Advanced-Windows-Exploit-Development-Practice icon indicating copy to clipboard operation
Advanced-Windows-Exploit-Development-Practice copied to clipboard

ASLR Evasion, Egghunters, SEH Overwrites

Exploits done:

Easy file sharing SEH OverWrite - windows 7
Vulnserver GMON Via SEH + Egghunter - Done (vulnerverseh) - windows vista
Kolibri HTTP Server - Windows 7 - Egghunter
Xitami HTTP Server - Windows Vista - Egghunter
HP NNM Egghunter


Ignore comments below here:
#Yahoo Player v1.0

Winamp-5.12-Playlist-UNC-Path-Computer-Name-Overflow-Remote-Code-Execution-Exploit

Egg Hunter Exploit

In python not perl :P

to run:


python actualfinalexploit.py

this then generates a poc.pls file
transfer this onto the target machine and open it using winamp 5.12,
blam you now have a bind shell on the target


you may need to swap out the first part of shellcode