Breaking code: Warm Up Windows Exploit and RE Challenge Examenes (▀̿Ĺ̯▀̿ ̿) (day 97) part II

This is the second write up of windows exploit challenge Examenes from https://github.com/naivenom/exploiting in this post we will finish the last two remaining challenge

I put the payload at my GitHub feel free to copy it:

https://github.com/sleepyowl-beep/exploit_development/tree/master/EXAMENES-Challenge
Without further ado! Let's Do This!

Challenge 6:

 

Just like the previous challenge the program open the file named "example.txt" using fopen() function, read the first 20 bytes of the content and move it again to a different variable using strcpy to be used as parameter for function EXAMEN_L.009A10D0. Let's try to generate a new example.txt file that contains 200 characters and follow the program flow

as we follow the called function, it turns out the function itself called another function named EXAMEN_L.009A1000

Inside the function, we can see there are a bunch of checks that we need to analyze. The first two red boxes show that our input is concatenated with another string using the "strcat" function and retrieve the length of it by using strlen.

after the get the length of the string the value is compared with "0xE5"(229) this is just a simple check if the string length is not equal as 229 it will exit the program. the last two red boxes used to check the two characters located at index 5 and 6 at the string to be equal to the character "I" and "P".

from this information we can create new example.txt like this:



Run the program again and as you can see we managed to bypass the three checks



continue the execution and we will go back to the previous function and there is the last comparison that basically check if our input does not exceed 200 bytes so as long as we input 200 bytes we are fine

There you go we pass the level

Challenge 7:

We finally reached the last stage and in this challenge, we need to overflow the stack to control the flow of the program

At first, I just try to create an example.txt file again but it contains 300 "A" characters



as you can see from the figure above our EIP is overflow with our input, let's try to figure out which location in the string that we need to change to control the EIP register.



using pattern exploit tools(https://github.com/Svenito/exploit-pattern) to generate the pattern. Load the new file again and you will see that we need to control the input at index 170

let's try to check one more time if we get the right input by supplying the following input:

cool! we all set to go know all we need to is to change the EIP register to contain address "0x004010aa" which contains the level pass banner

run the program one more time and we pass the last level, cool :)

That's all folks, I hope you enjoy this blog post and see you in the next breaking code series.