This is by far the simplest and logical walkthrough of buffer overruns and how to exploit them that I've seen. I really appreciate the pace (I dont care that it was long) as you covered each part. I understood everything except the struct and little endian elements. I guess I have some reading to do :-)
Little vs. big endian, two minute edition: when you write numbers, like 123 (= 1*100 + 2*10 + 3*1), you write the 3 in the ones place last, and the 1 in the biggest place (here 100s) first. That's big endian. If you write the ones place first and the biggest place last, e.g. write 321 to mean 3*1 + 2*10 + 1*100, that's little endian. The particular number we're looking at in the code, 0x62501203, is currently in big endian. What the particular step is about is converting it to a 4-digit base-256 number written in little endian (in python's `bytes` type). If you just want to do the conversion by hand, from int to int, you can just put in 0x03125062. Notice how each pair of hex digits has been swapped by its opposite: first and last swap, and the middle two swap. Each pair of hex digits corresponds to a single digit in base 16*16 = 256. Python v3.2 and newer has a `.to_bytes` method on int objects, so you could also do `(0x62501203).to_bytes(4, byteorder='little')` and get the desired result.
Came in here with very minimal (to non-existent) understanding of bytecode and memory-buffers ... just let me say that you did an absolutely amazing job at explaining the whole of it and how each aspect works and interacts with each other. All of that in just about an hour. "Slow pace", yeah right. You're a great teacher and a real blessing for those willing to learn. I've watched a few CTF videos and miscellaneous stuff of yours but after this one you got yourself that +1 "plzsub" :D! Keep up the great work, John! It is greatly appreciated.
love you john hammond, I learned so much feel like i should dive more into buffer overflow after practically doing it myself along with you. Thank you!
I'm no genius but as far as I know, nop sleds are used to guide the program to execute code when you don't know exactly where the code lies but you know the rough area. In this case you knew exactly where to go so the nop slide was indeed kind of useless, but I do believe he brought it up only so we could know it's a thing. The reason your malicious code could lie somewhere else in the system is if it didn't fit inside the initial payload, where the code itself is another payload and ended up going somewhere else in the system. A way to reach the code is by putting a long nop slide infront of it and initiating a jmp instruction somewhere inside the nop slide. This way you don't have to know where the code lies, only roughly where it is.
Really enjoyed it, I tried this once prior to watching this and realized where I stuffed up. (little endian addr), the mona script helps ALOT.. thanks.
Thank you so much for this tutorial. You have explained it very clearly and easy to follow. Buffer overflow is the topic that made me think twice to continue pursuing cybersecurity. But there you are. Life saver. Dream Saver! Thank you so much for this tutorial.
I have watched a ton of your videos over the past few week, but this is my favorite. Watching you work through that was super instructive and downright entertaining. ⭐⭐⭐⭐⭐
This may have been one of the best videos I've ever seen on how to exploit a buffer overflow. The technique of writing the code from scratch to do this in python was super helpful! Thanks John!
from couple of weeks i was searching for some good practical for buffer overflow, and seriously man u made it so easy with the python script, the end was awesome when you get the meterpreter, love u man ❤️ keep doing this gr8 work.
i dont know any thing about this and i was hooked for the whole video this was an amazing explanation i felt like im understanding every thing thou i'll forget all of it by the next hour :D
You are amazing my dude, I love how you really went step by step and didn't gloze over anything. Especially the programming and immunity debugger parts. (which is practically everything). This teaching style trumps university professors
Its a super fast pace for me but i keep grabbing onto the handle bars everytime he posts and am fully enjoying this circus ride :) I genuinely cant get enough. Please be my boss John !? I would literally enjoy having you boss me around (not in a wierd way) but i want to sponge you. No i did not say spoon you hahah :) Your teaching skills are super amazing but your brain is the jam! Totally digging your skills dude.
This is a really good explanation of how to do the BOF on certain exams. I already knew how to do this, but I learned a few things on the way. love your work bro
Tip, you can use python to generate a list of 2984 different 4*characters by using random and a dictionary to retrieve it. Great Video John, keep it up
Perfecto... I learned Buffer Overflows once 5 months ago and taking my OSCP soon. About to jump into these again to do over and over for the test. Perfect timing mate!
This was a fun watch, since i had little knowledge of Fuzzing or buffer overflow i didnt know they were related, but oberflow does kinda work how i thought. Now i have something else to mess with and try to practice 😂
Really enjoyed it, I tried this once prior to watching this and realized where I stuffed up. (little endian addr), the mona script helps ALOT.. thanks.
Thanks alot John! I was able to do it and this should help with the upcoming eCPPT retake. It was down to the wire and i couldnt connect with the one i built. See the mistakes now.
Really appreciate your vids man! 👍 even tough I stopped coding a couple of years ago you engage me to catch back up and attend my first upcoming ctf events. Cheers
Great to have awesome persons like you to help people to learn and much appreciate that you share your valuable knowledge. I am studying OSCP and planning to attend the exam and get the certificate and for sure I will follow your great videos to learn and learn but what make me confused like what is the best to practice for exam HTB or the offensive lab or any other resources and what is the best to study materials first then start practice over and over or study and practice in same time ?! We are very lucky to have a person like you to learn from.May god bless you and much appreciate
Great vid, John. Can you make a video on a more challenging scenario; where you have IP overwrite however the buffer size is very small to fit the shellcode?
I’m not great with pentesting but anything I’ve encountered in the cybersec field this far I’ve been able understand with enough studying. Buffer overflow is the exception, I can wrap my head around the theory, I can even follow along your with steps and “understand” but I could never do this exploit on my own. This is at least my 4th time coming back to BOFs to hopefully understand and I just can’t get it.
And I want to clarify that this is an excellent video I’ve watched multiple times all the way through. Blame is not on the instructor but on the student, it’s just a bit over my head.
It may be my limited understanding of python but if your total_lenght is 2984 and you start your actual exploit code at an offset of 2003 wouldn't that leave you with only 981 bytes for the shellcode? Meaning the in b"C"*(total_lenght - ...) the equation should result in a negative number. Apparently Python dosn't fail if you try this, but that also means your final payload was even longer than 2985 bytes or did I miss something?
I'm reminded of MC Frontalot - Zero Day, nerdcore song about hacking and exploits - always kinda made sense but this video gave a real example. (also recommend frontalot to all the nerds in this chat). "Found this bug on my own, no need for a fuzzer. 'It’s already too late' spreading as we planned. No need for the NO OPs, I know just where to land. Clearing out the registers, with pointers to my functions, loaded to your memory and writing new instructions. Braindump i/o, siphoned out the eye holes; enticed so i’m digging through the disassembled byte code. Push pop change order stack frame FILO filesystem inodes, all fall to my flow. Running over, there again i go: self-propagation engine, polymorphic sideshow. Every network, we’re found to get around... the exploit payload encoded in this sound.
Fantastic video. Appreciating the "slow pace"
This is by far the simplest and logical walkthrough of buffer overruns and how to exploit them that I've seen. I really appreciate the pace (I dont care that it was long) as you covered each part. I understood everything except the struct and little endian elements. I guess I have some reading to do :-)
same here i got lost around there
Little vs. big endian, two minute edition: when you write numbers, like 123 (= 1*100 + 2*10 + 3*1), you write the 3 in the ones place last, and the 1 in the biggest place (here 100s) first. That's big endian. If you write the ones place first and the biggest place last, e.g. write 321 to mean 3*1 + 2*10 + 1*100, that's little endian.
The particular number we're looking at in the code, 0x62501203, is currently in big endian. What the particular step is about is converting it to a 4-digit base-256 number written in little endian (in python's `bytes` type).
If you just want to do the conversion by hand, from int to int, you can just put in 0x03125062. Notice how each pair of hex digits has been swapped by its opposite: first and last swap, and the middle two swap. Each pair of hex digits corresponds to a single digit in base 16*16 = 256.
Python v3.2 and newer has a `.to_bytes` method on int objects, so you could also do `(0x62501203).to_bytes(4, byteorder='little')` and get the desired result.
You don't understand something until you can explain it simply.
Love the slow pace and crystal-clear explanations. Easy to understand and follow.
The way you broke that down to where a complete beginner like myself could grasp it is a real talent.
Came in here with very minimal (to non-existent) understanding of bytecode and memory-buffers ... just let me say that you did an absolutely amazing job at explaining the whole of it and how each aspect works and interacts with each other.
All of that in just about an hour. "Slow pace", yeah right.
You're a great teacher and a real blessing for those willing to learn.
I've watched a few CTF videos and miscellaneous stuff of yours but after this one you got yourself that +1 "plzsub" :D!
Keep up the great work, John!
It is greatly appreciated.
This is by far the best video i ever saw regarding buffer overflows and how to exploit them. This is a must see for every security researcher.
Now that i have spent weeks understanding buffer overflow, everyone has started making awesome videos on that topic
Can you send some good resources you found?
You're an awesome instructor, I commend you for humbling yourself and breaking everything down in simple terms vs your knowledge level lol. Thx man
love you john hammond, I learned so much feel like i should dive more into buffer overflow after practically doing it myself along with you. Thank you!
Beginner here - not sure why you built the nop_sled, but the rest of it made perfect sense. Thank you.
I'm no genius but as far as I know, nop sleds are used to guide the program to execute code when you don't know exactly where the code lies but you know the rough area. In this case you knew exactly where to go so the nop slide was indeed kind of useless, but I do believe he brought it up only so we could know it's a thing.
The reason your malicious code could lie somewhere else in the system is if it didn't fit inside the initial payload, where the code itself is another payload and ended up going somewhere else in the system. A way to reach the code is by putting a long nop slide infront of it and initiating a jmp instruction somewhere inside the nop slide. This way you don't have to know where the code lies, only roughly where it is.
I can’t believe I just sat through a 1h video and it was the greatest thing I’ve seen all day. Loved, loved it!
Really enjoyed it, I tried this once prior to watching this and realized where I stuffed up. (little endian addr), the mona script helps ALOT.. thanks.
Unreal mate, I rarely comment but you have imparted your knowledge with exceptional skill!! I absorbed it all so easily!!! Awesome.
Thank you. The way you explained and demonstrated everything made so many different pieces finally come together for me. Ty
Thank you John for the great video. Super Informative! The "beginner" approach is much appreciated.
Thank you so much for this tutorial. You have explained it very clearly and easy to follow. Buffer overflow is the topic that made me think twice to continue pursuing cybersecurity. But there you are. Life saver. Dream Saver! Thank you so much for this tutorial.
This unfolded like a movie I got more and more invested as time went on.
Most simple and comprehensive walkthrough of buffer overflow.. Really liked and understood it.. keep it up john
I have watched a ton of your videos over the past few week, but this is my favorite. Watching you work through that was super instructive and downright entertaining. ⭐⭐⭐⭐⭐
Finally, the only video where it really clearly explains about BoF. Thanks
This may have been one of the best videos I've ever seen on how to exploit a buffer overflow. The technique of writing the code from scratch to do this in python was super helpful! Thanks John!
from couple of weeks i was searching for some good practical for buffer overflow, and seriously man u made it so easy with the python script, the end was awesome when you get the meterpreter, love u man ❤️ keep doing this gr8 work.
This was the most in depth explanation I have seen so far. Thank you!
i dont know any thing about this and i was hooked for the whole video this was an amazing explanation i felt like im understanding every thing thou i'll forget all of it by the next hour :D
You are amazing my dude, I love how you really went step by step and didn't gloze over anything. Especially the programming and immunity debugger parts. (which is practically everything). This teaching style trumps university professors
Please refrain from using the word "trump(s)". It triggers my PTSD. ;)
@@bmbiz please refrain from writing such terrible comments. It triggers my triggerinator.
@@ldSt3345 please refrain from being a bub it triggers my bob
I recently fell in love with your videos. I'm still a student but I hope that one day I'll have such a deep understanding as you have.
That was an amazing video. It really helped that you created everything by hand without using too many tools to shorten the process. Thanks a lot!
Well, understanding computer architecture is super important for understanding and making these exploits. Great video!
What you manage to do is insane... it seems almost magic. Thanks for sharing. Hope to see other exploits like this (using buffer overflow). Cheers!
Pretty cool diversity of clips. Can’t wait for some more koth.
Its a super fast pace for me but i keep grabbing onto the handle bars everytime he posts and am fully enjoying this circus ride :)
I genuinely cant get enough.
Please be my boss John !?
I would literally enjoy having you boss me around (not in a wierd way) but i want to sponge you.
No i did not say spoon you hahah :)
Your teaching skills are super amazing but your brain is the jam!
Totally digging your skills dude.
You're legend mate! I learned a lot from this video. You've explained it very well 5 star for you 🌟🌟🌟🌟🌟
This is a really good explanation of how to do the BOF on certain exams. I already knew how to do this, but I learned a few things on the way. love your work bro
Awesome john i really love your content . never got bored watching your videos till the last second
Keep up the good work ★
This and TCMs buffer overflow are my go to when I need to do BOFs
Tip, you can use python to generate a list of 2984 different 4*characters by using random and a dictionary to retrieve it. Great Video John, keep it up
Tremendous help and fantastic write up, worked perfectly!
Perfecto... I learned Buffer Overflows once 5 months ago and taking my OSCP soon. About to jump into these again to do over and over for the test. Perfect timing mate!
Hello, i had spent hours searching for a fix that would work for python3, then i found this video. Thanks so muchhhhhh
I can't say BIG THANK enough I have watched many videos about this BOF but this one one I get some hints Be blessed John
This was a very clear and well explained video. Great job John
Tip: you can use the instruction int3 (0xCC) to make a debug breakpoint, then you can see much faster when the exploit occurs.
Thanks so much for this video. I was able to do BOF very easily after your video.
This was a fun watch, since i had little knowledge of Fuzzing or buffer overflow i didnt know they were related, but oberflow does kinda work how i thought. Now i have something else to mess with and try to practice 😂
Great video. Thanks for the slow pace.
Wow great Video!! Love the slow pace and explanation.
I still don't fully understand buffer overflows but I'm way closer now, thank you!
Really enjoyed it, I tried this once prior to watching this and realized where I stuffed up. (little endian addr), the mona script helps ALOT.. thanks.
blown away... and great teaching skills !
i wish i found your channel sooner. GJ!
Woah! watched the whole video and learned alot ! Thanks John
Thanks alot John! I was able to do it and this should help with the upcoming eCPPT retake. It was down to the wire and i couldnt connect with the one i built. See the mistakes now.
Awesome video John, great explanation and demonstration. thanks for uploading.
Fantastic! thank you John, so many bits and pieces are clarified with your video.
Thank you for this video , i learnt a lot 🙂
The beard looks absolutely epic
*Perfect* lesson :)
Three thumbs up
Really appreciate your vids man! 👍 even tough I stopped coding a couple of years ago you engage me to catch back up and attend my first upcoming ctf events. Cheers
That was amazing and super informative. Thanks John!
Really great content, learned so much cool stuff and enjoyed it. Thank you and keep videos like these coming....
Thank you so much. Was so lovely and helpful. Please continue.
Awesome walkthrough, thank you!
Perfect vid for what I needed! Im going through the eCPPT course rn :))
Awesome video. You made this pretty easy to understand! Thank you
this is a banger! I'm new and it made perfect sense
i appreciate did learn a lot . You're fast in scripting for a beginner to catch up
Man, thanks for putting this together.
That's so cool man. I love your channel thanks for the videos.
Great to have awesome persons like you to help people to learn and much appreciate that you share your valuable knowledge. I am studying OSCP and planning to attend the exam and get the certificate and for sure I will follow your great videos to learn and learn but what make me confused like what is the best to practice for exam HTB or the offensive lab or any other resources and what is the best to study materials first then start practice over and over or study and practice in same time ?!
We are very lucky to have a person like you to learn from.May god bless you and much appreciate
such a great video! thank you john!!!!
Thank you so much. Spike section was a bit complicated. And you don't need to generate all the characters, you can find them on github
Thank so much for this...i have learn a lot ,sir i am waiting for your complete cyber security courses from buggier to master level
Comments don’t lie. Great video.
Thanks a lot!
This is an amazing insight - i allways wondered how an overflow leads to execution :-p
Awesome stuff, John!
Real simple to understand. I am gonna experiment with this and implement something like this into my final school project :)
John you are so good amazing and addicting to watch Thank you
Thank you John for the great video. Super Informative! The "beginner" approach is much appreciated.
1:00:33 I literally said WOOOW, so cool!
Great video. Would be awesome if we get videos for the other vulnerable commands of Vulnserver too.
what a great trip! great job!
I am totally noob in binary exploitation and thank you again !!!
I got a meterpreter!😃 thanks soooo much!
Great vid, John. Can you make a video on a more challenging scenario; where you have IP overwrite however the buffer size is very small to fit the shellcode?
I salute you, Sir!🙌
this was beautiful ,learnt a lot!
I love exploit development. Very well explained.👍
Absolutely fkin amazing.. clever guy. You're now my main UA-cam sub
great video, and i follow step by step. it worked to the last minute... but it is still waiting meter/preter
Thank you so much John
Nice one John 💯
Great video! Thank you very much!
!GOLDEN CONTENT!
Great explanation
Brand New stuff for me well explained. Got overall concept of BOF.
Thanks a lot!
This is an amazing insight - i allways wondered how an overflow leads to execution :-p
God level tutor!
I’m not great with pentesting but anything I’ve encountered in the cybersec field this far I’ve been able understand with enough studying. Buffer overflow is the exception, I can wrap my head around the theory, I can even follow along your with steps and “understand” but I could never do this exploit on my own. This is at least my 4th time coming back to BOFs to hopefully understand and I just can’t get it.
And I want to clarify that this is an excellent video I’ve watched multiple times all the way through. Blame is not on the instructor but on the student, it’s just a bit over my head.
It may be my limited understanding of python but if your total_lenght is 2984 and you start your actual exploit code at an offset of 2003 wouldn't that leave you with only 981 bytes for the shellcode? Meaning the in b"C"*(total_lenght - ...) the equation should result in a negative number. Apparently Python dosn't fail if you try this, but that also means your final payload was even longer than 2985 bytes or did I miss something?
I'm reminded of MC Frontalot - Zero Day, nerdcore song about hacking and exploits - always kinda made sense but this video gave a real example. (also recommend frontalot to all the nerds in this chat).
"Found this bug on my own, no need for a fuzzer.
'It’s already too late' spreading as we planned.
No need for the NO OPs, I know just where to land.
Clearing out the registers, with pointers to my functions,
loaded to your memory and writing new instructions.
Braindump i/o, siphoned out the eye holes;
enticed so i’m digging through the disassembled byte code.
Push pop change order stack frame FILO
filesystem inodes, all fall to my flow.
Running over, there again i go:
self-propagation engine, polymorphic sideshow.
Every network, we’re found to get around...
the exploit payload encoded in this sound.
This is pure gold..
You're the best!
Love your vids btw!
Amazing video. Thank you