Exploit Research Megaprimer Part 5 Freesshd Buffer Overflow

Description:

Welcome to Part 5 of the Exploit Research Megaprimer. Please begin this series by watching Part 1, if you have not already done so!

In this video, we will look at how to exploit a buffer overflow which was disclosed on Exploit-Db - FreeSSHD 1.0.9 Buffer Overflow. You can download the FreeSSHD Program and follow this video.

We will first start by understanding the vulnerability from it's description on Exploit-Db and then reproduce the same in our lab setup. After this, we will use the Immunity Debugger to examine the exploit conditions, find the offsets for RET and ESP overwrite, find the bad characters which are 0x00, create shellcode for the payload encoding for these bad characters, create the exploit program and finally exploit the program! One of the interesting things you will find in this program is that the RET address and ESP are not adjacent to each other like in the previous examples.

Hope you enjoy this video! Please do leave your comments behind.

Tags: basics ,

Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.

Comments:

jan85f on Mon 28 Feb 2011

Hi Vivek,

I'm watching all your Primers since Friday. They are amazing! In my opinion, its nice to see you down rigth in the sceen =)

Next weekend I'm gonna code all your tutorials on Win7 32bit, maybe also on 64bit.

Looking forward to see more of you!

Best regards
Jan
Vivek-Ramachandran on Mon 28 Feb 2011

Thanks! When you do that if you have any interesting insights, then please do post them here.
Aoi on Wed 02 Mar 2011

Love your vids Vivek! They are extremely helpful and very well done.

Also, I think the small box with you in it is a good idea.

Thanks for all your hard work!
Vivek-Ramachandran on Wed 02 Mar 2011

@Aoi Thanks! Let me know if you have any feedback. I will start making the next set of videos in this series very soon.
Aoi on Fri 04 Mar 2011

Sounds good Vivek! Can't wait. Just thought of a quick question, could you recommend any other buffer overflows from exploit-db that would be good to try on my own?
kichan on Tue 24 May 2011

vivek this example was great.. mehn u awesome.. and the picturing picture is a great idea. u rock
rails345 on Sat 25 Jun 2011

Vivek, Just love your disciplined, step-by-step approach demonstrated in these videos. Also, very much appreciate your effors to insure that the various steps are both highly visible and explained. Thank you for this gift!
Gdogg on Wed 29 Jun 2011

I've watched 20+ of your videos, and they're great. Finally signed up because I know you like comments.

Question: Why do you always put the shell code in brackets, but nothing else? I don't think its necessary but I could be wrong. It's weird that you do it consistently though.

Some videos your mic sounds really muffled/staticy. I'd suggest you test out the sound first, because it was very hard to hear what you were saying in the last video in this series.

Another thing is I wish you mentioned why you woudl use a local buffer overflow in the older videos (to get higher access). I knew why, but I have been sending the videos out to others and some don't understand what the purpose would be when we have access to the binary anyway.

Other than that, keep up the amazing work. (I wish these videos were made 4 years ago, when I was just learning assembly)
in0cula on Sun 17 Jul 2011

Thank you, love this megaprimer
security123 on Wed 10 Aug 2011

thanks sir for such great work

i have a question why we use buffer +="A"*23000

if i will not use this then buffer overflow is not occurs while i have successfully overwritten ESP and EIP .
as i think answer would be because EIP will be read after buffer over flow occurs
plz help me
ChetaN on Mon 16 Jan 2012

plzz any 1 provide FreeSSHD alternate download link :(

that dl link not working for me...
mich4 on Sat 25 Feb 2012

@ChetaN this link works for me. I had also problems with the above link
http://cdn03.exploit-db.com/wp-content/themes/exploit/applications/be82447d556d60db55053d658b4822a8-freeSSHd.exe

Vivek you are the best your videos helps me a lot
keep the good work up =)
balaraja on Wed 18 Jul 2012

FreeSSHD 1.0.09 can be downloaded from http://www.mediafire.com/?u99oacr8b52hrhz

Thanks Vivek!! Needless to say your videos are awesome :)
Krish on Wed 27 Feb 2013

Ok I have downloaded this file from mediafire link and uploaded here:
http://www.mirrorcreator.com/files/1PZEQYFF/freeSSHd1.0.9.exe_links

SecurityTube

Follow us

Login to post a comment