Vulnerability Development mailing list archives
Re: Re: 3COM TFTPD Overflow: SEH Overwrite
From: lists () skilltube com
Date: Fri, 08 Feb 2008 10:08:40 +0100
Quoting jeremy.junginger () gmail com:
I was asking if ws2_32.dll was compiled with SafeSEH (didn't know about the Olly plugin). Regarding the return address...I already have control of EIP, but can't point it directly to the stack, so I'm searching for a module with a suitable return address (with pop/pop/ret) to help me get back to that buffer. The issue was with the return address I was pointing to, and the fact that it the module was compiled with SafeSEH. Is that enough detail?
Nope, you didn't answer my question regarding the vulnerability you are trying to exploit. If it turns out to be the transporting mode issue, than the best place to look for a working return address is the binary itself. Very reliable and still enough space for the shellcode. regards -S ---------------------------------- SkillTube.com
Current thread:
- Re: 3COM TFTPD Overflow: SEH Overwrite lists (Feb 04)
- <Possible follow-ups>
- Re: 3COM TFTPD Overflow: SEH Overwrite the_insider (Feb 04)
- Re: Re: 3COM TFTPD Overflow: SEH Overwrite jeremy . junginger (Feb 06)
- Re: Re: 3COM TFTPD Overflow: SEH Overwrite lists (Feb 08)