seh-exploit-methods

2 ways:

a) Find a POP POP RET pointer in a DLL that is not compiled with SafeSEH (Application DLL's or, if no other option, OS DLL)
b) use a POP POP RET pointer from the application itself, assuming that the application bianry is not SafeSEH compiled