Metasploit Revealed: Secrets of the Expert Pentester

Building the exploit base

Now that we have familiarized ourselves with the basics, let's see what essentials we need to build a working exploit for SEH-based vulnerabilities:

Component	Use
Offset	In this module, offset will refer to the exact size of input that is good enough to overwrite the address of the catch block.
POP/POP/RET address	In order to redirect execution to the short jump instruction, an address for a POP/POP/RET sequence is required. However, most modern operating systems implement DLL compiling with SafeSEH mechanism. This instruction works best from the SafeSEH free DLL modules.
Short jump instruction	In order to move to the start of shellcode, we will need to make a short jump of a specified number of bytes. Hence, ...