No room for shellcode

[patrick at aushack.com (Patrick Webster)]

Yeah try adjusting ESP first...

Otherwise you can use either the existing jmp esp return address to hit your
nops, but instead swap the nops for a jump backwards to the start of the
'A's (5 bytes), or use the EggHunter payload (about 32 bytes) which will
search the process space for the payload & execute it...

As a reference, I used this for the Ximati http server module due to similar
space issues.

-Patrick
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.metasploit.com/pipermail/framework/attachments/20090503/27f3d87d/attachment.htm>