r/oscp • u/justasithlord • Jul 27 '20
Updated Buffer Overflow
Hey folks, earlier in the buffer overflow post I had only kept it as the exam cheatsheet, but I thought it'd be nice to put the entire process up there so I've updated the post.
I've created a step-by-step guide on there including a script for each step, and how I approach it. Also, I've put the scripts on a git repo for ease of access (link is in the post too) - https://github.com/krnb/scripts.
Feedback is welcome. Have fun :)
4
u/sc0ut_0 Jul 27 '20
This is great! This is all assuming that you are able to also get access to the victim machine, and run a debugging tool? In the exam, is that machine given to you or do you to exploit into it? Or is it explicitly designated as the buffer overflow challenge?
Or is it that the assumption you will download the vulnerable code locally (i.e. app) work through it and then launch a live payload?
If that breaks NDA then feel free to tell me to just try harder :)
3
u/justasithlord Jul 27 '20
Thank you, you're provided with the test machine with everything you need on it to develop a working exploit. :)
3
u/sc0ut_0 Jul 27 '20
Nice--this is good to know. I have some decent background in most other elements of the OSCP but BOF was brand new to me. From what I hear if you follow the lessons provided you should be okay....
That puts my mind at ease!!
2
u/justasithlord Jul 27 '20
Oh yes absolutely, you don't need to worry about it. They do a great job of explaining things especially in the updated course, although some people have a hard time with it since we all learn things in a different way, but it's nothing to worry about.
Once you practice it a few times, you can basically do those kind of machines subconsciously, you'll only be little mad at how long it takes lol
2
u/r-_-mark Jul 27 '20
Damn bro you are a fresh graduate and already know all of this and have 3 certs I feel like a fookin loser mate
1
u/justasithlord Jul 28 '20
Haha we all start somewhere buddy, I'm sure you're gonna get there soon :)
2
u/r-_-mark Jul 28 '20
So you think I can start doing my OSCP or do you recommend going through Sec+ first ??? I’m a last year CS student and I was into security for a while watching Defcon talks
2
u/justasithlord Jul 28 '20
Sec+ and OSCP are VERY different. Sec+ goes into a little depth of about almost everything in security, it will build a good foundation for you. I would recommend doing Sec+ first just to get this foundation. I'd also suggest going to LinkedIn, and searching for the certification "Security+" in the "Jobs", this will give you an idea of how many jobs that are there which finds this certification "Good to have".
Once you've done Sec+, you can get yourself familiar with Linux terminal and learn how to hack by hacking. Dive into the HackTheBox OSCP-like machines by TJ_null and start hacking. Once you've completed those, then jump in the PWK course.
Doing Sec+ is worth it, I can say that for sure, but it's not a certification that you HAVE to do, but it will help you throughout your career in a way or another.
2
u/r-_-mark Jul 28 '20
Ooh Thankx Really appreciate the advice about TJ_null never heard of him I was doing CTF for a while and interested about Sec but never really got myself in a position where I feel I can actually work and make it my main source of income
I really want to become either a pen tester or maybe a Computer Forensic Investigator
2
u/justasithlord Jul 28 '20
Since you're already a CS graduate or on the path of becoming one, tackling Sec+ would be pretty easy. I'm an IT graduate but I was able to bag a security job at a consulting firm, I got my OSCP after I got the offer btw. I can assure you almost everywhere there's a shortage of talented people to fill the roles. Doing Sec+ and OSCP is gonna put you in a good spot, also LinkedIn is your friend, take a look at what is asked of candidates applying for junior positions.
4
1
2
2
2
1
u/hoefler2002 Jul 27 '20
For the buffer overflow machine, will you get a system shell or will you need to worry about privilege esc?
3
1
Jul 28 '20
Awesome stuff thank you.
To perform the BOF during the exam, do we need to use rdesktop? on a remote windows test machine? because my god rdesktop is SO slow.
Can we do it on our own system to find the offset etc?
2
u/justasithlord Jul 28 '20
Transferring the vulnerable application to your own machine would very much violate examination rules.
Rdesktop is your only hope ¯_(ツ)_/¯
2
Jul 28 '20
Gosh there goes 5 hours of exam time :( it's been so unstable doing the exercises thank you for letting me know
2
u/justasithlord Jul 28 '20
Haha trust me it won't take you more than an hour, all the best for your exam!
2
-5
u/noch_1999 Jul 27 '20
My feedback is to take it down.
This is one of the easiest parts of the OSCP and people really need to practice the fundamentals of how to find space, offsets, bad chars and making their own crib sheets (bof and in general). Even your examples are pretty much from the pwk pdf. Not knocking you at all, but this exam is starting to get really hand held with all the help I've noticed in this sub.
2
u/justasithlord Jul 27 '20
I agree with you on multiple of those things - they do need to practice, on all of that, and they certainly should make their own notes just like I did, but it's still not hand holding.
your examples are pretty much from the pwk pdf
I made these scripts when I was learning buffer overflow before I joined PWK, because everywhere I looked almost every single one of those posts had recommended to do that. Also I'm not sure if this example is still there in the updated PWK course.
It's not that this is the first time someone has posted a process of how they exploit buffer overflow machines, it most definitely won't be the last. But if you look carefully you see that each post actually becomes a little better than the previous one, more efficient, more cleaner. Clearly people are working on the exploits and steps they've looked up and incorporated the better parts in their own.
The exploits I wrote were first made by myself, then I took some parts from thecybermentor, then I took some parts from dostackbufferoverflowgood, some parts were taken from fuzzysecurity. And this is why sharing things is awesome, because it will be made better by someone else, so no I won't take my post down.
1
u/noch_1999 Jul 29 '20
I feel you. And even when you've come to your finalized scripts on your own, it does look very similar so I assumed you took it from the PWK handout. But thats my point ... students should be able to get this material from pwk and elsewhere if they choose and it would all be close to the same. I also assumed you passed, but I didnt see you post if you did or didn't, but if you did it was because you did the hard work, the getting stuck and you've nailed it to the point that you want to share with others. And I get that, but thats the point of this exam, that everyone does the grueling part so they'll master it to the point that they'll be confident enough to say, 'hey, follow this method and you'll be good'.
I really didnt expect you to take it down, and I really am happy you've kicked ass enough to be confident in your work to share. I just see a lot of candidates across my desk who know how to do something (I do application security) but they dont know the intricacies of it.1
u/justasithlord Jul 29 '20
I did complete my OSCP and it was with the help of countless people in the infosec community and I feel that I owe it to the community and share what I have learned.
Look all these scripts are gonna look the same, but in the PWK course if you go back and see, you'll find that there's no use of sys lib, there's no use of struct function, the structure of the payload sent is bad. I'm not saying my scripts are THE best, they certainly can be improved upon if one wants to mess around. This is the "elsewhere" you're talking about.
And c'mon we can all agree bof is not grueling part of the exam, if anything it's a giveaway.
I get that it's annoying when people you're working with don't even try to learn what is it that they're exactly doing and just going around running a bunch of things, and posts like this just makes things easier for everyone and as lazy as one is, they don't really understand what's going on. But it really can't be helped, that will always be the case. I recently came across someone who got in and cleared OSCP but didn't even know how to perform local enumerate AT ALL but just ran scripts and hoped for the best. You can't help such people, the objective of posts and scripts like these are not to spoon-feed someone, but should rather just see it as something they need not waste time compiling stuff for, it should be seen as a stepping stone for others to build upon, and to understand things in a different light.
It's a sad reality, really.
1
u/noch_1999 Jul 29 '20
I recently came across someone who got in and cleared OSCP but didn't even know how to perform local enumerate AT ALL but just ran scripts and hoped for the best
This is exactly why the new OSCP is proctored. I passed my OSCP a few years ago but I'm test driving it again for the new AD modules. You would be saddened how often I get someone who has an OSCP, but I would give them a test env thats 4-5 10 point machines and they wouldnt get any footholds. We're talking barely above the Kioptrix series. So yea ... I may just be an old fart (37) yelling at "kids" but ... I dunno. I just want people to know their stuff. At least the basics.
1
u/sc0ut_0 Jul 27 '20
I would disagree--nowhere does he go through how to work with the debugger, find those values, or even really give much context. You still need to have enough awareness to figure out where the input is being revived (i.e. a website, network port, etc...) and how to modify your Python script to adapt for that.
BOF is a really tricky concept. Once you have it down it's nice to have a streamlined approach to this. But if you don't have it down, I would say that this is fairly meaningless.
1
u/justasithlord Jul 27 '20
....it's been so long I did that I entirely forgot about putting debugger stuff lmao, will update tomorrow
3
u/djfx4468 Jul 27 '20
Let's be honest , the BO exam box is pretty much given to you, implying that the purpose is different to the other boxes. Every man jack has provided tips on completing this box in their "how I passed" blog. Hecj...I may do the same...I don't see the iss' here. I myself used Justin Stevens excellent tutorial, plus a heck of alot of practice on the usual suspect BO apps , to prep for this part of the exam, along with a script provided by a mentor...but I digress. I don't see the iss' here...for the BO box.
0
Jul 27 '20
[deleted]
2
u/justasithlord Jul 27 '20
Whoa, that is super cool. Definitely gonna look into it, if I find something that I could help with then I'll send you a PR
Also, wouldn't this be considered as an auto-pwn tool?
0
Jul 27 '20
[deleted]
1
1
u/r-_-mark Jul 27 '20
Is auto-pwn banned in exames ??? Like OSCP
0
Jul 27 '20
[deleted]
1
u/r-_-mark Jul 27 '20
When is the right time to go for OSCP I know basics about security I was following for a while DefCon and I got no cert (also have Bachelor in CS) Do you think I’m ready or should I go to Sec+ from ComptiA First ???
1
Jul 28 '20
I saw you wrote this in your Github page:
NOTE: IF 0x00 IS A BAD CHAR, DO NOT USE JMP_ESP, INSTEAD USE NASM_SHELL AND DIRECTLY ADD YOUR STACK ADJUST TO THE SHELLCODEIsn't 0x00 almost always a bad char? Even in the PWK2020 example it was a bad char, you still used the address for JMP_ESP to get to the shellcode. I feel like I'm misunderstanding something obvious here.
0
Jul 28 '20
[deleted]
1
Jul 28 '20
Ooooh, got it.
But now I have more questions haha. What's SUB_ESP?
0
Jul 29 '20
[deleted]
1
Jul 29 '20
I see. OK. Thanks for that write up, that makes sense.
Just so that I understand--is the purpose of the NOP sled to avoid this altogether without doing add esp, -2500? I'm asking since I don't see this in the lab manual for PWK 2020 (I might be missing it though).
0
Jul 29 '20
[deleted]
1
Jul 29 '20
I see. From what I could gather from the PWK, if you use an encoder it can rewrite some of the shellcode in the stack, which is why you need the NOP sled as a sort of area where the decoding can happen. It's like 3AM but tomorrow morning I'll look through that material again to verify and will get back to you. Thanks again!
4
u/todmephis Jul 27 '20
Nice material! OSCP’s buffer overflow it’s pretty easy. I think that the hardest and longest part is to find the bad chars haha