Mastering Metasploit - Third Edition

Using msfpescan

We can easily find the POP/POP/RET instruction sequence with msfpescan using the -s switch. Let's use it on the ImageLoad.dll file, as follows:

Let's use a safe address, eliminating any address that can cause issues with the HTTP protocol, such as the consecutive repetition of zeros, as follows:

We will use 0x10019798 as the POP/POP/RET address. We now have two critical components for writing the exploit, which are the offset and the address to be loaded into the catch block, which is the address of our POP/POP/RET instruction. ...