Full Disclosure mailing list archives
w32 SEH omelet shellcode stage
From: Berend-Jan Wever <berendjanwever () gmail com>
Date: Mon, 16 Mar 2009 19:30:17 +0100
Hey all, I'm releasing some code for a technique which I call "omelet shellcode" that may be useful in some exploits. It is similar to egg-hunt shellcode, but will search user-land address space for multiple smaller eggs and recombine them into one larger block of shellcode and execute it. This is useful in situation where you cannot inject a block of sufficient size into a target process to store your shellcode in one piece, but you can inject multiple smaller blocks and execute one of them. More details can be found here: http://skypher.com/wiki/index.php?title=Shellcode/w32_SEH_omelet_shellcode http://code.google.com/p/w32-seh-omelet-shellcode/ I have not had a chance to test this newer version in a live exploit, so do let me know if you have a chance to use it. Cheers, SkyLined Berend-Jan Wever <berendjanwever () gmail com> .----. , , , ( ' / / . _ _ __/ , `'-._ /_-'/ / / / / ) /_) / / ( )/` )(_/ / / / / (__ (_/ `------' __/ '-------' http://skypher.com/SkyLined
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- w32 SEH omelet shellcode stage Berend-Jan Wever (Mar 16)