Metasploit Revealed: Secrets of the Expert Pentester

Finding the POP/POP/RET address

As discussed previously, we will require the address to the POP/POP/RET instruction to load the address in the next SEH frame record and jump to the payload. We know that we need to load the address from an external DLL file. However, most of the latest operating systems compile their DLL files with SafeSEH protection. Therefore, we will require the address of POP/POP/RET instruction from a DLL module, which is not implemented with the SafeSEH mechanism.

The example application crashes on the following HEAD request, that is, HEAD followed by the junk pattern created by the pattern_create tool, which is followed by HTTP/1.0\r\n\r\n