Controlling the EIP
To take control of the EIP, we first need to locate the EIP’s exact position in the buffer of 600. To do this we will make use of a tool called “msf-pattern_create”.
Creating Pattern
Update POC
After creating the pattern, modify the code from the previous iteration (Crasher.py) to send the newly generated pattern as the buffer instead.
controllingEip.py
Controlling Eip
EIP = 41397241
Further inspecting the registers, as shown above, reveals that our EIP now has a unique value instead of the 4 bytes of “\x41” OR “A” we saw in the previous iteration.
Locating EIP
Now that we have sent in our custom pattern and extracted the value @ EIP, we have to figure out where that is in the buffer. The tool ”msf-pattern_offset” will help us with that.
EIP Was found at 537 Bytes
controlledEip.py
Now let's verify that by further modifying our initial code, we are able to write 4 B
s OR 4 bytes of \x42
into the EIP.
Controlled Eip
After running the new exploit code, we are able to see that we have successfully over-written the EIP with \x42\x42\x42\x42
. Now we have gained control of the EIP and are ready to move on to the next step.
Last updated