BufferOverflow ESP too small for shellcode

Question

I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this.

I have done the following steps.

1. Fuzzing
2. Find offset
3. check for Bad chars
4. find module JMP address
5. control EIP
6. use msfvenom for writing shellcode

I have tried to add 16 "B" but only 12 got written into the ESP space

Answer 1

You've run into a common problem in developing realistic exploits. Being a common problem, there is likely a solution. You just have to already know how to find it.

In this case, look into the concept of a trampoline. Trampolines are small segments of shellcode that exist to redirect execution. It is useful in this type of scenario because you can redirect to a larger block of memory that you also were able to overwrite. So in your 12 bytes, you have to craft code (start with JMP) that transfers EIP into a larger block from your overflow buffer.