Fuzzy registers – the low-level perspective

The fuzzing research we’ve done so far was effective in discovering the fact that these two FTP programs are vulnerable to overflows. Now, we need to understand what’s happening behind the scenes by watching the stack as we send fuzz payloads. Of course, this will be done with a debugger. Since we’re on Windows in this lab, we’ll fire up WinDbg and attach it to the vulnerable software PID. Since we’ve just finished toying around with the nfsAxe client, I’ll assume that’s still up and ready to go in your lab. Keep your 3Com Daemon lab handy, though, because the principles are the same. Let’s go down the rabbit hole with Metasploit’s offset discovery duo: pattern_create and pattern_offset.

Calculating the EIP offset with the Metasploit toolset

Head on over to the tools directory in Metasploit with cd /usr/share/metasploit-framework/tools/exploit...