Home page logo

metasploit logo Metasploit mailing list archives

A Wee Bit of Help
From: hdm at metasploit.com (H D Moore)
Date: Fri, 16 Mar 2007 15:30:33 -0500

This exception indicates that you control a pointer that is being 
dereferenced and compared with zero. This is not exploitable for anything 
other than a denial of a service. By placing a valid value into the EAX 
register, you prevent the process from crashing, but you have no control 
over execution. There may be another way to trigger code execution, but 
changing the value of EAX to be a valid address is probably not it.

Something you might want to try is making EAX point to DWORD with the 
value 0 (ie. 4 NULL bytes). This may change the logic of the application 
and continue on to an exploitable exception.

On Friday 16 March 2007 16:06, J. M. Seitz wrote:
Now, what I have done is starting at the specified offset where it does
the following: 
77c42a16 803800????????? cmp???? byte ptr [eax],0??????????
ds:0023:90909090=?? I fill that space with the address of where my
shellcode is. When I run my "crapsploit" against it, the target process
doesn't die anymore and I don't get "calc.exe" popping up. 
What am I doing wrong here? If?I make that return address where my
shellcode is a bunch of "A"s then again the process crashes with the
same error as before.?By the process not dying does it mean that it's
running my shellcode, but not successfully? 

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]