- A 32-bit Windows OS (Windows 7 or 10 preferred). 64-bit Windows or Wine might work for some challenges.
- Immunity Debugger - for debugging the target application
- Python 2.7 (x86) - required by Immunity and mona.py
- mona.py - useful to find gadgets (like JMP ESP)
- Download the vulnerable version from Exploit DB
- Install it on a 32-bit host.
- Run the client, click on
Options
>Server
>Enable Web Server on Port: 80
- Make sure you can browse to http://target/ and see the web interface. Disable firewall on target if needed.
- Start Immunity Debugger as administrator and attach to the running
syncbrs.exe
process. - Use the POC script from Kali to see the initial buffer overflow. Build a working
windows/shell_reverse_tcp
exploit.
- Download the vulnerable version from Exploit DB
- Extract and run the 32-bit version.
- Make sure you can connect to ftp://target/ (or test that port 21 is open with nmap).
- Start Immunity Debugger and attach to the running
FTPServer.exe
process.- You can also start
FTPServer.exe
directly from Immunity Debugger instead of running and attaching.
- You can also start
- Use the POC script from Kali to see the initial buffer overflow. Build a working
windows/meterpreter/reverse_tcp
exploit.- Note: Use a relocating (ASLR) JMP ESP gadget. No stable gadgets exist in this challenge.