hello I am with an exercise of a holding and I have control of EIP and ESP with a CALL ESP now the problem is that I have 42 bytes to put a shell code, so far I could only add an egghunter but I do not know where to put the shellcode in the memory.

To make it a bit clearer, this problem corresponds to a server that allows a port to listen to the connection and then has 5 commands, one of which is vulnerable.

tests performed:

  • As I mentioned earlier, it produced an explosion with the egghunter but I do not know where to put the Shellcode, I try to send the shellcode with another command and then execute the overflow, but it does not work for me.

  • I did another exploit for that which programmed a small shellcode that calls a system(cmd.exe / k dir) and can execute the limited command and I do not know if it can perform a shellcode.

I do not know if you're doing something wrong, please, if someone can help me, I'd really appreciate it.

  • 1
    what is different here from your previous question? Did you really need to post a near duplicate? – Igor Skochinsky Dec 20 '17 at 10:02
  • 1
    It's better to edit the original question to add details instead of posting it again. read the comments on it too. – Igor Skochinsky Dec 20 '17 at 10:05
  • What are you trying to accomplish? Why are you using egghunter if you can only overflow 42 bytes and you know where it overflows, is 42 byte area predictable and you want to jump another unpredictable area? – de6f Dec 20 '17 at 19:58
  • my problem is similar to this post security.stackexchange.com/questions/126250/… – s1kr10s Dec 20 '17 at 20:59

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.