EH-Net

I wanted to find jmp address of several machines however as we all know that opcode database is down , I need to do it manually .

One way is by using EEREAP from Eye Digital security , but they arnt good at Microsoft addresses .

Second way could be by using msfpescan -f ......

Third way where I can get old exploits and copy and paste their jmp addresses.


Now coming back to the second way , which attracts me the most , I would say that msf requires a DLL for that purpose . In one case I can copy and paste a kernal32.dll or user32.dll from a windows xp sp2 eng. box to it and then take out its jmp addresses. but if the case is not the same and the victim machine has to be a french version or a german version , or its xp sp1 , it wont be easy to get a dll . the only option which comes to my mind is that I will have to install a simillar operating system in my vmware and then get the dll and then get the jmp register . this sounds prety crazy . If there is a Linux victim and then I would need those DLLs . Is there a way where I can get a bunch of DLLs ( i mean from a website or so ) .


Is there someother way to find out the jmp esp/eax etc values of different operating systems ??

I can't guarantee anything, but take a look at the MS08_067_NETAPI exploit in Metasploit ;)

Also, take a look at the other exploits in Metasploit. There is usually opcodes for most operating systems included in the exploits, so if it was me then I'd take one of them and try to use it.

There was another site which had a huge database too, but that's unfortunately down as well.  :(
(Dead reference: http://www.securityfocus.com/archive/82/445612/2010-08-29/1 )

I did try to find cached examples of that opcode list he had, but I couldn't find any.

If you ask him nice, and if you can find him, then "Jerome Athias" is the guy you need to look for about that opcode database I'm referring to. Good luck!  :)

There are couple of sites providing DLL for free if you google up . I did downloaded them and put it in msf directory and did a msfpescan -f but it shows nothing , smillar is the case when i copied the same dll from my windows xp vm and it gave no result . I think there could be a problem with msf and bt3 vm image . I will download bt vm4 and update what happens next on that ...


can you try the msfpescan -f command and let me know whats ur results