Buffer Overflow + Exploit File Sharing (SEH-SafeSEH)

Night,,,
I wiill try to Buffer Overflow + Exploit File Sharing Wizard. Let's start tutorial

U must be prepare :
1. Virtual Machine (Windows + Installed on File Sharing Wizard)
2. OllyDbg (Installed on Virtual Machine)
3. Backtrack (i'm using BT5)


1. Run virtual machine and open File Sharing on OllyDbg.
2. Create a script fuzzer to attack File Sharing

#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
string="A"*2000
s.connect(('192.168.43.128',80))
print("Finish")
payload = (
'HEAD %s HTTP/1.1\r\n'
'\r\n') % (string)
s.send(payload)
s.close()

Stack Buffer Overflow + Exploit BigAnt (SEH-SafeSEH)

Hey guys,,,:)
Yesterday I was discussing and practicing how to basic Exploit+Buffer Overflow use Direct Return for some application (WarFTP, RM-MP3 Converter, VUPlayer).  Now I will practice basic Exploit+Buffer Overflow for SEH-SafeSEH application that is BigAnt. BigAnt is commonly used application for messagge on the Office.Okey, let's go to tutorial

Should be prepared :
1. Virtual Machine (Vbox or VMplayer) + Windows
2. BigAnt  version 2.52 (installed on windows)
3. OllyDbg (installed on windows)
4. Backtrack


1. Open OllyDbg and BigAnt , on the OllyDbg click file > attach > select process running BigAnt for AntServer.exe

Buffer Overflow + Exploit VUPlayer

Hey,,, :)
For the third time, I will do buffer overflow + exploit on VUPlayer aplication.
as usual, must to prepared :
1. Virtual Machine (Vbox or VMplayer) + Windows
2. VUPlayer (installed on windows)
3. OllyDbg (installed on windows)
4. Backtrack 

1. First step 
  

Run the VUPlayer on  machine, first I was a little confused where to start. then I try to see the menus on VUPlayer. but I found a menu that is "Add URL"

Buffer Overflow + Exploit Mini-Stream RM-MP3 Converter

Night everybody,, I will try a second time to buffer overflow + Exploits Mini-Stream RM-MP3 Converter which is an application on W*nd*s. 
Surely you already know that this application is used to mp3 file converters.

Should be prepare :
1. Backtrack 5
2. VMware player + Microsoft Windows
3. Fuzzer
4. OllyDbg
5. Mini-Stream RM-MP3 Converter

Oke,,step by step...

Buffer Overflow WarFTP Direct Return (non-SEH)

I will try to exploitation on an application. As the title above to bufferoverflow in applications that run on W*nd*ws. By way of "direct return" I will exploit WarFTP application because it is classified as non-SEH (Structured Expetation Handling) application.

Should be prepare :

1.Backtrack 5

2. Fuzzer

3. Vmware Player + Windows XP

4. WarFTP application

5. OllyDbg application

Oke,

1. Run Windows Xp on Virtual Box

2. Install WarFTP (follow the step the instalations)

3. After installation is complete, open the application WarFTP click properties and then run start service.

Fuzzer / Fuzzing

A Security fuzzer is a tool used by security professionals (and professional hackers ) to test a parameter of an application. Typical fuzzers test an application for buffer overflows, format string vulnerabilities, and error handling. More advanced fuzzers incorporate functionality to test for directory traversal attacks, command execution vulnerabilities, SQL Injection and Cross Site Scripting vulnerabilities. Web Vulnerability scanners typically perform all of this functionality, and can be considered an advanced fuzzer.