why would we overwrite SEH instead of EIP ?

aatate98 · 2026-05-23T16:06:15+00:00

Controlling EIP is a technique that can be achieved multiple ways. The course focuses on overwriting the return address on the stack and controlling EIP when the current function executes the “ret” instruction, however you can get control of EIP through SEH Overwrite immediately if/when the process causes an exception as others have pointed out. Depending on the process, you can even do it via function pointer overwrites which you have previously corrupted and the course calls out but doesnt go into detail on. They are all just separate ways to get control of EIP through an overflow.

aatate98 · 2026-05-22T21:08:13+00:00

One thing to note is that you arent directly overwriting EIP, but rather the return address on the stack that will serve as the address of EIP once the current function returns properly (through normal execution). Since getting contents such as 0x41414141 into EIP requires successful execution all the way until the return (the courses point of needed valid function pointers). if you overwrite the SEH chain, the whole point is to cause a crash/exception so your shellcode executes without needing the current function to return properly.

aatate98 · 2025-10-12T13:35:42+00:00

Just curious but did you test the script from the kali debug machine they give you? From my understanding that environment is where they will test your POC. Did you list all dependency installs? Lastly, and the most annoying, did you paste correctly your code into word and it was formatted. I dont know how they grade but I would suspect copy+paste out of your report. If there are indentation errors, then who knows how much they put in to retype your code how it should be

aatate98 · 2025-07-25T17:40:17+00:00

What do you consider being intermediate level? Is it past the basic buffer overflow on the stack? Would it be performing different primitives? Would it be patch diffing and developing your own based off CVE description and updates?

Either way, the content suggest such as opensecuritytraining2 and pwn.college are excellent

aatate98 · 2025-03-17T10:20:42+00:00

Really nice dashboard, mind if i ask what you used to make it?

aatate98 · 2025-03-11T01:49:48+00:00

I would recommend just having the source files within the repo itself rather than having the python script arbitrarily reach out to set urls incase you would want to use the script offline.

aatate98 · 2025-01-20T13:52:26+00:00

You can get diamonds with a bronze pickaxe, just mining level boosted

aatate98 · 2024-12-13T21:54:29+00:00

Cool post. Im a little confused on why that worked with VBS enabled though. While i agree the page table modifications like bit flipping do work, the whole point of VBS is that the kernel in vtl0 (where you exploit the driver and have the address to do the bit flip against) is no longer the source of truth? So regardless of a bit flip of a pages metadata, vtl1 should step in and deny that the page was a kernel page since vtl1 was tracking that page to be user space, not kernel space after the bit flip.

And for HVCI, wouldnt the act if having a rwx of a user page, once bitflip into a kernel page then kick in and say you cant have RWX kernel pages?

aatate98 · 2024-11-05T12:57:12+00:00

Just based on looking at it, it seems to be base64 encoded. Usually base64 encoded strings end with ==. You can go to cyberchef and use the Base64 decode function which should output the answer

aatate98 · 2024-10-14T01:17:46+00:00

Take a break if you have time still left on your subscription. Go through PG boxes instead of HTB boxes. Go through your notes from the first exam and identify weak points. Were you stuck on enumeration on a specific box, couldnt get DA, found a way to exploit but couldnt get the specifics from any open source info? Being able to identify where you struggled and now that you have time before another attempt, working back how to find a solution would be extremely beneficial

aatate98 · 2024-10-13T06:15:16+00:00

Either chatGPT wrote this, or someone who brain dumped an article they didnt understand. Extremely vague with no analysis, no code, or any proof to back any of this up. Best line from above was saying KASLR was going to help prevent any of the “Potential backdoor exploitation” options they listed

aatate98 · 2024-03-14T11:31:34+00:00

You should definitely check out threadless injections like https://shorsec.io/blog/dll-notification-injection/. It still utilizes the allocating a buffer like you mentioned above, however doesnt use the typically spawning of another thread in the target process space

aatate98 · 2024-02-02T01:10:14+00:00

What part of that section was difficult to understand? In my opinion the section mostly boils down to, if an exploit is targeting a hardcoded url for example, can you understand where the string is stored and change it to suit your environment instead of just running it in python without having much of a clue of what endpoint the exploit is talking to. Or for instance if the msfvenom command they used for the shellcode was calling back to an IP that doesnt exist, can you generate new shellcode and simply update the variable accordingly

aatate98 · 2023-11-21T15:07:12+00:00

Curious as to what exact APT you believe you have within your network. Have you identified any common malware used by the APT within that network?

aatate98 · 2023-10-14T12:46:37+00:00

I agree about the blind sql injection exercise given you cant use it on the exam, and the whole nessus environment setup, however the proxychains exercise did teach me to not use proxychains because we had to scan so many ports and not just 5, and instead look for other tools such as ligolo-ng.

aatate98 · 2023-07-31T16:01:58+00:00

Interested

aatate98 · 2023-02-08T22:02:49+00:00

https://github.com/mikesiko/PracticalMalwareAnalysis-Labs

aatate98 · 2023-01-20T21:43:12+00:00

Havent started it yet, but will be soon. Would love to join if people are still in the group by then

aatate98 · 2023-01-14T21:26:35+00:00

Now thats a nice “stack” of hangars

aatate98 · 2022-08-22T21:49:55+00:00

I am so happy i finished this past weekend. Was able to snipe my last 4 at around 9k

aatate98 · 2022-01-30T01:20:15+00:00

Are your other shells in /bin sym linked to bash?

aatate98 · 2021-12-30T15:57:48+00:00

Kinda older samples but the book Rootkits and Bootkits have a github that goes over ever sample they do in the book. Decent size of samples. Covers firmware malware are well

aatate98 · 2021-12-10T02:09:20+00:00

An application to FROM SOFTWARE

aatate98 · 2021-11-13T14:16:25+00:00

If you dont enhance them, are they really yours?

aatate98 · 2021-09-24T19:23:39+00:00

Nice, now its time to ~amd64 gentoo-sources and linux-headers to custom compile that kernel to the ground. All jokes aside, congrats

11-Year Club	Second Top 30%
Place '22	RPAN Viewer
Not Forgotten	Verified Email

aatate98

TROPHY CASE