Exploitation objective: Exploit the Buffer Overflow vulnerability to carry out DoS on the target.

Experiment Deployment

• B1: On the victim machine:

  • Download apache 2.4.38 to the machine.
  • Proceed to configure httpd.conf ( Appendix I ).
  • Create the file test.lua in the htdocs folder ( Appendix I).
  • Before using the attacker machine, we need to turn off the victim machine's firewall.
  • Use cmd to navigate to the directory :
  root@kitploit:~

  **Apache24/bin**  để tiến hành chạy **httpd.exe.**
  

• B2: On the attacker machine:

  • Try to connect to the victim's website ( since in the experiment it is a local network ⇒ connect to the victim machine's IP: 10.6.10.131 ).

  

  • When you can connect, find the location of the Lua file ( in the experiment it will be : 10.6.10.131/test.lua ).

  

  • Send the exploit request to that location and observe the results:

    1. Initial connection reset error:

       • The first part of the log shows ConnectionResetError104

         an issue occurred with the specific error number

         , which means "Connection reset by peer". This usually happens when the remote server ("peer") receives your connection request but then abruptly closes the connection.

    2. The Urllib3 library and the request:

       • The script appears to be using requestsurllib3

         library, thus relying on it

         to create the HTTP connection.

       • The urllib3

         library is trying to open a connection and make a request but fails due to the connection being reset.

    3. Exception handling in the library:

       • Both urllib3requestsurllib3

         are

         catching and re-raising exceptions. The lib

         rary is trying to increase the number of retries for the request, indicating that it may be configured to retry on failure, but eventually gives up after exhausting the retries.

    4. Final connection error in the request:

       • The final exception is raised by requestsConnectionError

         library raises, that is the file

         . This is a generic exception raised when a connection to the server cannot be made, which can happen if the server resets the connection.

• B3: On the victim machine:

  • Check the log:
  • [Wed Nov 29 15:11:58.320403 2023] [mpm_winnt:notice] [pid 6224:tid 732] AH00428: Parent: child process 7220 exited with status 3221225477 -- Restarting.
  • Child process 7220 exited with error code 3221225477. This may be an error caused by invalid memory access or a similar error. Apache then attempts to restart the process.

  

  • Check the service:
    • The error details state that the failing application name is httpd.exe, which is the executable file of the Apache HTTP server. The failing module name is MSVCR110.dll11.0.51106.1 The exception code is 0xc0000005, which usually indicates an access violation error. This means the program tried to read or write to a memory location it should not have, which is a common cause of application crashes.

  

Appendix I

• Configure httpd.conf :

  • Edit the path

    

  • Launch the Lua module

    

  • Add Handler for the Lua module

    

• Content of test.lua and path: