SEH bypass

Before we start, we need to understand what SEH is. SEH stands for structured exception handling. We may have often seen programs popping up an error saying the software has encountered a problem and needs to close. This basically means it's the default exception handler of Windows kicking in.

SEH handlers can be considered the block of try and catch statements that are executed in order when there's an exception in the program. This is what a typical SEH chain would look like:

Source: https://www.corelan.be/wp-content/uploads/2009/07/image_thumb45.png

When an exception occurs, the SEH chain comes to the rescue and handles the exception based on its type.

So, when an illegal instruction occurs, the application gets a chance to handle the exception. If no exception handler is defined in the application, we will see an error shown by Windows: something like Send a report to Microsoft.

To perform a successful exploitation of a program with the SEH handler, we first try to fill the stack...