(Buffer Overflow: Lesson 1)

{ PCMan's FTP Server 2.0.7 Buffer Overflow Explained }

1. What is Damn Vulnerable Windows XP?
   • This is a Windows XP Virtual Machine that provides a practice environment to conduct ethical penetration testing, vulnerability assessment, exploitation and forensics investigation.
   • The Microsoft Software License Terms for the IE VMs are included in the release notes.
   • By downloading and using this software, you agree to these license terms.
   
   
2. What is PCMan FTP Server?
   • PCMan's FTP Server is a free software mainly designed for beginners not familiar with how to set up a basic FTP.  Configuration is made very easy. Consequently, functionality and security are not major concerns.  Accordingly, the following exploit (CVE-2013-4730) exists.
    
3. What is the PCMan FTP Server 2.0.7 Buffer Overflow Exploit?
   • The CVE Vulnerability number is CVE-2013-4730.
   • Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.
   
   
4. Implementing the CVE-2013-4730 with PCMan FTP Server 2.0.7
   • The following lesson will show you step by step (1) How to discover how many bytes it would take to crash PCMan, (2) How to determined the offset, which is number of bytes necessary to occur before the EIP can be over overwritten, (3) How to extract a good JMP ESP static memory location from SHELL32.dll, (4) How to established control of the EIP, (5) How to test the hexadecimal sequence list for bad characters, (6) How to create a payload, (7) How to encode the payload in perl output, and (8) How to successfully overflow the buffer and place the payload into memory thus allowing us to connect remotely with netcat.
   
   
5. References
   • Author: @PROFESX0R
   
   
6. Special Thanks!!!
   1. I wanted to thank Master Peleus(@0x42424242)for his original PCMan Buffer Overflow Article in which this lesson is based upon.
   2. I wanted to thank Master Mitchell(@bobmitch2311) for providing the blueprints and working with me step by step. Boston College is very lucky to have a Computer Science Student of your caliber.
   
   
7. Pre-Requisite
   • Damn Vulnerable Windows XP: Lesson 1: How to create a Damn Vulnerable Windows XP Machine
   • Damn Vulnerable Windows XP: Lesson 8: How to install OllyDbg v1.10 x86 Debugger
   • Damn Vulnerable Windows XP: Lesson 9: How to setup the PCMan's FTP Server 2.0.7 Buffer
   
   
8. Lab Notes
   • In this lab we will do the following:
     1. Using fuzzing to determine the crash point of PCMan.
     2. Using fuzzing, pattern_create.rb, and pattern_offset.rb to determine the offset.
     3. How to overwrite the EIP.
     4. How to extract a JMP ESP static memory location and place it in the EIP, thus taking control of the EIP.
     5. How to test the sequential hexadecimal sequence list for bad characters.
     6. How to create a payload with msfpayload.
     7. How to encode a payload in perl format with msfencode.
     8. How to craft perl script to implement a buffer overflow, which includes injecting the payload in memory to allow a remote connection with netcat.
    
9. Legal Disclaimer
   • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
   • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
   • In addition, this is a teaching website that does not condone malicious behavior of any kind.
   • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
   • © 2016 No content replication of any kind is allowed without express written permission.

1. Open VMware Player on your windows machine.
   • Instructions:
     1. Click the Start Button
     2. Type "vmware player" in the search box
     3. Click on VMware Player
   • 

    

2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Damn Vulnerable WXP-SP2
     2. Edit Virtual Machine Settings
   • Note:
     • Before beginning a lesson it is necessary to check the following VM settings.
   • 

    

3. Set Network Adapter
   • Instructions:
     1. Click on Network Adapter
     2. Click on the radio button "Bridged: Connected directly to the physical network".
     3. Click the OK Button
   • 

    

4. Start Up Damn Vulnerable WXP-SP2.
   • Instructions:
     1. Start Up your VMware Player
     2. Play virtual machine
   • 

    

5. Logging into Damn Vulnerable WXP-SP2.
   • Instructions:
     1. Click on Administrator
     2. Password: Supply Password
        •  (See Note)
     3. Press <Enter> or Click the Arrow
   • Note(FYI):
     2. Password was created in (Lab 1, Section 1, Step 8)
   • 

    

6. Open the Command Prompt
   • Instructions:
     1. Click the Start Button
     2. All Programs --> Accessories --> Command Prompt
   • 

    

7. Obtain Damn Vulnerable WXP-SP2's IP Address
   • Instructions:
     1. ipconfig
     2. Record Your IP Address
   • Note(FYI):
     • In my case, Damn Vulnerable WXP-SP2's IP Address 192.168.2.106.
     • This is the IP Address of the Victim Machine.
   • 

1. Open VMware Player on your windows machine.
   • Instructions:
     1. Click the Start Button
     2. Type "vmware player" in the search box
     3. Click on VMware Player
   • 

    

2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Kali
     2. Edit Virtual Machine Settings
   • Note:
     • Before beginning a lesson it is necessary to check the following VM settings.
   • 

    

3. Configure CD/DVD
   • Instructions:
     1. Click on CD/DVD (IDE)
     2. Click on the radio button "Use physical drive:"
     3. Select Auto detect
   • 

    

4. Set Network Adapter
   • Instructions:
     1. Click on Network Adapter
     2. Click on the radio button "Bridged: Connected directly to the physical network".
     3. Click the OK Button
   • 

1. Start Up Kali
   • Instructions:
     1. Click on Kali
     2. Play virtual machine
   • 

    

2. Supply Username
   • Instructions:
     1. Click Other...
     2. Username: root
     3. Click the Log In Button
   • 

    

3. Supply Password
   • Instructions:
     1. Password: <Provide you Kali root password>
     2. Click the Log In Button
   • 

    

4. Open a Terminal Window
   • Instructions:
     1. Click on Applications
     2. Accessories --> Terminal
   • 

    

5. Obtain Kali's IP Address
   • Instructions:
     1. ifconfig
     2. Record your IP Address
   • Note(FYI):
     • Arrow #1, ifconfig is used to display Kali's IP Address.
     • Arrow #2, Record Your IP Address. 
       • Mine is 192.168.2.111. 
       • Yours will probably be different.
   • 

1. Open the Command Prompt (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Click the Start Button
     2. All Programs --> Accessories --> Command Prompt
   • 

    

2. Create PCMan Artifact Directory
   • Instructions:
     1. mkdir C:\BUFFER\PCMan
   • Note(FYI):
     • Arrow #1, Use (mkdir) to create the following directory (C:\BUFFER\PCMan).  This directory will be used to same some lesson artifacts.
   • 

    

3. Create PCMan Script Directory (On Kali 1.0.5)
   • Instructions:
     1. mkdir /var/tmp/BUFFER/PCMan
     2. ls -ld /var/tmp/BUFFER/PCMan
     3. cd /var/tmp/BUFFER/PCMan
   • Note(FYI):
     • Arrow #1, Use (mkdir) to create the following directory (/var/tmp/BUFFER/PCMan).
     • Arrow #2, Use (ls -ld) to display the directory(d) long listing for the following directory (/var/tmp/BUFFER/PCMan).  If you remove the (d) the contents of the directory will be displayed as well.
     • Arrow #3, Use (cd) to navigate to change directory into the following directory (/var/tmp/BUFFER/PCMan).
   • 

    

4. Download Fuzzer Perl Scripts
   • Instructions:
     1. wget http://www.computersecuritystudent.com/SECURITY_TOOLS/BUFFER_OVERFLOW/WINDOWS_APPS/lesson1/fuzzer.tar.gz
     2. tar zxovf fuzzer.tar.gz
   • Note(FYI):
     • Arrow #1, Use (wget) to download the perl scripts that we will eventually use for fuzzing purposes.
     • Arrow #2, Use (tar) to unzip(z), extract(x), file(f), don't restore ownerships(o), in verbose mode.
   • 

    

5. Change Perl Script Permissions
   • Instructions:
     1. chmod 700 *.pl
     2. ls -lrta
   • Note(FYI):
     • Arrow #1, Use (chmod) allow the current owner (ie root) Read(4), Write(2), and Execute(1) permissions to all perl script file that end in (*.pl).
     • Arrow #2, Use (ls -lrta) to display a long listing (-l) of files in reverse(r) order by time(t), and show any hidden(a) files that start with a dot(.).
   • 

1. Open Firefox (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Click the Start Button
     2. All Programs --> Mozilla Firefox
   • 

    

2. PCMan 2.0.7 Buffer Overdue Description
   • Instructions:
     1. Navigate to the following URL
        • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4730
   • Note(FYI):
     2. Arrow #2, The first clue of the description tells you the the remote attacker can execute arbitrary code via a long string. 
        • Accordingly, your question should be how long do I make the string?
     3. Arrow #3, The second clue of the description tells you that the remote attacker is attacking the USER command.
        • Subsequently, your next question should be how do we attack the USER command with a long string.
   • 

1. Start PCMan FTP Server (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Right Click on PCMANFTPD2
     2. Click on Open
   • 

    

2. PCMan is Online
   • Note(FYI):
     1. Arrow #1, Notice the FTP Server is online
   • 

    

3. Exit PCMan
   • Instructions:
     1. --> (See Picture)
     2. Click the Yes Button
   • 

1. Start PCMan FTP Server (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Right Click on PCMANFTPD2
     2. Click on Open
   • 

    

2. PCMan is Online
   • Note(FYI):
     1. Notice the FTP Server is online.
        • I apologize for the repetitive starting and stopping of the FTP Server.
        • But, Practice Makes Better
   • 

    

3. Basic NMAP Scan (On Kali 1.0.5)
   • Note(FYI):
     • Replace (192.168.2.106) with your Damn Vulnerable WXP-SP2 Address found in (Section 1, Step 7).
   • Instructions:
     1. nmap 192.168.2.106
     2. Notice that you can see that FTP is running on Port 21
   • Note(FYI):
     • Arrow #1, Use (nmap) to run a very basic footprint scan on the Damn Vulnerable WXP-SP2 machine.
     • Arrow #2, It is great that we can see that FTP is running, but you should be asking who is the vendor and what is the version.
   • 

    

4. View Basic NMAP Scan Connection (On Damn Vulnerable WXP-SP2)
   • Note(FYI):
     1. In my case, a User made a connection from 192.168.2.111, which is the IP Address of my Kali Machine. 
     2. Notice the connects and disconnects within the same second.  Accordingly, this is a pretty good sign that somebody is scanning you.
   • 

    

5. NMAP Version Banner Scan (On Kali 1.0.5)
   • Note(FYI):
     • Replace (192.168.2.106) with your Damn Vulnerable WXP-SP2 Address found in (Section 1, Step 7).
   • Instructions:
     1. nmap -sV --script=banner -p 21 192.168.2.106
     2. The banner displays PCMan's FTP Server 2.0
   • Note(FYI):
     • Arrow #1, use (nmap) to determine the version (-sV) of the service running on a specific port(-p 21) and display the banner (--script=banner) if possible.
     • Arrow #2, Notice how easy NMAP makes it to grab a banner, and through clever covert flag automation, an attacker can easily crawl the internet for vulnerable applications (ie., PCMan 2.0.7).
   • 

    

6. View Banner NMAP Scan Connection (On Damn Vulnerable WXP-SP2)
   • Note(FYI):
     1. Arrow #1, Now the we used NMAP to invoke both version detection (-sV) and banner detection (--script=banner); we see a lot of connects and disconnects.
     2. Arrow #2, Also, notice that NMAP is trying to use the FTP HELP menu to potentially collect some artifacts.
   • 

    

7. Use Telnet (On Kali 1.0.5)
   • Note(FYI):
     • Replace (192.168.2.106) with your Damn Vulnerable WXP-SP2 Address found in (Section 1, Step 7).
   • Instructions:
     1. telnet 192.168.2.106 21
     2. Notice the Banner is display on the screen
     3. Press both the <Ctrl> and Right Bracket(]) keys at the same time.
     4. quit
   • Note(FYI):
     • Arrow #1, Use (telnet) to the IP (192.168.2.106)over port (21) to establish a TCP connection.
     • Arrow #2, Notice that you are also supplied the same banner that NMAP supplies.  Accordingly, this really old fashion technique is almost normal traffic, the attacker is probably not as likely to set off as many alarms.  This is why you should turn off all banners on any service that you are running.
   • 

    

8. Exit PCMan
   • Instructions:
     1. --> (See Picture)
     2. Click the Yes Button
   • 

1. Start PCMan FTP Server (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Right Click on PCMANFTPD2
     2. Click on Open
   • 

    

2. PCMan is Online
   • Note(FYI):
     1. Notice the FTP Server is online.
        • I apologize for the repetitive starting and stopping of the FTP Server.
   • 

    

3. Open fuzzer1.pl with leafpad (On Kali 1.0.5)
   • Instructions:
     1. cd /var/tmp/BUFFER/PCMan
     2. leafpad fuzzer1.pl
   • Note(FYI):
     • Arrow #1, Use (cd) to navigate to the (/var/tmp/BUFFER/PCMan) directory.
     • Arrow #2, Use (leafpad) to open (fuzzer1.pl).  Leafpad is a simple GTK+ based text editor. The user interface is similar to Windows(tm) notepad.
   • 

    

4. Explain fuzzer1.pl (Command Line Arguments) (On Kali 1.0.5)
   • Instructions:
     1. Select Options and Check Word Wrap and Line Numbers.
     2. Scroll Down to Line 17
   • Note(FYI):
     • Arrow #2, The script (fuzzer1.pl) take in three command line arguments: IPADDRESS, PORT and COUNT.
       • Eg., ./fuzzer1.pl 192.168.2.106 21 2020
       • IPADDRESS - Is the IP Address associated with the attack vector.
       • PORT - Is the Port associated with the attack vector server.
       • COUNT - Is the number of character that will be sent to the particular IPADDRESS and PORT.
   • 

    

5. Explain fuzzer1.pl Essential Variables (On Kali 1.0.5)
   • Instructions:
     1. Arrow #1 [Line 37], The ($header) variable is composed of the string (USER) plus a single <SPACE>.  The characters that come after the (USER ) string is the actual username.  (Eg. JOHNDOE  or  AAAA[2200]AAAAs...)
     2. Arrow #2 [Line 42], The ($junk) variable will actually contain the username that will be supplied immediately after the $header.  Ultimately, the $junk variable will used to overflow the USER variable within PCMan.
        • Normal Usage: E.g., USER JOHNDOE
        • Ab-Normal Usage: E.g., USER AAAA[2200]AAAA...
     3. Arrow #3 [Line 46], The ($string) variable contains the Hexademical representation for an A (e.g., x41) multiplied by the OFFSET_COUNT.  In the below example, 2200 A's would be sent to PCMan. 
        • E.g., ./fuzzer1.pl 192.168.2.106 21 2200
     4. Arrow #4 [Line 49], The ($socket) variable is used to create a TCP connection to an $IPADDRESS over a $PORT.
     5. Arrow #5 [Line 53], The function $socket->send($string) is used to send the $string composed of (USER AAAA[2200]AAAA...) to the specified $IPADDRESS and $PORT.
     6. Arrow #6 [Line 57], The function close($socket) will close the TCP connection.
     7. Arrow #7, Click the icon to close leafpad.
   • 

    

6. PCMan Fuzz Test (Part 1) (On Kali 1.0.5)
   • Note(FYI):
     • Replace (192.168.2.106) with your Damn Vulnerable WXP-SP2 Address found in (Section 1, Step 7).
   • Instructions:
     1. cd /var/tmp/BUFFER/PCMan
     2. ./fuzzer1.pl
     3. ./fuzzer1.pl 192.168.2.106 21 10
     4. ./fuzzer1.pl 192.168.2.106 21 100
     5. ./fuzzer1.pl 192.168.2.106 21 1000
   • Note(FYI):
     • Arrow #1, Use (cd) to navigate to the (/var/tmp/BUFFER/PCMan) directory.
     • Arrow #2, Use (fuzzer1.pl) to see which parameters are required for the program to execute as designed.  No buffer overflow will occur for (Arrows #3-#5). 
       • ./fuzzer1.pl <IPADDRESS> <PORT> <FUZZER_COUNT>
       • ./fuzzer1.pl 192.168.2.106 21 10
     • Arrow #3, Use (fuzzer1.pl) to send 10 A's to (192.168.2.106) over port 21.
     • Arrow #4, Use (fuzzer1.pl) to send 100 A's to (192.168.2.106) over port 21.
     • Arrow #5, Use (fuzzer1.pl) to send 1000 A's to (192.168.2.106) over port 21.
   • 

    

7. Review of Initial Fuzzing Test (Part 1) (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Notice that 10's were sent and the User name is okay.
     2. Notice that 100's were sent and the User name is okay.
     3. Notice that 1000's were sent and the User name is okay.
   • Note(FYI):
     • Arrows #1-#3, The goal of fuzzing is to find out the following: (1) at what point will the application fail to work as designed, (2) at what point will the application crash, and (3) at what point will the application allow exploitation to occur.
     • Accordingly, we are not at that point yet.
   • 

    

8. Exit PCMan
   • Instructions:
     1. --> (See Picture)
     2. Click the Yes Button
   • Note(FYI):
     • It is really not necessary to exit PCMan at this point.  The purpose of exiting is to clear the application input and output streams.
   •