The presentation "Advances in Exploit Technology", presented by H D Moore & spoonm, talked about the future of exploits and how Metasploit was going to make things better... for the ones writing the exploit. They touched on comparisons of open source and closed source exploitation; dynamic vs. static addressing, return address bouncing, using the stack exception handler, polymorphic exploits to avoid detection (IDS/IPS) systems, and the concept of a multi-byte NOP sled.

The most interesting aspect of the presentation was polymorphic exploitation code. This would make the life of a passive detection system much more challenging. I would imagine that it would be possible to design algorithms capable of deciphering polymorphic code based on the same principles of "BinDiff"... look for common logic. It may also be possible to simply detect the polymorphic algorithm and completely avoid any code deciphering.

The multi-byte NOP sled was also very interesting. It appeared to be a concept for generating random OP codes that do not impact the process or shell code in a negative way. It is placed in the stack prior to the shell code when the return address is non-deterministic. The shell code must be placed in a location that is equal to or above the highest perceived return address. The multi-byte NOP sled generates random OP codes to obfuscate passive detection while simultaneously providing a clean path of execution to the shell code.