buffer-overflow/win-buff-overflow at master · SiowCY/buffer-overflow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
Kali pattern create:
# cd /usr/share/metasploit-framework/tools/exploit/
# ./pattern_create.rb -l 1000

Kali pattern offset:
# cd /usr/share/metasploit-framework/tools/exploit/
# ./pattern_offset.rb -l 1000 -q [EIP pattern]

Immunity DBG mona.py pattern create:
!mona pattern_create 1000

Immunity DBG mona.py pattern offset:
!mona pattern_offset [EIP pattern]

========================= Bad Character =========================

"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10"
"\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30"
"\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50"
"\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70"
"\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90"
"\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0"
"\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0"
"\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0"
"\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"

========================= JMP ESP ===============================

Buffer = "X" * [number] + [JMP ESP] + [NOP] * number (in case extra random buffer required) + shellcode

In OllyDBG find instruction:
Search for > All Command
JMP ESP

In mona.py
!mona modules
!mona jmp -r ESP -m kernel32.dll

========================= POP POP RET ===============================

Buffer = "X" * [number] + [POP POP RET] + [NOP NOP] + [JMP ESP] + [NOP] * number (in case extra random buffer required) + shellcode

In OllyDBG
Search for > Sequence of commands or Search for > All sequences
POP r32
POP r32
RETN

In mona.py
!mona findwild -s "pop r32#pop r32#ret" -m kernel32.dll

========================= Radare2 rasm2 - hex dis/assemble =========================

Assemble
$ rasm2 -a x86 -b 32 'mov eax, 33'
b821000000

$ echo 'push eax;nop;nop' | rasm2 -f -
5090

$ rasm2 -a x86 -b 32 -f file.asm

Disassemble

$ rasm2 -a x86 -b 32 -d '90'
nop

========================= Radare2 rax2 - hex, ascii, bin convert =========================

$ rax2 0x345
837

$ rax2 837
0x345

$ rax2 44.44f
Fx8fc23142

$ rax2 0xfffffffd
-3

$ rax2 -3
0xfffffffd

$ rax2 -s "41 42 43 44"
ABCD