In our course in university, we recently moved on from standard buffer-overflows to SEH based ones.
My exploit is already ready and working thanks to some nice tutorials, although I am still not sure I completely understand, when and why we need the SEH buffer-overflow.
My understanding so far is that, if there are no explicit exception handlers in the source code, every thread will get an automatic one, specific handlers will be there additionally.
For programs, which are vulnerable to SEH BOF a buffer-overflow will cause the e.g. Immunity debugger to pause the program at an exception. Only after the exception is passed to the program the
EIP register is overwritten with the malicious buffer.
Why does this not happen for every program then since there should be an automatic exception handler in any case?
After passing the exception
ESP are overwritten, with values from my buffer, yet other registers are zeroed out (
EDI in my example). So I can control
ESP, but the tutorials mention that it is useless, due to the zeroed out registers.
However, they never explain why the zeroed out registers are the problem - so here is my second lack of understanding.
What exactly is the deal with the zeroed out registers and why would they break shellcode execution?
Now we also overwrite the NSEH and SEH records and using a pattern can figure out the exact offset to overwrite those. Then comes the magic with referencing some module which has
POP POP RET to get to
ESP + 8.
Plus eventually yet another jump.
Why do I need POP POP RET and the final jump?
I have the exploit working and can hand it in like this, yet it feels very unsatisfactory and pointless without actually understanding what is going on. I only started working with low level stuff recently and still have a lot to learn, so I am very thankful for every help.