Jump back to shellcode Windows overflow

From: <chaboyd77(at)yahoo.com>
Date: Mon Apr 21 2003 - 23:50:17 EDT

('binary' encoding is not supported, stored as-is)

I'm practicing developing Windows Buffer Overflows and have run into a slight snag. When I overwrite EIP with the address of "jmp ESP" I land below my shellcode instead of where the top of the stack used to be:

<-----------400 bytes-------->
[NOP's........Shellcode...EIP..*<-code jumps here**]

This didn't seem right but I figured that I'd use an offset from ESP to hop back to my shellcode.

xor         eax,eax	
	xor		ebp,ebp
	mov		ebp,esp
	mov		eax,ebp - 190H
        jump            eax

What I'm trying is loading esp into ebp and then moving that value into eax followed by a jump eax. Tried straight from esp to eax but figured out that wasn't allowed. I know that the .printer exploit(jill.c) does something similar (uses eax and ebx to make the jump). Any ideas? Thanks,
Dave Received on Tue Apr 22 13:27:40 2003