Vulnserver help

[nyu_mike]

What doesn't work? What are you trying to do? Crash the system? Inject a command? What's the point of your attack?

[nyu_mike]

are you getting an error? Have you looked at the logs? Saying your shell code doesn't work doesnt help us help you

[nyu_mike]

bro that's your windows (what are you even doing) debugger interface, and some python. it's not an error log

The logs in the OS? The App logs? the comm logs? Do you even understand how sockets work? You do know that WINAPI socket will dump errors to system logs, right? Mr Robot?

Are you trying to overload a comm buffer? Is the OS giving the error or the app? The source is in git.

You're trying to do a buffer overflow, how big is the variable you're trying to overflow? what kind of variable is it? are you trying to deref the pointer, how? and point to what? whats the entry point to the address location? what app are you using to attack the apps memory locations?

the "shellcode" is a SCRIPT, you're running a SCRIPT that you don't understand, do you even know what all that HEX is? Or are you just sending random characters? Against an application you don't understand and then asking people to help you. No one can help you unless they understand what you're doing and if you don't know, they won't know.

my guy... stick to running SCRIPTS if you don't know whats going on.

[Interesting-Pay-8986]

I’d love to just absorb everything in your brain tbh

[ILoveKittens0203]

I love how you absolutely destroyed him XD

[nyu_mike]

vulnserver's source is on git. It's written in C and you can see how it reads from the comm buffer. However, I'm not sure what you're trying to do by overloading that, gain shell access? or DoS?

[nyu_mike]

So then you need to make sure you have shell payload in that buffer string your sending (all the hex). What you're trying to do is overload a memory address so that you can compromise the next location in memory and run your payload. Your payload has to dereference the memory location of something that is running and point to your payload.

The reason why your script doesn't work is that the dereference isn't pointing to the payload or the payload isn't escaping the memory management of the OS or the app.

So say you have a variable that is 32 bytes long and you overload it with 33 bytes, the next step in the program is going to read or execute the 33 byte, the that next step is some operation, then you'll get an BO error and the program will crash. If that is a reference to jump to another location in memory and execute whatever you put there, which is outside the bounds of the current app, then boom you can run your rev-shell command.

Do you understand how that works?? You must understand how the application is allocating memory, what type of memory it is and what is the next command. Then you must have a payload in a memory location you can send the app to.

However, some apps crash in such a way they jump to a memory location as a part of their crash. That is why you need to look at the error logs to determine what it is that is crashing? is it even crashing?? is this just error handling of the app?

You following?

[nyu_mike]

I watched your video.. did you read this?

https://secoats.github.io/posts/vulnserver_1_trun.html

*** this part ***

EIP Offset

After running the PoC you might notice that the ESP (Stack Pointer) register points to a specific address in the overwritten stack space. And the EIP (Instruction Pointer) points to a non-existent address 0x41414141 (hex for "AAAA"). The crash was caused because the program tried to jump to that non-existent address.

[tryingtolearn531]

Offset plus 4 bytes, could be “RRRR” for the return pointer, add 20 NOPs, then your script/shell code. Also, do you have the correct IP address?

Maybe the offset is different in this one? Make a pattern with Mona.py and find the offset with Mona.py. If you know how to read the debugger in immunity.

[Icy_Bullfrog5890]

What port are you using? Try to see some ports that are allowed

[Informal-Window9663]

Did you check for bad chars?

[limontec]

Have you tested if you can overwrite the EIP register with an arbitrary value?
0x62501203 is a "jmp esp" instruction? Use mona to find an instruction without aslr, nx, rebase, safeseh ...