As far as the screenshot depicts, I can say that you are on the right track. You have correctly, overwritten the Pointer to NextSEH and SE Handler.
Exception Registration Record Structure
typedef struct _EXCEPTION_REGISTRATION_RECORD
struct _EXCEPTION_REGISTRATION_RECORD *Next;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;
Whenever a new function is called which has exception handling mechanism, the EXCEPTION_REGISTRATION_RECORD is added to the stack. Where *Next is the pointer to the Previous EXCEPTION_REGISTRATION_RECORD and Handler is the function pointer to the Exception handler.
The FS:0 register always points to the first EXCEPTION_REGISTRATION_RECORD. Once the EXCEPTION_REGISTRATION_RECORD is pushed on the stack, the FS:0 register will be set to point to the new EXCEPTION_REGISTRATION_RECORD and Next record will be set to point to the previous value of FS:0 register. This will maintain the link list of the SEH chains.
typedef EXCEPTION_DISPOSITION (*ExceptionHandler) (
IN PEXCEPTION_RECORD ExceptionRecord,
IN ULONG64 EstablisherFrame,
IN OUT PCONTEXT ContextRecord,
IN OUT PDISPATCHER_CONTEXT DispatcherContext
When an exception occurs, System Exception Dispatcher routine kicks in and it's sets up it's own stack frame. The structure of the ExceptionHandler is pushed to the stack.
In SEH overwrite scenario, an attacker is lucky because, System Exception Dispatcher routine places the EstablisherFrame value on the stack at [ESP+8] before this ExceptionHandler function is called.
EstablisherFrame is the pointer to the NextSEH record. An attacker is able to control it by overwriting NextSEH record with arbitrary memory address.
Note: Attacker has not overwritten the EstablisherFrame. However, the attacker has overwritten NextSEH pointer which was there on the stack.
Once, you pass the exception System Exception Dispatcher passes the control to the SE handler and the exception handling code is executed.
- Attacker will overwrite the NextSEH with Backward Jump and the SE Handler with the address of POP/POP/RET sequence.
- Once the exception occurs, the address of NextSEH will be placed on the stack at [ESP+8] due to exception dispatch routine prologue.
- Once the exception is passed, the exception dispatcher routine will pass the control to SE Handler.
- SE Handler will execute the POP/POP/RET sequence and will POP the address of NextSEH in EIP. Hence, gaining code execution.
Please accept my apologies if there are mistakes in the answer, and please help to improve the answer so that it's useful to the community members.