# Buffer Overflow

**Buffer overflow practice machines**\
https://github.com/freddiebarrsmith/Buffer-Overflow-Exploit-Development-Practice

**Slmail55**\
https://www.exploit-db.com/apps/12f1ab027e5374587e7e998c00682c5d-SLMail55\_4433.exe

**Floatftp**\
https://www.exploit-db.com/apps/687ef6f72dcbbf5b2506e80a375377fa-freefloatftpserver.zip 

**minishare**\
https://www.exploit-db.com/apps/0ffe5385147edd1f9e7b460c6d7cb0a6-minishare-1.4.1.zip&#x20;

## OSCP BO Step by Step guide

1\. Attach debugger\
2\. Fuzz and check # of As to crash it\
3\. Check for enough buffer for exploit (about 350 - 400 bytes)\
4\. Check for bad characters (remove bad characters from script for each iterations to test)\
5\. Check JMP ESP\
\
a. `!mona modules` - find modules with no bad charcters in address (no null bytes) eg. `x5f400000` and has no DEP, ASLR protection\
\
b. Select it and click 'e' for executable modules list then double click the module

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3NnBI8VN5HdlWfuI-%2F-MN3nxLHELn10cJUHXp1%2Fimage.png?alt=media\&token=9b905443-f93b-4f55-9a48-03da564fc96f)

c. Search for jump esp instruction, rightclick > search for > command > `jmp esp`

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3NnBI8VN5HdlWfuI-%2F-MN3o96BiiBArK4qhcJM%2Fimage.png?alt=media\&token=8d8b2cb2-b49e-4016-b172-11ddeecbb5c4)

d. (OR) rightclick > search for > sequence of commands > "push esp" (enter) "retn"

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3NnBI8VN5HdlWfuI-%2F-MN3oEmwWHvtsQBi9073%2Fimage.png?alt=media\&token=2e5a61e7-f7d0-4b90-8004-53dca2714c12)

(OR) look for executable parts of dll instructions eg.

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3NnBI8VN5HdlWfuI-%2F-MN3oJOnb-8JcH4l1Gcu%2Fimage.png?alt=media\&token=49c92bc7-ac9d-45b4-accc-3a4045f2efc9)

{% hint style="info" %}
Note: Because in SLMail example the dll SLMFC is not protected by DEP and ASLR, we could use any part of the SLMFC dll (eg. Text,data,rdata etc) and not just limited to the 'Executable' part of SLMFC's .text section
{% endhint %}

e. Using the command `!mona find -s "\xff\xe4" -m <dll name>`\
Search for the jmp esp address (look for no badcharacters in address)

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3oiLENTcvZf2W8WHc%2F-MN3olYYuZVtxwERNYvo%2Fimage.png?alt=media\&token=c648605d-c300-4924-a01c-c21d54294095)

f. Verify if address contain JMP ESP. Rightclick and copy to clipboard address.&#x20;Click on icon to go to address

6\. Verifing JMP ESP

a. Add address **IN REVERSE** to buffer overflow script&#x20;\
b. Set breakpoint on JMP ESP using F2 in immunity debbuger and run\


![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3oiLENTcvZf2W8WHc%2F-MN3p8NS24cEDw_8LuFu%2Fimage.png?alt=media\&token=2d6491ac-83b0-4b3f-af58-ee94c7942623)

c. Right click ESP address and click `follow in dump` to verify that the next executing set of instructions are indeed `CCCC....`

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3oiLENTcvZf2W8WHc%2F-MN3pHgrigacAsx6wzMl%2Fimage.png?alt=media\&token=48a21fb8-1561-4fb6-96bc-47ffe7d495f9)

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3oiLENTcvZf2W8WHc%2F-MN3pJE8z3q-piUc7xnI%2Fimage.png?alt=media\&token=1819e9a3-4f15-4f3b-8083-f53004179758)

(clicking F7) will continue program flow to the "CCCCC…."&#x20;

7\. Finally Adding shellcode to buffer overflow script
