3

In a CTF/exploitation lab, I am aware of two separate machines.

  • Developer machine: Windows 7 x64, as blank, as it can get (no KB patch)
  • Service machine: UNKNOWN

On Developer:

I have a source code file in C with a basic BoF vulnerability on a specific port and a compiled application of that source code. When I run the binary, I get an error with "missing api-ms-win-crt-runtime-l1-1-0.dll" and also I can not install, add, use that DLL unless I upgrade the developer machine to SP1. Therefore, I created a local VM with a blank Windows 7 x64 with "api-ms-win-crt-runtime-l1-1-0.dll" available. On my VM, I have a fully functional exploit.

On Service machine:

During a fuzzing trail and error procedure, I have identified that I can crush the target application on the same specific port due to a BoF vulnerability. Unfortunately, I can not execute any bind_tcp / reverse_tcp shell, ping back, dns request, nothing...

How can I ensure that I am pointing the EIP to the right address of a JMP ESP (for example) on the Service machine? Can I use addresses from "api-ms-win-crt-runtime-l1-1-0.dll"?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.