To create a Windows-specific exploit, we must identify the right offset, that of the EIP. This can be extracted by exploit tools such as patter_offset, which takes the input of the EIP with the same length that was used to create the pattern:
root@kali:/usr/share/metasploit-framework/tools/exploit# ./pattern_offset.rb -q 0x6F43376F -l 4000 [*] Exact match at offset 2002
This means an offset match was found in the created pattern with the EIP. Now we know that buffer 2002 is enough to crash the server and we can begin the overflow.
The next step is to find which EIP register stores the opcodes for the assembly JMP ESP. In the immunity debugger, view the executable modules and select essfunc.dll, as shown ...
