EZ Server 6 Stack Buffer Overflow Part2

From my post before, we allready done to exploit Ezserver6 using execute command payload type, but how if we want to execute bind shell? is that enough empty space? Now we are gonna discuss it.

 

1. Calculate the space

     Junk space we found only 240 bytes, and as we konow bind shell payload need at least 317 bytes free space. How we solve it? There are method name egghunter. 

2. Generate Bind Shell payload

Before we learn about egghunter, we can generate payload first

Generate it, then copy the codes to fuzzer.

3. Egghunter method 

Documentation about egghunter method u can learn more in this site : Egg Hunter , before we put egghunter code ino our fuzzer we must prepare the

 skenario >> payload=sampah+jmp+alamat+egghunter+padding+ "w00tw00t"  + shellcode;
So our fuzzer will be :

 now the last,...we can try fuzzing on Ezserver again.

Alhamdulillah....we succeed....