I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as JMP ESP and CALL ESI - but I don't fully understand. So the problem is as followed:
There is a FTP server which crashes while fuzzing. The exact offset value is 2008 bytes (PCman FTP). I am used to execute a buffer overflow as the first example above: Junk + EIP (JMP ESP) + NOP sled + Shellcode. This has usually been done on a Windows XP. It has always worked - and I get my shell.
However, I found an interesting solution from this exploit: https://www.exploit-db.com/exploits/44596
I tried to execute everything according to the image above: and it worked. I got my reverse shell. This is on a Windows 10 machine. The problem is: How exactly does this work? I've been trying to read about CALL ESI and how it "jumps to the beginning of the stack", but I really don't understand how and why this works. Does my payload get executed and then return the stack "back to normal"?