Reference no: EM132266934

Question 1. Analyze the malware found in the file Lab09-01.exe using OllyDbg and IDA-Pro to answer the following questions.
a. How can you get this malware to install itself?
b. What are the command-line options for this program? What is the password requirement?
c. How can you use OllyDbg to permanently patch this malware, so that it doesn't require the special command-line password?
d. What are the host-based indicators of this malware?
e. What are the different actions this malware can be instructed to take via the network?
f. 6. Are there any useful network-based signatures for this malware?

Question 2. Analyze the malware found in the file Lab09-02.exe using OllyDbg to answer the following questions.
a. What strings do you see statically in the binary?
b. What happens when you run this binary?
c. How can you get this sample to run its malicious payload?
d. What is happening at 0x00401133?
e. What arguments are being passed to subroutine 0x00401089?
f. What domain name does this malware use?
g. What encoding routine is being used to obfuscate the domain name?
h. What is the significance of the CreateProcessAcall at 0x0040106E?

Question 3. Given vulnerableserver.exe, use Windows 10, Windbg, and Kali Linux to write an exploit string. Your final deliverable should be:
a. A screen shot of the corrupted stack

b. A screenshot of your exploit (from Kali Linux)

Specifics:
1) Please leave your EIP as a "dummy placeholder" (0x42424242 in my screenshot above) (no need to find the address of JMP ESP (or equivalent))
2) Please set a 0xCC as the first character of your payload
3) You must store your student number as the following digits of the payload. Make sure to mask off any illegal characters.

Attachment:- PROG8300 - Assignment.rar