Metasploit Revealed: Secrets of the Expert Pentester

Using msfbinscan

We can easily find the POP/POP/RET instruction sequence with msfbinscan using the -p switch. Let's use if on the ImageLoad.dll file as follows:

Let's use a safe address, eliminating any address that can cause issues with the HTTP protocol, such as repetition of zeros consecutively, as follows:

We will use 0x10019798 as the POP/POP/RET address. We now have two important components for writing the exploit, which are the offset and the address to be loaded into the catch block, which is the address of our POP/POP/RET instruction. ...