
Closed
Posted
Paid on delivery
Context: I’m taking an ethical hacking course on Windows XP (32bit, x86) and trying to perform a classic buffer overflow using 32bit FTP version 25.10.31 as the target client, a fake FTP server written in Python 2 to send the payload, and Immunity Debugger to capture the crash. What is working: • The Python server starts normally on port 21 • 32bit FTP successfully connects to the Python server • The payload of \x41 is sent in the 220, 331 and 230 response fields • At some point the FTP seems to crash (screen goes grey) • Immunity Debugger is configured as JIT debugger • DEP is configured as “essential programs only” • Memory access violation is configured to NOT be ignored in Immunity The problem: Immunity Debugger is not capturing the crash correctly. When the FTP crashes the screen goes grey but Immunity does not pause showing the access violation with the EIP overwritten with 41414141 as it should. What has already been tried: • Opening the FTP through Immunity’s File > Open • Configuring JIT debugging without confirmation • Disabling Windows XP firewall • Unchecking all exceptions in pass to program • Increasing FTP timeout to 999 • Sending payload in multiple fields (220, 331, 230) • Testing payloads of 1200 and 3000 bytes What is needed: Identify why Immunity is not capturing the crash and correctly configure the environment so that when the buffer overflow occurs, Immunity pauses and shows the EIP overwritten with 41414141. Obs.: Python code: #!/usr/bin/python from socket import * print ">>> SCRIPT STARTING <<<" payload = "\x41" * 1200 # Tries to create the socket and bind to port 21 try: s = socket(AF_INET, SOCK_STREAM) [login to view URL](("[login to view URL]", 21)) print ">>> BIND OK <<<" except Exception as e: print ">>> BIND ERROR:", e raw_input("Press Enter to exit...") exit() # Puts the socket to listen for connections try: [login to view URL](1) print ">>> LISTEN OK (port 21) <<<" except Exception as e: print ">>> LISTEN ERROR:", e raw_input("Press Enter to exit...") exit() print "[+] Waiting for FTP client connection..." # Accepts the client connection try: c, addr = [login to view URL]() print "[+] Connection accepted from:", addr[0] except Exception as e: print ">>> ACCEPT ERROR:", e raw_input("Press Enter to exit...") exit() # Sends a normal banner so the client doesn't disconnect early try: [login to view URL]("220 ok\r\n") print "[+] Banner 220 sent (no payload)" except Exception as e: print ">>> ERROR SENDING BANNER:", e # Receives the USER command from the client try: data = [login to view URL](1024) print "[+] Received from client:", [login to view URL]() except Exception as e: print ">>> ERROR RECEIVING USER:", e # Sends payload in the USER response (suspected vulnerable field) try: [login to view URL]("331 " + payload + "\r\n") print "[+] Payload sent in USER response (331)" except Exception as e: print ">>> ERROR SENDING 331:", e # Receives the PASS command from the client try: data = [login to view URL](1024) print "[+] Received from client:", [login to view URL]() except Exception as e: print ">>> ERROR RECEIVING PASS:", e # Sends payload in the PASS response as well try: [login to view URL]("230 " + payload + "\r\n") print "[+] Payload sent in PASS response (230)" except Exception as e: print ">>> ERROR SENDING 230:", e print "[+] Payloads sent - check Immunity Debugger now!" print "[+] If successful, Immunity should pause with Access Violation" raw_input("Press Enter to exit...") [login to view URL]() [login to view URL]() print "[+] Done"
Project ID: 40415894
13 proposals
Remote project
Active 13 days ago
Set your budget and timeframe
Get paid for your work
Outline your proposal
It's free to sign up and bid on jobs
13 freelancers are bidding on average $19 USD for this job

Welcome to professional Python development services! Hi there, I'm Alema, a Python expert programmer who strives for clear code in atmospheric, numerical weather prediction, physics, and all other seminal fields. I'm ready to provide you with high-quality services. I have completed 350+ projects with a 100% Positive Rating. If you are looking for Quality work, look no further. Also, we are a team of professional workers, and we are always available 24/7 to help employers without limitations, and delivery is guaranteed on time. Your faithfully. Eng. Alema Akter
$20 USD in 1 day
3.0
3.0

As an experienced full-stack developer who has devoted years to building and optimizing applications, I am confident in my ability to resolve your challenge. Given that I have a broad understanding of systems and strong coding abilities, I believe I can expertly handle the task. Throughout my career journey, I have demonstrated resilience and determination in solving complex problems, a trait that aligns well with what is demanded in this project. In regard to Python, this is one of my core competencies. With it, I am accomplished at creating server-side applications such as the Python server you've been using for your ethical hacking course. Moreover, I am highly skilled in debugging and addressing software errors and faults - an expertise that intersects well with your need for Immunity debugger configuration. I am truly interested in your project and would appreciate the opportunity to help you get past this hurdle. Having experienced similar scenarios before, I'm confident I can provide you with a successful resolution and make significant improvements to your buffer overflow process. Let's connect.
$20 USD in 7 days
1.1
1.1

I understand the critical importance of successfully capturing the crash in Immunity Debugger for your ethical hacking course. Your detailed outline of the current setup and the challenges faced provides a solid foundation for addressing this issue. I will conduct a thorough analysis of your existing environment and configurations to identify the root cause of the debugger not capturing the access violation as expected. This will involve reviewing the Python server code, Immunity Debugger settings, and any potential system-level configurations that may be affecting the debugging process. With my expertise in Python, debugging, and penetration testing, I will ensure that we configure the environment correctly so that when the buffer overflow occurs, Immunity pauses and displays the EIP overwritten with 41414141. I estimate that I can deliver a solution within 14 days, allowing ample time for testing and revisions to guarantee effectiveness. Let's collaborate to achieve your learning goals and ensure a successful lab experience.
$20 USD in 14 days
0.6
0.6

I can help you complete this 32bit FTP Buffer Overflow Lab by identifying why Immunity Debugger is not capturing the crash and correctly configuring the environment, specifically addressing the issue with the Python script sending a payload of \x41 in the 220, 331, and 230 response fields, to ensure that when the buffer overflow occurs, Immunity pauses and shows the EIP overwritten with 41414141, resulting in a stable and tested solution that meets your requirements.
$10 USD in 7 days
0.2
0.2

Hi there. I’ve recently completed a similar project involving redirecting buffer overflow payloads and debugging crashes with Immunity Debugger on Windows XP 32-bit, and I can deliver your project efficiently to the same standard. You’ve correctly set up the Python server and the FTP connection, but Immunity not pausing on crash often points to attaching debugger after process start or Windows handling crash before debugger intercepts. Ensuring FTP is launched directly from Immunity or attaching it preemptively is crucial. I specialize in debugging buffer overflows and configuring debuggers for effective crash capture on legacy Windows systems. Your brief is clear and well-structured. To optimize debugger capture, how exactly are you initiating the FTP client in relation to Immunity—is it launched from within Immunity or attached afterward? Regards, Riyaaz
$12 USD in 14 days
0.0
0.0

The inability of Immunity Debugger to capture the crash suggests potential misconfigurations in the debugger settings or the environment. Given the steps already tried, it may be beneficial to verify the handling of exceptions in your Python server. Specifically, ensure that the socket errors aren't silently failing, potentially hindering the payload delivery. Additionally, consider refining the JIT debugging settings to ensure that exceptions are appropriately reported and that environment variables related to DEP settings do not interfere with Immunity's operations. I can resolve this within 5 days. Should we do a quick trial task so you can see the quality first-hand?
$17 USD in 3 days
0.0
0.0

When Immunity goes grey and silent instead of pausing on 41414141, it's almost always SEH catching the crash before the debugger sees it, or a JIT registry misconfiguration losing the race. I'll attach via File > Open (not JIT), bypass the SEH chain, confirm the exact EIP offset using pattern_create, and get Immunity pausing cleanly on your access violation. I'll also fix the AeDebug auto-attach registry key so JIT works correctly as a fallback. 7+ years low-level systems experience including x86 memory exploitation and Windows debugging environments. Classic 32-bit stack overflows are well within my wheelhouse. No Freelancer reviews yet, but you'll walk away with a working crash capture and a clear explanation of what was blocking it.
$20 USD in 7 days
0.0
0.0

The Immunity Debugger capture issue on XP usually comes down to socket timing in the Python script or how the exception is being passed after the crash. Getting EIP controlled reliably and the bad chars identified correctly is the part where most people get stuck. I can debug your exact setup and get the lab working. Can start today, and you should have it resolved within 24 hours. The bid reflects what is in the description and may shift slightly once I see the actual script and crash output. Want to jump on a quick call?
$30 USD in 2 days
0.0
0.0

Hi there, This project immediately caught my attention as it aligns perfectly with my experience in network security, reverse engineering, and buffer overflow exploitation in controlled lab environments. I specialize in analyzing memory corruption vulnerabilities such as stack-based buffer overflows, especially in services like FTP where unsafe input handling can lead to control-flow hijacking. I focus on identifying the vulnerable input function, calculating the correct offset, understanding stack layout, and explaining how execution flow is redirected step-by-step in a clear and educational way. On a recent similar lab, I analyzed an FTP buffer overflow scenario using debugging tools (like GDB), identified the exact overwrite point of the return address, and demonstrated how the payload affects execution flow in a controlled and reproducible manner. For your engagement, I will carefully analyze the FTP buffer overflow lab, help you identify the vulnerability behavior, determine the overflow offset, and explain the execution flow clearly so you understand exactly how and why the crash or control redirection happens. I will keep it focused on learning and understanding the mechanism behind the exploit. I am comfortable communicating in Portuguese, English, and Spanish, ensuring smooth collaboration. I look forward to working with you. Best regards, Sostenes Apollo
$10 USD in 1 day
0.0
0.0

Hey, Buffer overflows on 32bit Windows with Immunity Debugger is exactly my area — I work through these in my pentest training regularly. The issue is likely with the SEH chain or the way Immunity is attaching to the process. Can you share the Python server code and a screenshot of what Immunity shows at the crash point? I can debug and fix this quickly. Abdelilah — eJPT v2
$20 USD in 7 days
0.0
0.0

Hi there, I have carefully reviewed your Python script and the environment details you provided. I believe I have identified why Immunity Debugger is not capturing the crash as expected. The Technical Gap: In your script, you are sending the payload within the 331 and 230 response fields. However, in many classic FTP client vulnerabilities (especially for version 25.10.31), the overflow is often triggered during the initial 220 Banner handshake or requires a specific character sequence to overflow the internal buffer of the client. If the application handles the exception internally or if the payload size (1200 bytes) hasn't reached the specific EIP offset, Immunity will not trigger the pause. My Solution Plan: Payload Relocation: I will help you restructure the script to deliver the payload within the initial 220 Banner to hit the buffer before the client processes further commands. Offset Discovery: We will use a unique pattern to find the exact offset for the EIP so you can see the 41414141 overwrite clearly. Debugger Calibration: I will guide you through the advanced exception settings in Immunity (Alt+O configuration) to ensure no internal exception handlers bypass our capture. I have a deep understanding of memory architecture and exploit development. Let’s hop on a chat, fix your script, and get that crash captured perfectly. Best regards, Rauf IŞIK
$20 USD in 2 days
0.0
0.0

Jundiaí, Brazil
Payment method verified
Member since May 3, 2026
$10-30 USD
₹12500-37500 INR
$30-250 USD
£2-5 GBP / hour
$30-250 USD
$30-250 USD
$10-30 USD
$750-1500 USD
₹15000-20000 INR
$250-750 USD
$250-750 CAD
$250-750 USD
₹150000-250000 INR
₹1500-12500 INR
₹12500-37500 INR
min €36 EUR / hour
₹37500-75000 INR
₹1500-4000 INR
₹600-1500 INR
₹1500-12500 INR
₹12500-37500 INR