In a CTF/exploitation lab, I am aware of two separate machines.
- Developer machine: Windows 7 x64, as blank, as it can get (no KB patch)
- Service machine: UNKNOWN
I have a source code file in C with a basic BoF vulnerability on a specific port and a compiled application of that source code. When I run the binary, I get an error with "missing api-ms-win-crt-runtime-l1-1-0.dll" and also I can not install, add, use that DLL unless I upgrade the developer machine to SP1. Therefore, I created a local VM with a blank Windows 7 x64 with "api-ms-win-crt-runtime-l1-1-0.dll" available. On my VM, I have a fully functional exploit.
On Service machine:
During a fuzzing trail and error procedure, I have identified that I can crush the target application on the same specific port due to a BoF vulnerability. Unfortunately, I can not execute any bind_tcp / reverse_tcp shell, ping back, dns request, nothing...
How can I ensure that I am pointing the EIP to the right address of a JMP ESP (for example) on the Service machine? Can I use addresses from "api-ms-win-crt-runtime-l1-1-0.dll"?