Metasploit mailing list archives

Using encoded payload in executable

From: mmiller at hick.org (mmiller at hick.org)
Date: Thu, 7 Jun 2007 13:57:06 -0700

On Thu, Jun 07, 2007 at 10:43:17AM +0200, C0r3 1mp4ct wrote:

Hi List!

I tried to use the output of "./msfpayload -e windows/x86/exec CMD=cmd
EXITFUNC=process R | ./msfencode -e x86/avoid_utf8_tolower c" in a C
program that executes it by simply transferring the control to the
string buffer containing the encoded payload. The payload is generated
on Fedora Core 6.


The avoid_utf8_tolower encoder may require some additional parameters in
order for it to be used correctly.  This specific encoder does not have
a getpc stub, and therefore relies on a certain register holding the
address of the encoded payload (including the decoder stub).  The
decoder stub is hardcoded to assume that ecx will hold the address.

Does your vulnerability require you to use this specific encoder?

Current thread:

Using encoded payload in executable C0r3 1mp4ct (Jun 07)
- Using encoded payload in executable mmiller at hick.org (Jun 07)
  - Using encoded payload in executable C0r3 1mp4ct (Jun 07)
    - Using encoded payload in executable mmiller at hick.org (Jun 07)
    - Using encoded payload in executable C0r3 1mp4ct (Jun 11)