Understanding the Code

00:01

understanding the code

00:03

are learning objectives are to understand how to analyze exploit code,

00:07

interpret what the code does and check if the exploit code is malicious to our own machines,

00:14

understand the code, so you don't have to be a developer to pass the osc p um I understand a little bit more than I did when I passed the SCP about python and javascript and things like that. But I definitely was by no means an expert in writing code or writing scripts. I mean I

00:33

I did some bash scripting and I did some python scripting and still now I just say I can script

00:40

but um you do generally need to know what code does and you did that in the buffer overflow lab is and and the whole that whole module is your writing code. You're writing code to exploit a buffer overflow vulnerability in python.

00:56

And if you notice it was written in python two and now we're using python three and even that it takes some getting used to it. If you know python two

01:04

um you need to know how to modify that code to fit python three and you'll notice that the author of do stack buffer overflow, good talks about his exploit code and how he changed it and how it has to be changed

01:18

to fit python three. But if you know python two and you look at a python three script you generally know what's going on. It's like you know I can speak spanish um and I also have heard people speak italian and I know that some words can be very similar

01:34

so it is kind of like that and it goes to the same with other types of code. I don't know java I don't know C Sharp but I should at least study enough to know what the code is doing because the worst thing that could happen is I pull somebody's code from GIT hub and I have no idea what it does

01:53

and it just doss is my box because someone thought it would be funny

01:59

if someone pulled code from their website and you know, now they're laughing at us because we've, we've erased all of our files

02:06

or they've created a backdoor. So again, it is really important to know what the code is doing. So no enough of the code to and also that's being good pen tester, right? You have to be able to explain to a client the exploit that you used and what it did.

02:22

And if you have no idea, well you don't look like a very professional pen tester. So

02:27

that's why you should know what the code does.

02:30

So of course that you have to actually read the code and a lot of this code will have comments in them. And that's why I picked this Konica Minolta vulnerability one because it's a buffer overflow, which we just did. So it kind of, you're you're used to looking at that code.

02:44

And the other thing is there's lots of comments in that code, so it's very verbose and it's very helpful. So you'll, you'll notice in things like the dirty cow exploit and a lot of those that will tell you how to compile that code correctly. And that's what will happen when you get these colonel exploits

03:01

is if you have to you have to compile them correctly

03:05

so that they work and if you don't, well then it's not going to work correctly. So

03:08

if someone is doing a good job of, of being helpful to other hackers, they're going to put comments in their code to help us understand what it does.

03:17

You'll also notice a lot of the time there's hard coded information, there's hard coded ports, someone's going to assume it's an FTP vulnerability is going to be on port 21 or Ssh is port 22. As we've seen, that's not always the case. People change ports so be cognizant of that.

03:35

You saw the SMTP one was Port 25.

03:38

What if it's on port 25 25 or some other random port? So you have to be able to spot those IP addresses that are hard coded

03:46

as well as the ports and and change them if necessary.

03:53

So again, we're looking at this Konica Minolta exploit script and I talked about this before.

04:00

He tells you a lot uh what software it what software it was tested on, what, what version of Windows it was tested on how to set up a net cat listener and what it looks like when the exploit works as you should get this

04:14

command line prompt in the Windows box.

04:17

Um So and also realize is this python two or is this pipe python three with the shebang user bin python?

04:27

So be aware of that. If you're trying to run python three on this code, will it work?

04:32

So again, no, no what version of python this looks like or is.

04:38

Um So you'll also notice in this code

04:41

a hard coded I. P. Address with MSF venom. We've used MSF venom a lot. The listening host you see is hard coded and the and the listening port is hard coded. That is of course something that we're going to have to change

04:54

in our environment because we're not gonna have the same ip address. I can bet you that

05:00

also notice with exploits if you have to be authenticated or not. If you're if you don't have,

05:08

if you don't have the login credentials, well then it's not gonna work right because you need to have the user name and password to authenticate um into the application to exploit the vulnerability. You can see this is a Wordpress plug in that only works. If you're authenticated into the application, you'll notice that with a lot of wordpress plug ins is

05:26

you have to be authenticated to exploit it. Well pay attention to that and you should notice that with your WP skin output. I prioritize the unauthenticated over the authenticated. If I don't have a login and password. Right? Because it's going to be a whole lot easier

05:44

for an unauthenticated file upload vulnerability than an authenticated sequel injection.

05:49

Also be aware it has H G p vulnerable site dot com.

05:56

Of course ours isn't gonna say vulnerable site dot com. Um you know ours could be an I. P address and we could have a different wordpress directory, it could be, you know, 19216817

06:09

Wordpress and then WP admin.

06:12

So realize that

06:14

right here with action you may have to change the vulnerable site and the path

06:18

of this of this site to have your exploit work.

06:26

So in summary, we should now understand how to analyze exploit code. I know you're not going to be an expert. I really recommend taking some basic coding classes and like python, I know python is very popular

06:38

but I would just just so generally you understand what code does.

06:42

You should be able to interpret what the exploit code does.

06:46

Google again, is your friend. If you just want to google certain syntax, you know, what's import system or import socket in python, what is that doing? Google it, you know, it's in your code for

06:59

for the FTP vulnerability, what our libraries in python, you should know what those are.

07:04

And also check of the exploit code is malicious to your own machine.

07:09

Of course, you know, we've done command line labs um and they note this in the P W K material that some code that they saw, like removed everything within the box are mrf, you know, it it removes

07:21

everything and it's a malicious script. So

07:25

that's why I talk about GIT hub being careful exploit DB. If there's a check mark, I wouldn't worry so much about, but nowhere you're downloading the code from and

07:34

check and make sure you understand what the code does because again, a good pen tester is going to be able to explain to a client

07:42

what the code is doing, why why this exploit code is working,

07:46

so I will see you in the next lesson.

07:49

Yeah,