[54C3]

So I was doing this module Stack-Based Buffer Overflows on Windows x86. It is on hackthebox academy website. It was going fine until the chapter "Finding a Return Instruction".

The question in exercise is "Try to search the 'cdextract.exe' binary for 'PUSH ESP;RET' instruction as pattern '54C3'. What is the address of the first result you get?"

I rdp into machine open x32dbg run cdextract.exe and attach process. Then I click ctrl + b (as they said to do) and look for pattern '54C3' firstly I found two addresses none of them worked after that I realized that I did not clicked Entire Block button It returned 3 additional addresses. I submitted all of them one by one as answer, but none of them were correct.
Those are the addresses: 77AEEEA8, 77AF02A2, 77B3DDC1, 77BCD627, 77BCD67F

What am I doing wrong? Should the answer be in diffrent format?

[Raphgui]

So may be before want to do dôme bof windows. Try on linux. U can use ROPGADGET to find some xxx ; ret

[54C3]

So may be before want to do dôme bof windows. Try on linux. U can use ROPGADGET to find some xxx ; ret

Thanks I will try.

[Raphgui]

So may be before want to do dôme bof windows. Try on linux. U can use ROPGADGET to find some xxx ; ret

Thanks I will try.

I mean u also can do a ret2winexec.

[gwenxinhdep456]

My mother is a person I admire most

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.