Buffer Overflows Made Easy - Part 5: Overwriting the EIP

Key Takeaways

[Music] ok so now we're going to try to overwrite the EIP so in the last video we discovered that the offset was at 2003 bytes what that means is there's 2003 bytes right before you get to the IP and then the EIP itself is 4 bytes long so we're going to try to do is overwrite those four specific bytes so as always go ahead and get your immunity debugger running with Volans ever attached when you have that let's go ahead and hop right into Kali Linux this should be a pretty short video so we're gonna do is let's go ahead and just G edit the last script that we wrote which was 2 dot PI and we're gonna modify this together so we can do here is we can just delete this offset variable because we don't need that anymore and instead we can just write shell code here and we'll switch out this offset variable to shell code and then let's go ahead and set this equal to a times 2003 plus B times 4 so let's make sense of this real quick we're replacing what we sent before to find the offset with the shell code now the shell codes nothing but A's and B's right now but it's going to get malicious in a minute so what we're doing here is we're sending 2003 A's why because that's where the EIP starts so bite 2004 starts the EIP so what we're doing is we're sending a bunch of a's but we want to make sure that we don't overwrite the EIP with A's and have no idea if we're correct or not so remember A's are four ones B's is gonna then be 4 - so in theory we should see four two four two four two four two on the EIP when we override it so let's go ahead and just fire this guy off I'm gonna save this and you could save it as dot three if you want I'm just gonna keep a dot two to make it simple and then what we're gonna do is to dot pi remember if you did make it a new file go ahead and change the mode and since we have vole and server running and attach to immunity dude bugger we should feel a little fire this guy off and it should break the program so we have paws down here access violation great okay so let's talk about what happened here so you see the EAX trend ran through a bunch of a's we're used to seeing that EBP 401 401 401 401 good came through but look here the EIP is four two four two four two four two now we only sent four bytes of bees and they all land on the EIP guess what that means we control this AI p now so from here it's pretty smooth sailing we got a couple of housekeeping things we got to do in terms of finding bad characters and finding the right module to send this to but once we do that we're gonna generate some shellcode we're gonna point this IP here instead to that return address that's gonna be malicious and then we're going to gain root so hopefully this makes sense again just to reiterate we have controlled the EIP and now we're gonna start to get malicious so in the next video we're going to talk about finding bad characters [Music] you [Music]