Buffer overflow Mona modules all show Rebase SafeSEH ASLR True

Question

Almost every beginners (noob friendly) tutorial written for Stack based buffer overflow explains when using mona module to locate a safe reliable memory address for our EIP to JMP to our shellcode should have Rebase, Safe SEH, ASLR disabled.

However in a recent stack based buffer overflow challenge, all the modules mona provided showed they were protected except for the executable itself.

I used a module (DLL) that had those protections shown by mona to JMP to my shellcode and successfully execute my shellcode which really confused me.

If the executable itself is not protected does that mean we can use any DLL to JMP to our shellcode? if not what is the proper way to handle this situation?

Answer 1

Using the protected modules WILL ONLY work during that session however when restarting Windows the Address's of the protected DLL's will change. So this explains why I was able to get a reverse shell during this windows session. If mona output shows DLL modules are protected best to look at the Executable itself.

The solution to this situation is to look for JMP ESP within the EXE itself.