PornoSecurity

Having Fun With Windogs

Posted on 2008-08-11 14:21:03 in PornoSecurity

Oh yes, it's definitely true, i'm actually approaching the wild word of windogs. I started with some simple stack-based buffer overflows, and let me say a thing: they seems to be very very easy to exploit, kernel32.dll(which is guaranteed to be loaded in every single windozze app) and his friends are full of very usefull opcodes.
Heap-based buffer overflows are a bit more tricky, but it's just a matter of playing around for a while with your favourite debugger. At least for windozze <= sp1, actually sp2 introduces a bit more security in the way he manage chunk's coalescence, they call it safe-unlink and is more or less what glibc adds around version 2.3.5, it basically checks that the prev->next pointer equals the next->prev one before triggering RtlpCoalesceFreeBlocks(). So, i dunnno how to defeat it (yet), but if we speak about all of those browser-based vulnerabilities, i mean like ActiveX, the good news is that is possibile to adjust the Infernet eXploder heap by playing with javascript, and this is very very helpful!

Nick  

2008-10-22 22:34:42  

fXsTar: Infernet eXploder :)))) nice one.respect

---