Exploiting heap overflows on XP SP2

From: <nicolas.falliere_at_gmail.com>
Date: 18 Aug 2005 15:56:20 -0000

('binary' encoding is not supported, stored as-is) Hi,

I describe a new way to exploit heap-based buffer overflows in the following paper:

http://www.packetstormsecurity.com/papers/bypass/bypassing-win-heap-protections.pdf

Basically, one can use critical section related linking structures stored on the process’s default heap to produce a n*4-byte overwrite. Gaining control is another problem, only memory overwrite is discussed in the paper.

NF
Received on Aug 19 2005