[Full-disclosure] w32 SEH omelet shellcode stage

[Berend-Jan Wever <berendjanwever@xxxxxxxxx>]

Hey all,

I'm releasing some code for a technique which I call "omelet shellcode" that
may be useful in some exploits. It is similar to egg-hunt shellcode, but
will search user-land address space for multiple smaller eggs and recombine
them into one larger block of shellcode and execute it. This is useful in
situation where you cannot inject a block of sufficient size into a target
process to store your shellcode in one piece, but you can inject multiple
smaller blocks and execute one of them.

More details can be found here:
http://skypher.com/wiki/index.php?title=Shellcode/w32_SEH_omelet_shellcode
http://code.google.com/p/w32-seh-omelet-shellcode/
I have not had a chance to test this newer version in a live exploit, so do
let me know if you have a chance to use it.


Cheers,
SkyLined


Berend-Jan Wever <berendjanwever@xxxxxxxxx>
    .----.   ,       ,             ,
   (      ' /       / . _   _   __/
 ,  `'-._  /_-'/ / / / / ) /_) / /
(        )/` )(_/ / / / / (__ (_/
 `------'    __/ '-------'
               http://skypher.com/SkyLined

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/