CSI3508: Ethical Hacking & Defence - Exploit Development Workshop 6

This report focuses on exploit development within the context of ethical hacking and defense, specifically addressing Workshop 6 of the CSI3508 course. It covers setting up virtual machines in host-only mode, using Network Address Translation (NAT) for IP address security, and employing the Immunity debugger for code analysis. The report details how to run programs with the debugger, interpret CPU instructions, registers, stack, and memory dumps. It explains the process of identifying denial-of-service attacks using machine learning systems and weaponizing vulnerabilities by determining hardware and software resources, assessing asset values, identifying security vulnerabilities, and mitigating risks. The report also discusses determining the offset of EIP, redirecting execution flow through a JMP ESP address, developing shellcode, and exploiting vulnerabilities to gain control or access data. The process involves using tools like pattern_create.rb and pattern_offset.rb in Kali Linux, and emphasizes the importance of a comprehensive incident response process.

CSI3508 – Ethical Hacking and Defence
|

Workshop 6: Exploit Development
Setting both virtual machine to host only. Due to various working system conditions can exist at
the same time on a comparative machine, disconnected from each other; Virtual machine offers a
direction set designing that differs from certified PC. This ensures straightforward help,
application provisioning, openness and invaluable (Caldwell, 2011) i.
Host PC just enables the VMS to just speak with one another through fundamental host machine.
They can't reach outside systems which is useful for sending noxious payloads through a system.
Network Address Translation is referred for IP address security. It gives a private IP organizes
which uses IP which is not registered and delivers to associate with the Internet (Engebretson, P.
(2013) ii. NAT works on a switch, for the most part associating two systems together, and
deciphers the private locations in the inward system into lawful locations, previously parcels are
sent to another system.
The Immunity debugger is a twofold code examination apparatus created by immunity inc. It’s in
view of well-known Olly debugger, however it empowers utilization of contents to automatize
dull employments. At the point when the program is kept running with the invulnerability it
begins in a delayed state (Jamil & Khan, 2011)iii. Pressing the F9 runs the program. The CPU is
broken into four screens delineating the accompanying directions: The CPU Instructions which
shows the memory address and gathering guidelines, extra remarks, work names and other data
identified with the CPU directions, the Registers which are in charge of showing the substance of
the universally useful registers, guidance pointer, and banners related with the present condition
of the application. The Stack which just demonstrates the substance of the present stack and the
Memory Dump which demonstrates the substance of the application's memory (Harper et al.,
2011) iv.
Running the order python attack.py IP_ADDRESS 1337 enable the PC to distinguish dissents of
administration assault utilizing machine learning system. The area of the log records must be
given with a specific end goal to run the program.
Weaponising the Vulnerability is done to: decide the equipment and software resources in any
condition, decide the quantifiable estimation of these benefits, recognize the security
vulnerabilities affecting the advantages, decide a quantifiable danger or hazard score for every

helplessness, and to relieve the most noteworthy hazard vulnerabilities from the most important
resources.
Running ./pattern_create.rb - l 5000 | nc IP_ADDRESS 1337 inside Kali, where IP_ADDRESS
is the IP address of the Windows VM prompts the ISO which is the general occurrence reaction
process which incorporates discovery, regulation, examination, remediation and recuperation,
recorded in particular systems it keeps up.
Running "./pattern_offset.rb - l 5000 - q 37694136" – this is done inside Kali to decide the
counterbalance of EIP. Toward the finish of that exertion we found that we could overwrite EIP,
making ESP the main enlist indicating a memory area under our control. We can simply ahead
and modify our support to affirm that the execution stream is redirectable through a JMP ESP
address as a ret.
While deciding the location for code which will bounce to ESP, it guides straightforwardly
toward the beginning of the payload (after execution of the ret in the capacity you're assaulting)
in light of the fact that you put the payload directly after the 4 bytes that overwrite the arrival
address on the stack.
Developing the shellcode
The shellcode is a system installed in the Kali Linux platform that allows one to give instructions
to be performed by the system. At this point a kali terminal widow is opened, the shell system is
started which brings a link to give instructions (Saleem, 2009) v. This link is referred to as the
order line interface. Now the instructions are given where shell executes them and the yield is
shown on the screen.
Exploitation
Exploitation is one territory that sets an infiltration test separated from a helplessness appraisal.
Since vulnerabilities have been discovered, you will really approve and exploit these
vulnerabilities by misusing the framework in the expectation of increasing full control or extra
data and perceivability into the focused on arrange and the frameworks in that.

References
Caldwell, T. (2011). Ethical hackers: putting on the white hat. Network Security, 2011(7), 10-13.
Engebretson, P. (2013). The basics of hacking and penetration testing: ethical hacking and
penetration testing made easy. Elsevier.
Harper, A., Harris, S., Ness, J., Eagle, C., Lenkey, G., & Williams, T. (2011). Gray hat hacking
the ethical hackers handbook. McGraw-Hill Osborne Media.
Jamil, D. A. N. I. S. H., & Khan, M. N. A. (2011). Is ethical hacking ethical. International
Journal of Engineering Science and Technology (IJEST), ISSN, 0975-5462.
Saleem, S. A. (2009, September). Ethical hacking as a risk management technique.
In Proceedings of the 3rd annual conference on Information security curriculum
development(pp. 201-203). ACM.

i http://jeffh.pbworks.com/w/file/fetch/93696356/Ethical%20Hackers-%20Putting%20on%20the%20white%20hate.pdf
ii http://cfrs.gmu.edu/assets/Fall13/CFRS-767-001%20-%20Penetration%20Testing-Syllabus-Fall2013.pdf
iii http://digitalmediafys.pbworks.com/w/file/fetch/60359759/jamild2011ethicalhacking.pdf
iv https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=6818949
vhttps://s3.amazonaws.com/academia.edu.documents/38739114/Enhancing_Comp_Sniffing_Attack.pdf?
AWSAccessKeyId=AKIAIWOWYYGZ2Y53UL3A&Expires=1537522566&Signature=TgDY6i8ihBPWL4QVdTqP3qAG6i4%3D&re
sponse-content-disposition=inline%3B%20filename%3DEnhancing_the_comprehension_of_network_s.pdf