Welcome back to Basic Exploit Development.
And in this section, we're covering egg hunters.
Now, it's important for me to merely mention that this section in topic is not required for the OCP
exam.
The OCP exam only focuses on two topics for buffer overflow attacks, stack smashing and multi-stage
shell code, and also the CROSSFIRE exploit, which is the multi-state shell code exercise that is also
not tested.
If you are concerned about passing the OCP, you should always stick in reverse.
So now 5.5 in the sample, 5.5 section of the class.
Now the only reason why out of this section is because even though egg hunters are a bit of a complicated
topic, I think if not completely certain that you will be able to grasp how to use an egg hunter within
this course as long as you have done what you need to do.
On the other three exploitable applications, this brings our total amount of exploitable applications
to four.
So if you guys are already OCP eighth grade, there actually is a fancy security certified expert egg
hunter actually covered in offensive security, certified expert certifications code cracking in the
perimeter as well as advanced windows.
Exploitation, which would give you the certification offensive security exploitation expert.
So an 800 operates when you're only allowed a limited buffer space that you can't fit any charcoal inside
of.
And it refuses to expand.
We try to float over a larger buffer base.
As long as we have 32 bytes within that buffer, you can drop an hundred inside of that.
And when the egg cutter executes, the CPU will be hijacked and will search for the full shell code
and wherever section of virtual outer space that is located.
So many hundreds work by marking the shell code with a double egg.
So if my egg was woot in, let's be w00t.
And I put what worked in front of my shell code.
Then the egg hunter will be able to locate it by scanning the string and comparing against this register
according to work by scanning virtual address space for bytes at a time, it looks for the condition
of the double egg as the egg hunter hijacks CPU execution and searches for the egg increments appointed
by one each time while comparing the contents of the register.
It uses the scan string command to compare what is located in the string against the egg that was programmed
to find.
Once it locate the correct egg egg marker for a shell code, it will jump to into it and it will skip
the eight bytes, which is the egg, and begin execution of the shell code.
For more information, go to this link right here.
This website has shown a lot of information, including the basic practical functionality of the Hunter.
So as you can see, what it does is it saves the egg and then it compares it against any strings that
you may find, such as the egg it uses to scan strings to validate whether or not it found the egg,
that if it did find the double agent, it would then shock to the register and jump eight bites past
the egg to merely execute the shell code.