How is an egg placed in memory before the egg hunter code executes?

If a payload is too large for the exploit buffer but an egg hunter can find the payload, is the payload also sent in smaller chunks and moved into memory before hand? If the payload is stored and done in stages, how are the memory chunks connected so that the egg hunter can find the full payload later on? I guess each payload chunk could be prefixed with the key.

How would a single payload be stored before hand though, if there isn't enough space for it to begin with?


This will be target specific (e.g. a service or protocol). Most times you’ll need an opportunity to:

  1. copy the (larger) final payload
  2. copy the (smaller) egg hunt code
  3. trigger the exploit

In a typical stack overflow the second and third steps will likely be combined. Note the egg hunt code needs to land somewhere executable, but the payload doesn’t, if the egg hunt is sufficiently clever.

Imagine a hypothetical program. This could be an implementation of a network protocol (such as HTTP, SMTP, LDAP, etc.) or file parsing code (maybe an image or XML parser).

The process would be something like:

  • start a session: open a new connection, or start parsing a stream
  • send input that copies bulk data: maybe a first HTTP request, or a few kilobytes of image data
  • trigger a vulnerability: perhaps a second pipelined HTTP request or a broken structure in the image format
  • egg hunt through all memory regions, then jump to the payload (maybe allocating memory, copying and setting the correct permissions first)

During the process of writing the exploit a lot of time will be spent sending input and understanding where it ends up in memory (and for how long). These skills are directly transferable to other tasks like fuzzing.

| improve this answer | |
  • Thanks. So essentially the egg can be hidden inside data that the application needs to load into memory and then the vulnerability gets exploited with the hunter. Would the egg still execute if the region is marked as non executable? – system Apr 18 '18 at 21:03
  • 1
    If the data lands in a non-executable section the egg hunter would need to allocate new memory, mark it RWX and copy the payload shellcode into it. – David Apr 18 '18 at 21:19

Generally you would need to find something that will get stored to a appropriate variable in the same service to store your egg. The smaller egghunter then finds the egg you previously saved.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.