Metasploit mailing list archives

need help porting exploit to win2k

From: security at vahle.de (Thomas Werth)
Date: Wed, 29 Aug 2007 15:01:31 +0200

Dear List,

i'm trying to port a test exploit towards win2k sp4 german.
I'm looking for a jmp esp. I didn't find one in msf web opcode.
So i used msfpescan like this msfpescan -j esp /mnt/hgfs/ntdll.dll and got :
[/mnt/hgfs/ntdll.dll]
0x778b5a22 push esp; ret
[/mnt/hgfs/KERNEL32.DLL]
0x77ea5570 push esp; retn 0xfffd
[/mnt/hgfs/ws2_32.dll]
0x74fa1dce push esp; ret

When using this as retVal exploit fails and target app crashes.
Am i doing something wrong ?

thx
Thomas

Current thread:

Payload Bugs ? Thomas Werth (Aug 28)
- Payload Bugs ? H D Moore (Aug 28)
  - Payload Bugs ? Patrick Webster (Aug 28)
    - Payload Bugs ? Thomas Werth (Aug 28)
    - Payload Bugs ? J. M. Seitz (Aug 28)
    - Payload Bugs ? Thomas Werth (Aug 28)
    - Payload Bugs ? J. M. Seitz (Aug 29)
    - Payload Bugs ? Thomas Werth (Aug 29)
    - Payload Bugs ? Thomas Werth (Aug 29)
    - Payload Bugs ? Jerome Athias (Aug 29)
    - need help porting exploit to win2k Thomas Werth (Aug 29)
    - need help porting exploit to win2k Jerome Athias (Aug 29)
    - need help porting exploit to win2k Thomas Werth (Aug 29)
  - Payload Bugs ? Thomas Werth (Aug 28)