Collaborate Disseminate
I know we’re in 2020, however I’d like to study heap management and attacks that were prevalent at the time, especially in Windows XP SP1.
After installing Windows XP SP1 and windbg on it, I configured the symbols path as follow :
srv*c:\s… Continue reading Getting symbols for Windows XP SP1
When assigning priority for a bug, we had an internal discussion whether in C++ deleting an object more than once can result in code execution if the pointer to object can be corrupted. For the objects having virtual destruct… Continue reading Can deleting a non-inherited object more than once be exploited for code execution?
One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction:
Any non-exploitable read overflow get CVSS of 9.8, like VLC is a server and you could do RC… Continue reading Exploitation tactics for heap over-reading?
Here there is a thorough description of the exploit I am talking about. There is this step:
var x1 = new Array();
for (i = 0; i < 200; ++i) {
x1[i] = document.createElement(“COMMENT”);
x1[i].data=”abc”;
};
var e1 … Continue reading Why does hydraqs exploit put "abc" in its x1 array?
There is a 32-bit linux application. It’s possible to overwrite EIP easily. I will call this process: “send a string”.
It’s also possible to send about 10000 custom bytes to heap (it’s possible to send a float, and I can sen… Continue reading Need help in exploiting an overflow on Linux [on hold]
Assuming the application is vulnerable would a process crash if it was a subject for a heap spray attack and the attack is blocked by the EDR?
I was recently reading up a PDF (https://www.owasp.org/images/0/01/OWASL_IL_2010_Jan_-_Moshe_Ben_Abu_-_Advanced_Heapspray.pdf) heap spray techniques when they mentioned heap spray with bitmaps. Now they didn’t exactly explain… Continue reading Bitmap heap spray technique