This will be target specific (e.g. a service or protocol). Most times you’ll need an opportunity to:
- copy the (larger) final payload
- copy the (smaller) egg hunt code
- trigger the exploit
In a typical stack overflow the second and third steps will likely be combined. Note the egg hunt code needs to land somewhere executable, but the payload doesn’t, if the egg hunt is sufficiently clever.
Imagine a hypothetical program. This could be an implementation of a network protocol (such as HTTP, SMTP, LDAP, etc.) or file parsing code (maybe an image or XML parser).
The process would be something like:
- start a session: open a new connection, or start parsing a stream
- send input that copies bulk data: maybe a first HTTP request, or a few kilobytes of image data
- trigger a vulnerability: perhaps a second pipelined HTTP request or a broken structure in the image format
- egg hunt through all memory regions, then jump to the payload (maybe allocating memory, copying and setting the correct permissions first)
During the process of writing the exploit a lot of time will be spent sending input and understanding where it ends up in memory (and for how long). These skills are directly transferable to other tasks like fuzzing.