Mastering Metasploit - Third Edition

Building the exploit base

Now that we have familiarized ourselves with the basics, let's see what essentials we need to develop a working exploit for SEH-based vulnerabilities:

Component	Use
Offset	In this module, the offset will refer to the exact size of input that is good enough to overwrite the address of the catch block.
POP/POP/RET address	This is the address of a POP-POP-RET sequence from the DLL.
Short jump instruction	To move to the start of shellcode, we will need to make a short jump of a specified number of bytes. Hence, a short jump instruction will be required.

 

We already know that we require a payload, a set of bad characters to prevent, space considerations, and so on.