From SEH Overwrite with Egg Hunter to Get a Shell

Introduction The Windows operating system has a default "handler" that catches any exception that is not handled by the program. When Windows handles an exception in an application, you will usually see the message: "program has encountered a problem and needs to close". The SEH works in chain and are localized in end of stack.  In the classic Buffer Overflow (vanilla), the exploit overwrites the return address without worrying about writing more bytes in the stack, but with the SEH Overwrite technique, it is possible to obtain more space for the shellcode, in order to have a more stable exploit. In addition, Egg Hunter is a technique where a small piece of shellcode is used that searches for an actual bigger shellcode the attacker was not able to fit-in the available buffer space. For this, make use of this little piece of shellcode "egg hunter" to redirect execution flow to....