Metasploit Revealed: Secrets of the Expert Pentester

Stuffing the space

Let's revise the exploitation diagram and understand where exactly we lie in the exploitation process:

We have successfully completed the second step. However, an important point here is that sometimes it may happen that the shellcode may not always land at at the location in memory pointed to by ESP. In this situation, where there is a gap between the EIP and ESP, we need to fill this space with random padding data or NOPs.

Suppose we send ABCDEF to ESP, but when we analyze it using Immunity Debugger, we get the contents as DEF only. In this case, we have three missing characters. Therefore, we will to pad the payload with ...