vulnserver - Can't find JMP ESP in ntdll.dll

Question

This tutorial shows how to find a JMP ESP in nttdll.dll

http://sh3llc0d3r.com/vulnserver-trun-command-buffer-overflow-exploit/

3. Find address for EIP

In this step we have to check the registers and the stack. We have to find a way to jump to our buffer to execute our code. ESP points to the beginning of the C part of our buffer. We have to find a JMP ESP or CALL ESP instruction. Do not forget, that the address must not contain bad characters!

Open the executable modules list in OllyDbg (press the E letter on the toolbar). Select a module, for example the ntdll.dll. (Vulnserv would not be a good choice as its address contains zero!)

Press right click on the code and select Search for/All commands. Enter JMP ESP. A couple of possible address is displayed. Select one.

I've followed the steps but couldn't find JMP ESP instruction in nttdll.dll.

Answer 1

There are a few executable modules in your screenshot. In your case, nttdll.dll doesn't has JMP ESP instruction.

The right tool for this is mona.py

mona.py is a tool written in Python and available with Immunity Debugger that helps finding a reliable JMP ESP instruction.

https://www.whitelist1.com/2016/11/xstack-overflow-1-exploiting-slmail.html

To find all addresses with JMP ESP, use !mona jmp -r esp command.

This command will search in the loaded executable modules for a memory address that has JMP ESP.

https://medium.com/@johntroony/a-practical-overview-of-stack-based-buffer-overflow-7572eaaa4982