Metasploit Revealed: Secrets of the Expert Pentester

Using msfbinscan

We saw in the previous section that we found the DLL modules associated with the vulnerable application. Either we can use Immunity Debugger to find the address of JMP ESP instructions, which is a lengthy and time-consuming process, or we can simply use msfbinscan to search the addresses for JMP ESP instruction from a DLL file, which is a much faster process and eliminates manual search.

Running the help command on msfbinscan gets the following output:

We can perform variety of tasks such as finding the POP-POP-RET instruction addresses for SEH-based buffer overflows, displaying the code at a particular address and much more ...