hello I am with an exercise of a holding and I have control of EIP and ESP with a CALL ESP now the problem is that I have 42 bytes to put a shell code, so far I could only add an egghunter but I do not know where to put the shellcode in the memory.
To make it a bit clearer, this problem corresponds to a server that allows a port to listen to the connection and then has 5 commands, one of which is vulnerable.
As I mentioned earlier, it produced an explosion with the egghunter but I do not know where to put the Shellcode, I try to send the shellcode with another command and then execute the overflow, but it does not work for me.
I did another exploit for that which programmed a small shellcode that calls a system(cmd.exe / k dir) and can execute the limited command and I do not know if it can perform a shellcode.
I do not know if you're doing something wrong, please, if someone can help me, I'd really appreciate it.