I’ve been trying to figure this out for the past few days with no success. I’m taking the Ethical Hacking 15 YouTube ‘class’ with The Cyber Mentor. When following the steps to exploit Vulnserver all of the steps work as expected except for the last one which does the exploit. It just runs and vulnserver crashes with no exploit taking place.

In Immunity Debugger(run as admin), I put a breakpoint at 625011af which is the address of the JMP ESP in essfunc.dll. I setup a listener with nc. I run my python code to load the payload and do the exploit. What happens is that it pauses at 625011af as expected. I hit F8 and it goes the the first address in ESP. At that point the instruction is a NOP because I loaded 24 NOPs before the payload which I got from msvenom. When creating the payload, I excluded x00. When I hit F8 when the code is at the first NOP in ESP(in my loaded exploit code), it gives the following message: “Access violation when executing [00E9F9CC] – Use Shift+F7/F8/F9 to pass exception to program”. When I hit Shift+F8 I get this message: “Debugging program was unable to process exception”. The program stays on the same instruction as before – 00E9F9CC. I press Shift+F8 again and it says running for a second and then terminates. When it terminates it is at address 77BB89DC(in NTDLL) at a command RETN 14. It terminates with exit code C00000005. The original breakpoint at 625011af is in essfunc.

From the dump of ESP I can clearly see that my payload (preceded by 24 NOPs) is loaded starting at 00E9F9CC. I turned off my firewalls and real time protection. The only strange thing is that I was not able to attached vulnserver to Immunity. I did a file open and selected vulnserver to make it work. I’m always running everything as administrator. I have Windows 11 Home which is where I am running my vulnserver/immunity. The python exploit code is running on a Kali VM. I’ve tried it with the CALC.EXE instead of a reverse_tcp. I’ve tried it with zero NOPs, 30 NOPs and 24 NOPs. All the preceding steps worked just fine(Fuzzing, etc). Why doesn’t it let me step through the NOP? Is it some sort of memory or security violation? I’m not sure what else to try. I’ve tried it with Python 2 and Python 3. Please give me a clue.