need help porting exploit to win2k

[security at vahle.de (Thomas Werth)]

Hi Jerome,

thank you very much for that hint. In user32.dll i found a nice jmp esp.
Although thank you for information about reason of stackadjustment .

Thomas

Jerome Athias schrieb:
> hi Thomas,
>
> you should try to search in USER32.DLL ;-)
>
> https://www.securinfos.info/international-opcodes/OPcodes_LIST_Windows_2000_Server_SP4_USER32.DLL.html
>
> 0x77DF4C29
> <https://www.securinfos.info/international-opcodes/OPcodes_LIST_Windows_2000_Server_SP4_USER32.DLL.html#>
>
>
> Good luck
> /JA
> SecurInfos.info
>
> Thomas Werth a ?crit :
> > Dear List,
> >
> > i'm trying to port a test exploit towards win2k sp4 german.
> > I'm looking for a jmp esp. I didn't find one in msf web opcode.
> > So i used msfpescan like this msfpescan -j esp /mnt/hgfs/ntdll.dll and
> > got :
> > [/mnt/hgfs/ntdll.dll]
> > 0x778b5a22 push esp; ret
> > [/mnt/hgfs/KERNEL32.DLL]
> > 0x77ea5570 push esp; retn 0xfffd
> > [/mnt/hgfs/ws2_32.dll]
> > 0x74fa1dce push esp; ret
> >
> > When using this as retVal exploit fails and target app crashes.
> > Am i doing something wrong ?
> >
> > thx
> > Thomas
> >
> >
> >