In this video I show how to recreate the popular SLMail exploit from scratch!
This video is the first part of a mini-series, so within the next couple of days the next video should be ready and published.
Vulnerable Software: https://www.exploit-db.com/apps/12f1ab027e5374587e7e998c00682c5d-SLMail55_4433.exe (This software is intentionally vulnerable and should only be installed inside a virtual machine. In order to recreate the exploit as shown in this video, you will need to use a 32-bit Windows 7 installation. Windows Vista or XP may work as well.)
Windows 7 Virtual Machine: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/
Kali Linux: https://kali.org (https://www.offensive-security.com/kali-linux-vm-vmware-virtualbox-image-download/)
VMware: https://www.vmware.com/dk/products/workstation-player/workstation-player-evaluation.html (You may be able to use VirtualBox as well.)
Immunity Debugger: https://www.immunityinc.com/products/debugger/
Mona: https://github.com/corelan/mona (https://github.com/corelan/mona/archive/master.zip)
Python: https://www.python.org/downloads/release/python-2717/ (https://www.python.org/ftp/python/2.7.17/python-2.7.17.msi)
Background real space image: https://hubblesite.org/image/3862
– Installation of tools inside the Windows 7 virtual machine
– Adding a network interface to the virtual machine
– Kali Linux Undercover Mode
– Python POC Basics (Explaining the Proof Of Concept)
– Verifying that our SLMail service is running
– Changing the appearance (i.e. font size) of Immunity Debugger
– Overflowing the Extended Instruction Pointer (EIP)
– Sending a controlled crash string to modify EIP
– Searching memory for “opcodes” in loaded modules such as DLLs (Multiple ways)
– Little Endian encoding of EIP
The remaining topics such as finding bad characters, generating shellcode, reconfiguring the windows firewall, etc., will be covered in the following video.
Stay tuned and subscribe for more upcoming videos showing actual hacks!