I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?

# Return Address for Windows 7 32b SP1
ret = '\x25\xDF\xB8\x68'
  • The title of your question is more of a category, am I correct the question is "how do I get a return address?"? – J.A.K. Apr 12 '19 at 17:29
  • sure, of course. – yesii_0691 Apr 12 '19 at 19:37

Once the stack is properly overwritten you will see that ESP (stack pointer) has the address where the payload (reverse shell) starts.

As this address changes after each reboot, it cannot be used in the exploit code. Since the address is stored in ESP, all we need to do is find a JMP ESP or PUSH ESP in order for the program logic to jump to our shell code.

Using Mona within Immunity debugger:

First search for all DLL's that are used by the program, this can be done by typing:

!mona modules

This should give a list with DLL's. Now carefully search for a DLL where DEP and ASLR is not enabled. Additionally, make sure the address does not contain any bad character such as null bytes, carriage return and line breaks.

Once that is found, double click the DLL and search for the commands:




In case no results are found, click "C" in the menu bar and search for the opcode "\xFF\xE4" (this is JMP ESP) by typing:

!mona find -s “\xFF\xE4" -m [dll file]

If the PUSH ESP is found, this memory location should be used in order to jump to the shell code.

So what you see in those exploits are memory locations where JMP ESP is performed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.