skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-windows-binary-exploitation

Exploits 32-bit Windows stack buffer overflows in network services to achieve remote code execution.

954|172|Updated Mar 13, 2026
Search Tags:#windows#msfvenom#buffer overflow#reverse shell#binary exploitation#eip offset#mona.py
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-windows-binary-exploitation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-windows-binary-exploitation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/binary-exploitation/performing-windows-binary-exploitation
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-windows-binary-exploitation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests and OSCP-style labs, a crashing 32-bit Windows service is only the beginning. This Skill provides the complete methodology to turn a proof-of-concept crash into a working exploit, covering EIP control confirmation, offset discovery, bad-character enumeration, and payload delivery.

Core Features & Use Cases

  • Crash-to-Control Workflow: Reproduce the crash, confirm EIP overwrite with a marker pattern, and compute the exact offset using pattern_create/pattern_offset.
  • Bad-Character and Shellcode-Space Analysis: Enumerate bytes that corrupt payloads in memory and verify contiguous space at ESP for shellcode.
  • Reliable Return Address Selection: Use mona.py to find a JMP ESP gadget in modules without ASLR, SafeSEH, or rebase, then deliver an msfvenom-encoded reverse shell.
  • Use Case: Against SLMail 5.5 POP3, send an oversized PASS argument, confirm EIP control at offset 2606, jump via slmfc.dll at 0x5f4a358f, and catch a reverse shell as the service account.

Quick Start

Use this skill to develop a working exploit for the crashing 32-bit Windows service I found during my authorized assessment, starting from crash reproduction through to a reverse shell.

Frequently Asked Questions about performing-windows-binary-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a Windows stack buffer overflow in a network service?▼

Reproduce the crash with an oversized input, find the EIP offset using pattern_create and pattern_offset, enumerate bad characters, then overwrite EIP with a JMP ESP address from a non-ASLR module and append a NOP sled plus msfvenom shellcode.

How to find the EIP offset with pattern_create and pattern_offset?▼

Generate a cyclic pattern with pattern_create.rb -l <size>, send it to crash the service, and read the EIP value in the debugger. Feed that value to pattern_offset.rb -q <eip> to get the exact byte offset, then confirm with 'A'*offset + 'BBBB' so EIP equals 0x42424242.

What are bad characters in exploit development?▼

Bad characters are bytes like 0x00, 0x0A, and 0x0D that the target's input handler truncates or corrupts, breaking shellcode in memory. Enumerate them by sending bytes 0x01 through 0xFF after EIP and diffing the in-memory block against what was sent.

Why does my exploit work in the debugger but the shell never connects?▼

Encoded payloads like shikata_ga_nai decode on the stack and can overwrite their own first bytes. Prepend a NOP sled of 8 to 16 bytes between the return address and shellcode, and verify the JMP ESP address itself contains no bad characters.

How do I choose a reliable JMP ESP address with mona.py?▼

Run !mona modules to list loaded modules and pick one with Rebase, ASLR, SafeSEH, and NXCompat all set to False. Then use !mona find -s "\xff\xe4" -m <module> to locate a JMP ESP gadget whose address contains no bad characters.

When is this buffer overflow technique not applicable?▼

This method targets 32-bit Windows binaries without modern mitigations. It does not apply when ASLR, DEP/NX, or SafeSEH are enabled, or on 64-bit targets, which require different techniques such as ROP chains and information leaks.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

proto-rdp

Audit RDP services for NLA, TLS, and known vulnerabilities.

Community
Advanced
TencentTencent
6.1k

unexpected-code-execution-detection

Detect command injection, eval/exec abuse, and remote code loading in AI agents.

Official
Intermediate
yaklangyaklang
2.0k

crlf-injection

Detects and exploits CRLF injection in HTTP response headers, redirects, cookies, and logs.

Official
Intermediate
alicangnllalicangnll

ROP Chain Builder

Automate ROP chain construction to bypass DEP/NX protections.

Community
Advanced