Once the stack is properly overwritten you will see that ESP (stack pointer) has the address where the payload (reverse shell) starts.
As this address changes after each reboot, it cannot be used in the exploit code. Since the address is stored in ESP, all we need to do is find a JMP ESP or PUSH ESP in order for the program logic to jump to our shell code.
Using Mona within Immunity debugger:
First search for all DLL's that are used by the program, this can be done by typing:
This should give a list with DLL's. Now carefully search for a DLL where DEP and ASLR is not enabled. Additionally, make sure the address does not contain any bad character such as null bytes, carriage return and line breaks.
Once that is found, double click the DLL and search for the commands:
In case no results are found, click "C" in the menu bar and search for the opcode "\xFF\xE4" (this is JMP ESP) by typing:
!mona find -s “\xFF\xE4" -m [dll file]
If the PUSH ESP is found, this memory location should be used in order to jump to the shell code.
So what you see in those exploits are memory locations where JMP ESP is performed.