Name: Buffer Overflow Bypass DEP using ROP
Uploaded: 2022-02-05T22:56:41+00:00
Duration: 34 min 49 s
Description: That's the English version about this topic where I manually adjust the gadgets into the memory in order to execute VirtualAlloc function to change memory's properties to execute so it can execute a s

2 years ago

bufferoverflow bof rop rop chains ropchains oscp

That's the English version about this topic where I manually adjust the gadgets into the memory in order to execute VirtualAlloc function to change memory's properties to execute so it can execute a shellcode to get back a reverse shell.

Was used the CloudMe Sync 1.11.2 vulnerable version.

00:00 Intro
00:55 Pre-reqs
01:25 Review Stack Buffer Overflow
02:43 Theory - DEP - Data Execution Prevention
03:00 Theory - ROP - Return-Oriented Programing
05:00 Theory - Change Memory Protection
06:15 How VirtualAlloc base address
06:45 What modules should you use?
07:30 RP++
08:10 Organize the gadgets with custom tool
08:50 Demo time
09:12 CloudMe Sync version check
09:20 Code overview
10:10 Checking VirtualAlloc signature
11:17 Using Ida Pro to get VirtualAlloc base address
12:25 Payload Walkthough
13:27 Starting Windbg
13:38 Load Narly, get loaded modules
14:10 Generate modules list and execute RP++
15:18 Organize RP++ output into simpler gadgets groups
16:15 Add the first breakpoint
17:05 Debug started
17:40 Visualize stack and the placeholders
18:52 Get a copy of ESP
20:00 Move to first placeholder
22:26 Pop VirtualAlloc base address
23:04 Check POI(EAX)
23:29 Dereference VirtualAlloc base address
23:55 VirtualAlloc patching
24:33 Increment ECX
25:30 Find a place to store the reverse shell
26:40 Return address patching
27:15 lpAddress patching
28:25 dwSize patching
29:45 flAllocationType patching
30:33 flProtect patching
30:56 Check stack with VirtualAlloc function and its parameters setup
32:03 Update ESP to point to VirtualAlloc address
32:48 Check protection memory before execution
33:23 Get reverse shell
33:40 Check protection memory after execution
34:20 Bye!