I was writing an exploit for BOF. The server accepts only ASCII payloads. FInally I wnted to jump to my shellcode which is clearly in the stack. But only one module is available without ASLR and DEP which has address starting from 56566577. I got JUMP ESP, suppose in 5757578E, this doesn't work. Becuase the 0x8E outside the scope of ASCII 0x00 to 0x7F. Consider no other register has the shellcode. How can I deal with certain situations?

To create ASCII shellcode I use below:

msfvenom -p windows/shell_bind_tcp -a x86 -f perl --platform windows LHOST= LPORT=8181 -b "\x00" EXITFUNC=seh -e x86/alpha_upper

But this also has character above 0x7F. How can I generate shellcode within 0x00 - 0x7F.

1 Answer 1


Find a different pivot, such as call esp or pop eax; call eax; maybe a blind ret will work. There are several other alternatives to jmp esp, you just have to find one that works for you.

If you control a value in any of the other registers you can usually find a gagdet that will call the registry at an offset f.ex: call [eax+0x16]; and adjust the value in said register to point to jmp esp with the offset applied.

  • Thanks. I think push ESP; RET also will work. I got the tricks.
    – melvinjose
    Dec 14, 2019 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.