Exploiting egg hunters
Egg hunting is used when there is not enough space in the memory to place our shellcode consecutively. Using this technique, we prefix a unique tag with our shellcode and then the egg hunter will basically search for that tag in the memory and execute the shellcode. The egg hunter contains a set of programming instructions; it is not much different from shellcode. There are multiple egg hunters available. You can learn more about them and how they work with this paper by skape: http://www.hick.org/code/skape/papers/egghunt-shellcode.pdf.
Getting ready
We will try to make an exploit with an egg hunter for the same software we used in the previous recipe. The logic behind the exploitation would be something similar to what is shown in the following diagram:
Our aim is to overwrite the nSEH and then SEH in order to make it jump to the egg hunter shellcode, which, when executed, will find and execute our shellcode in the memory.
How to do it...
Following are the steps that...
