But now I got the ability to use some Windows server 2019 datacenter licenses, so why not give it a try an deploy a small Windows cluster Ofcourse the hardware of choice are beefed HP T620 Thin Clients.

I was always wondering how retail keys behaved when you enter them in your VMs, turns out you dont.

I never gave it a thought while deploying Volume license keys over VMware infrastructures, but turns out that on Hyper-V your host can license the guest.

Well assume youre ok with this, but you can opt-out if you wish.

Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website.

We also use third-party cookies that help us analyze and understand how you use this website.

These cookies will be stored in your browser only with your consent.

But opting out of some of these cookies may have an effect on your browsing experience.

This category only includes cookies that ensures basic functionalities and security features of the website.

It is mandatory to procure user consent prior to running these cookies on your website.

Thus the first 10 Cs used has to be set to x90 i.e. No operation value. Step 26: The next step would be creating a payload.

This blog will take you through exploiting Brainpan step by step.

Extract the file in a folder.

Vulnerable Windows Vm Code Of The

Nikto nikto -h 192.168.43.205 -p 10000 Step 3: Browse Checking the source code of the given page also doesnt reveal much information.

Ste p 4: Run a Dirbuster scan dirb Step 5: Here is whats seen when connecting to 192.168.43.205:9999 using netcat: nc 192.168.43.205 9999 Step 6: Try entering any password, it shows access denied.

Vulnerable Windows Vm .Exe File Which

Step 7: Browse We can see brainpan.exe file which is a windows executable file.

Step 9: Let us check the file using strings command Strings brainpan.exe.

Let us take a look at the functions executables.

Since the application uses functions like socket, send, bind, recv, listen and accept, we can tell that it is a network server application.

Functions like strcmp, strlen, printf and strcpy is also used.

Strcpy is an important function since it is vulnerable to buffer overflow attack.

Step 10: Install Immunity debugger in windows machine and copy the executable.

Step 11: We can see the service running on port 9999 and the function strcpy vulnerable to buffer overflow attack.

Lets us write a simple attackers script to see if we can crash the application.

Executing the exploit from Kali linux python exploitbrainpan.py.

Step 13: As soon as the payload is sent you notice that the EIP has been overwritten with 41414141 i.e.

AAAA in Immunity Debugger.

Step 14: Thus, EIP has been successfully overwritten with As (ox41).

The next step would be to determine after how many bytes the EIP is being overwritten.

We will be using patterncreate and patteroffset using metasploit framework.

To create a pattern go to usrsharemetasploit-frameworktoolsexploit and type the given command: Step 15: We will take this pattern and replace the 1000 As in our exploit with this entire pattern, so our exploit now looks like: Step 16: Execute the script.

Executing the program we see that the EIP is overwritten with 35724134.

Step 17: Let us check the patternoffset using metasploit framework.

Step 18: The updated attackers code will look like: Step 19: Execute the script.

You will notice that the EIP gets overwritten with 42424242 i.e.

BBBB. Step 20: Now we need to overwrite the EIP with JMP ESP address.So we need to find an instruction like jmp esp, call esp, or push esp; ret.

Go to View Executable Modules and select the file i.e.

SafeSEH and ASLR is set to False.

This memory addresses containing a jmp esp instructions is good to put in EIP and make the flow jump to our Shellcode.

Note: The EIP address is arranged in backward as it is sent to the stack i.e.

Step 24: Let us send the following exploit to the application.

Thus the first 10 Cs used has to be set to x90 i.e.

Step 26: The next step would be creating a payload.