# Metasploit/WritingWindowsExploit

* Metasploit FAQs
Writing a Windows Exploit for the Metasploit Framework

## Abstract

This page explains how to write a Windows Exploit for the Metasploit Framework v3.x. This page doesn't explain how to find vulnerabilities. (For this, please see Fuzzing)

## Overview

The Metasploit Framework helps to write reliable exploits easily and quickly. The Metasploit Framework uses the Ruby language.

## Requirements

Technical skills
* Some skills about the use of the Metasploit Framework.
* Some programming skills (Ruby skills are useful but not fully required)
* Some understanding about the Windows memory management (Heap, Stack, Registers)
Materials
* The Metasploit Framework installed and working
* A Windows platform
* A debugger [1]
* A text editor

## Getting started

In the Metasploit Framework, an exploit is called an "exploit module".
Exploit modules are located by default in:
C:\Program Files\Metasploit\Framework3\home\framework\modules\exploits\ (also check C:\Documents and Settings\<Your User Name>\Application Data\msf3\modules\exploits if you do not find in above path)
Exploit modules are classified by platforms (OSes) and then by types (protocols).

### Editing an exploit module

A good way to understand how an exploit module is written is to first edit one.
We edit this module: C:\Program Files\Metasploit\Framework3\home\framework\modules\exploits\windows\ftp\cesarftp_mkd.rb
#Notes of the author are noted in red.

### Writing an exploit module
#### The target

To understand how to write an exploit module for the Metasploit Framework, we'll write an exploit for an easily exploitable vulnerability in WarFTPD version 1.5 [2].
(Note that the exploit module for this vulnerability already exists in the Metasploit Framework, but we are trying to build our own exploit.)
We download and install WarFTPD in our local Windows machine.
We start WarFTPD Daemon.
We uncheck the "No anonymous logins" checkbox.
We start the FTP server (click on the "Go Online/Offline" button)
Ok, the server is now waiting for us...

#### The vulnerability

The first thing to do is to find information about the vulnerability in question. There are many possible sources for this.
Here's an example:
http://osvdb.org/displayvuln.php?osvdb_id=875&print
We now see that the bug can be triggered by sending a specially crafted request in the USER command.
Often a very long string will trigger this sort of bug, but let's verify that.

#### The PoC

We first reproduce the vulnerability.
For this, we directly use the Metasploit Framework.
We create the file:
C:\Program Files\Metasploit\Framework3\home\framework\modules\exploits\windows\ftp\warftpd.rb
We open this file and write (copy/paste) the following code in it:
The WarFTPD server is running (listening on default port 21/tcp).
We now launch the Metasploit Framework's console.
(Start / Programs / Metasploit3 / MSFConsole)
We can now view our exploit using this command:
show exploits
We now launch our exploit using these commands:
use windows/ftp/warftpd set RHOST 127.0.0.1 set TARGET 0 set PAYLOAD generic/shell_bind_tcp exploit
After few seconds we see the WarFTPD Daemon FTP Server disappearing (crashing).
We have successfully reproduced the bug.

##### Debugging

To see what happens when the server crashes, we use a debugger.
We launch again WarFTPD Daemon and attach our debugger to it.
=> In OllyDbg, we use "File/Attach", choose the WarFTPD process, click Ok and after it has been loaded, we press the F9 key to have it Running.
We launch our exploit again.
We can now look at our debugger.
We see that an access violation is triggered.
EIP is overwritten with our evil string (41414141 is the hexadecimal equivalent for AAAA)

#### Fine tuning
##### Finding space available

We have to find the space available for our shellcode (payload).
The Metasploit Framework includes tools to help us.
First, we shut down our debugger.
We use the pattern_create function to generate a string of non-repeating alpha-numeric text string. We use this function by calling the following script: C:\Program Files\Metasploit\Framework3\msf3\tools\pattern_create.rb
From a DOS command line console, it gives:
We generate a string of 1000 characters and use it in our exploit to trigger the bug again:
In our PoC code, we replace this line:
for:
Then, we save our modified PoC code. We start the War-FTPD FTP server. We run our debugger and attach it to the War-FTPD process. We launch our exploit...
Ok, we can now see this in our debugger:
We see that EIP is now overwritten with the value "32714131".
Then we use patternOffset to know the number of characters to send before hitting EIP. For this, we use the following script: C:\Program Files\Metasploit\Framework3\framework\tools\pattern_offset.rb
From a DOS command line console, it gives:
So, we now provide the parameters found before like this:
The result "485" is displayed. It means that we should have a space of 485 bytes to store our payload.
We add this value in our PoC code: We modify this line:
for:
In this way, when we will load our exploit in the Metasploit Framework (with the "use" command), it will automatically search and display the available payloads with a size lower than 485 (with the "show PAYLOADS" command).

##### Finding a return address

We have now to find a reliable return address.
The best way is to take a return address directly in our target. (in the vulnerable executable itself or in one of the DLLs it uses) It avoids problems with various versions of Windows and Service Packs, locales, hotfixes... It would make our exploit universal. But it is not always so easy.
One way for this is to use the search in memory functionality of OllyDbg.
And, once again, the Metasploit Framework includes tools to help us.
We can use 'msfpescan' to search return addresses for an opcode:
We can also use the MSF Opcodes Database:
http://metasploit.com/users/opcode/msfopcode.cgi
Note that the Metasploit Framework includes a built-in client to use this database:
http://www.metasploit.com/projects/Framework/msf3/msfopcode.html
We can also use another nice tool called eereap from eEye: http://research.eeye.com/html/tools/RT20060801-2.html
We can also find some international return addresses here: https://www.securinfos.info/international-opcodes/index.php

##### Dealing with badchars

We have now to find and prevent badchars.
We should not include terminating null character in our shellcode as it would break out of the execution.
We have already done this with this in our exploit: 'BadChars' => "\x00"
Additionally, a target application will often modify the data received before the application will work with the data.
An example is an application that will change all characters to uppercase.
As this will modify our shellcode, we have to deal with it.
For this, the Metasploit Framework will encode our shellcode to obtain one without any specified badchars.
We just have to specify the list of badchars in our exploit code.
So, to find the badchars, we will send a string containing all the characters of the ASCII table, with both printable and non-printable ones.
The string will look like this:
@ We edit our exploit code and put the above string in it.
Then, having our target application running and our debugger attached to its process; we relaunch our exploit.
Under the debugger, after the access violation is triggered, we right click on the esp register and choose the option "follow in dump".
We will now see our string and check what are the missing or modified characters at the end of the string.
It is our first badchars. (note it)
We remove it in our exploit code, and do it@ again... until we see all the characters sended in our debugger.
Now we write, in the badchars section of our exploit, the characters found as badchars (removed or modified by the application).

## References

[1] Free Windows Debuggers
http://www.ollydbg.de/
http://www.microsoft.com/whdc/devtools/debugging/default.mspx
[2] WarFTPD v1.5 download link https://www.securinfos.info/old_softwares_vulnerable/WarFTP165_vulnerable_USER_BufferOverflow.exe
http://www.milw0rm.com/papers/142
Metasploit Framework v3.0 Developer Documentation:
http://Metasploit.com/projects/Framework/msf3/
Exploit Module Tutorial:
http://Metasploit.com/projects/Framework/documentation.html#exploitTutorial
Vinnie Liu - Writing Exploits III:
http://www.syngress.com/book_catalog/327_SSPC/sample.pdf
http://www.securityforest.com/wiki/index.php/Category:Buffer_Overflows_Education
https://www.securinfos.info/english/security-papers-hacking-whitepapers.php
https://www.securinfos.info/VNSECON2007/VNSECON07-JA-Exploit_development.pdf
Developing My First Exploit - by MaXe (thanks to Jerome Athias)
Video Guide: http://guides.intern0t.net/msf2.php