8

I am learning exploit development on Windows and I have a problem with it, when I analyze the registers ESP and EIP.
I am able to overwrite both ESP and EIP.
The problem is that I can not make use of "mona.py". "Mona.py" keeps showing me that there are no pointers and any os dlls whereas that is not true.
Immunity Debugger is working completely fine.
I need "mona.py" to find pointers to ESP, but it says there is none.

Comments
  • 2
    Please don't mind me just inserting a tactical pin real quick 📍
  • 3
    Me too. Just gonna stick in my huge pin: -<=========[:::::]
  • 3
    I found a workaround for this.
    Type this "!mona config -set workingfolder c:\logs\%p" into the console of the Immunity Debugger program.
    This will create a new directory at c: called logs and add a new folder inside of "log" with the process's name, when you use "mona.py" again.

    I can finally see the pointers pointing to ESP!
  • 0
    That "workaround" did not work. It was an illusion. :/
    "mona.py" was correct. It did not find any pointers pointing to ESP with SafeSEH and ASLR set to False and with no bad characters.
    It finds pointers to ESP, but the problem is that they do not obey "mona.py"'s rules.
    These pointers become unreusable.

    ASLR is a windows os security mechanism which I need to disable myself to keep working on the exploit.
    Note to myself: Do a research on "DEP".
Add Comment