Calculating the EIP offset with the Metasploit toolset

Head on over to the tools directory in Metasploit with cd /usr/share/metasploit-framework/tools. First, let's generate a 4,000-byte payload, as we know that's enough bytes to overwrite critical parts of memory:

# ./pattern_create.rb -l 4000 > /root/fuzz.txt

After a couple of seconds, this new text file will appear in your home directory. If you open it up, you'll see 3,000 bytes of junk. Don't be so fast to judge, though – it's a specially crafted string that the offset finder, pattern_offset.rb, will use to find where our sweet spot lies.

Now, open your fuzzer with Vim again and comment out the lines that take input and set the fuzz variable. Add this line after the comment lines:

Get Hands-On Penetration Testing on Windows now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.