GuidedHacking
patreon
WTF is Egg Hunting Shellcode?
🕑 Added 2023-11-19 17:08:04 +0000 UTCDon't know where your shellcode went? Use an Egg Hunter.
Exploit Development 11 - Using Egghunters For Exploits
Why search for our shellcode in memory when we can let Windows do it for us? Sometimes the offset to the shellcode on the stack might not be consistent across application restarts or exploit attempts. In other scenarios, the shellcode might not end up on the stack at all but on the Heap which is dynamically allocated. In order to be still able to write reliable exploits that find the shellcode every time egghunters can be used to enumerate the memory for it.
Article: https://guidedhacking.com/threads/binary-exploit-development-11-egg-hunter-shellcode.20403/
How Does Egghunting Work?
The overall concept of egghunting is very simple, all you need are two parts: the egghunter and the egg.
The egg is a marker that gets prepended to the shellcode whereas the egghunter is basically a tiny shellcode stage that looks for the egg.
While this might sound easy, there is one big problem: Inaccessible memory
Memory might be inaccessible simply because it is invalid memory (not allocated) or because the egghunter is not allowed to access that memory.
If you would try to access a memory page and read its content without considering this hurdle your egghunter will cause a non-recoverable access violation that will lead to the process crashing.
To solve this problem exploit developers came up with two approaches for creating egghunters:
Using Windows APIs that are able to handle invalid/inaccessible memory
Using a custom Structured Exception Handler that is also able to handle this situation.
Buy Our Courses: https://guidedhacking.com/register/
Donate on Patreon: https://patreon.com/guidedhacking
Follow us on Social Media: https://linktr.ee/guidedhacking
