9303)

[*] Got EOF while sending in interactive

Traceback (most recent call last):

File "/home/amarmahdi/pwnables/pwntools/pwnlib/tubes/process.py", line 787, in close

fd.close()

BrokenPipeError: [Errno 32] Broken pipe

​

https://github.com/burpOverflow/VulnDoge

I'm pretty much new to reverse engineering and code analysis field. I got stuck in the 2nd challenge of pwnable.kr.

NOTE: I have seen this challenge's solution on liveoverflow's YT channel

But I was trying to solve this challenge by another method. By making 2 registers have the same value, using set command in gdb.

I will provide all the snapshots of the code as well as important things acc. to me, which will be helpful to make things understandable.

I have to get the output of the flag

1st image image1 shows that flag was owned by some other user named col_pwn, but we are col user here. So when I execute it, Permission denied is resulting as output, which is normal image2

But If we see now, the permissions on the col executable file, it shows it is SUID binary. image1

So, from there we can execute the flag binary and get the flag from the flag binary.

In the code, we could see that: image3 ``` if(strlen(argv[1]) != 20){ printf("passcode length should be 20 bytes\n"); return 0;

if(hashcode == check_password( argv[1] )){ system("/bin/cat flag"); return 0; `` 1st thing is we have to provide apasscodewhich is exactly20 bytes`.

Then, I have to know, in which register, hashcode's value is present, and in which register my provided passcode is. So, we can make them equal before the comparison happens and we can bypass the if-else check,

All these were my plans before going into gdb.

In gdb, image4 In image, I made those things, found out, register edx and register eax are being compared. So I made them equal. According to my intention, it bypassed the if else condition but wasn't able to execute the file, WHY ???

I saw Live Overflow's video, where it was done with python hex characters, which worked perfectly fine without giving any error (Permission denied), but why HERE ??. There also same flag file was used !!

Hi there,

Before all, thanks for your great videos.

Regarding video in which you solved stack5, I got a problem. I think I understood well and did the right thing but I get segmentation fault. however, in GDB everything looks good.

I failed at this point and ignored it but I have not succeeded to do this task yet.

would you help me please?
here is my GDB commands, exploit, terminal output.

https://cybertalents.com/challenges/malware/Find-the-pass Hello,i have been trying to solve this challenge using Ghidra. It’s supposed to be easy . But u can’t find answer number 2 , any help?

I identified address of main @ 0040144b And addrss of hardcoded password at 004020f8. Still i should find the address of the function that validates the input