exploit analysis

[peju]

Hi,

how can I analyse an exploit?

For example https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms04_007_killbill.rb

This is working on MS IIS, this smb exploit generates a token with a lot of hex values.

How can I reconstruct why it is like this. I installed immunity debugger in my xp vm, but there is no process for iis to attach.

 

Best regards

 

 

[Bigbiz]

Couldnt you locate where the exploit is located on machine then vi into it.?

[peju]

Shure, but I mean, why is the token constructed like this on line 187-248 from the link. Maybe I can follow the stack, heap changes with a debugger?