So when exploiting a Buffer Overflow vulnerability, the attacker needs to not only generate the payload (Let's say to create a binding shell), but also set up the corrupted buffer with the said payload to be sent to the victim's machine. (ie. a tcp echo server that utilizes a vulnerable BoF function call that is running on Windows XP OS). And as part of setting up the buffer, there needs to be certain parameters taken from the victim's machine; such as
- the EIP offset at the moment of the crash
- the memory location of the corrupted EIP (pointing at the payload to be executed).
My Question is:
In a professional pen testing environment how would the pen tester access the above two parameters without having access to the victim's machine? Meaning without having to install a disassembler and debugger inside the victim PC and actually analyze the program in the debugger.
Is there another way to simulate this attack without having access to the victim's machine?