Bypassing DEP in Metasploit modules
Data Execution Prevention (DEP) is a protection mechanism that marks specific areas of memory as non-executable, causing no execution of shellcode when it comes to exploitation. Therefore, even if we can overwrite the EIP register and point the ESP to the start of the shellcode, we will not be able to execute our payloads. This is because DEP prevents the execution of data in the writable areas of the memory, such as the stack and heap. In this case, we will need to use existing instructions that are in the executable regions to achieve the desired functionality. We can do this by putting all of the executable instructions in such an order that jumping to the shellcode becomes viable.
The technique for bypassing DEP is called Return Oriented Programming (ROP). ROP differs from an ordinary stack overflow, where overwriting the EIP and calling the jump to the shellcode is only required. When DEP is enabled, we cannot do that since the data in the...
