Hi I have a heap overflow problem, who can help me? - HeapOverflow Computer Security Community & Forums : Heap Overflow.com

HeapOverflow Computer Security Community & Forums : Heap Overflow.com

		HeapOverflow Computer Security Community & Forums : Heap Overflow.com > Computer Security: Discussions > Applications, Tools & Papers
Hi I have a heap overflow problem, who can help me?

Mark Forums Read

Notices

Welcome to you visitor! This community is mainly dedicated to the computer and security, if you're looking for DFind scanner or others exploits codes you will find them into the Projects section, feel free to start Blogging and remember to always keep an eye and start talking about security Advisories & public Exploits.

Applications, Tools & Papers Discuss about security applications, tools, papers, etc...

Hi I have a heap overflow problem, who can help me?

This is a discussion on "Hi I have a heap overflow problem, who can help me?" within the Applications, Tools & Papers part of the Computer Security: Discussions section; See below code. a1 = malloc(32); a2 = malloc(32); memset(a2,'A',64); free(a2); it can arose an heap overflow, But I can't use it to write 4bytes to anywhere. Does any one have a good way?...

Reply

1 links from elsewhere to this Post. Click to view.

#1 (permalink)

Old

17-05-06

paris-ye is offline

Junior Member

Join Date: May 2006

Posts: 8

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

paris-ye is on a distinguished road

Default

Hi I have a heap overflow problem, who can help me?

See below code.
a1 = malloc(32);
a2 = malloc(32);
memset(a2,'A',64);
free(a2);

it can arose an heap overflow, But I can't use it to write 4bytes to anywhere. Does any one have a good way?

Reply With Quote

Sponsor

Advertiser

#2 (permalink)

Old

17-05-06

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

because that is a stack overflow not a heap overflow.

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#3 (permalink)

Old

17-05-06

paris-ye is offline

Junior Member

Join Date: May 2006

Posts: 8

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

paris-ye is on a distinguished road

Default

Quote:

Originally Posted by class101

because that is a stack overflow not a heap overflow.

No, It's a heap overflow.

The real program is like that.

a = getprocessheap();
a1 = heapalloc(a, ,XXX);
a2 = heapalloc(a, ,36);
readfile(pfile,a2,60,1,0);
heapfree(a2);

before readfile,the heap manage & date is:
0008D8F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0008D900 00 00 00 00 00 00 00 00 AB AB AB AB AB AB AB AB
0008D910 00 00 00 00 00 00 00 00 DD 02 06 00 00 14 EE FE
0008D920 78 01 07 00 78 01 07 00 EE FE EE FE EE FE EE FE
^-------last heap struct point
after readfile, the heap manage & data is:
0008D8F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0008D900 00 00 00 00 00 00 00 00 00 00 33 33 33 33 33 33
0008D910 33 33 33 33 33 33 33 33 34 34 34 34 35 35 35 35
0008D920 36 36 36 36 37 37 37 37 33 33 33 33 33 33 33 33

heap management struct and two point is overflowd.

Reply With Quote

#4 (permalink)

Old

17-05-06

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

looks much a heap overflow in this case yes

you can usually control then a function looking like

mov dword [ecx],eax
mov dword [eax+4],ecx

wich allow you to write 4 bytes everywhere.

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#5 (permalink)

Old

17-05-06

paris-ye is offline

Junior Member

Join Date: May 2006

Posts: 8

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

paris-ye is on a distinguished road

Default

Quote:

Originally Posted by class101

looks much a heap overflow in this case yes

you can usually control then a function looking like

mov dword [ecx],eax
mov dword [eax+4],ecx

wich allow you to write 4 bytes everywhere.

Yep, I am tring for it. So hard! It's a 0day Ms vulnerability, I hope can expolit it =^^=

Reply With Quote

#6 (permalink)

Old

17-05-06

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

if it's winhlp related , you can forget

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#7 (permalink)

Old

17-05-06

paris-ye is offline

Junior Member

Join Date: May 2006

Posts: 8

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

paris-ye is on a distinguished road

Default

Quote:

Originally Posted by class101

if it's winhlp related , you can forget

Not winhlp. It's other one.

But why you said "if it's winhlp related , you can forget ". I know winhlp vulnerability is released. Your meens no one can develp exploit?

Reply With Quote

#8 (permalink)

Old

17-05-06

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

nah I just mean it has been found already many bugs in it so that's not that hot, if yours anyway is usable remotely, try contacting zerodayinitiative.com, they pay high price for and you are welcome to put me as the referer if it's the first time you are selling to them :> , good luck with it

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#9 (permalink)

Old

17-05-06

paris-ye is offline

Junior Member

Join Date: May 2006

Posts: 8

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

paris-ye is on a distinguished road

Default

Quote:

Originally Posted by class101

nah I just mean it has been found already many bugs in it so that's not that hot, if yours anyway is usable remotely, try contacting zerodayinitiative.com, they pay high price for and you are welcome to put me as the referer if it's the first time you are selling to them :> , good luck with it

Thx for you

but it seems very hard to exploit.

Reply With Quote

Sponsor

Advertiser

Reply

Tags
heap, help, overflow, problem

« Windows Multi-Lang OPcodes DB | How to discover vulns in file formats? »

LinkBacks (?) LinkBack to this Thread: http://heapoverflow.com/f0rums/applications-tools-papers/1211-hi-i-have-heap-overflow-problem-who-can-help-me.html
Posted By	For	Type	Date
help - Members and Communities tagged with help - Zoints	This thread	Refback	15-01-08 18:00

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Titan FTP Server 6.03 (USER/PASS) Remote Heap Overflow PoC	Heap	Public	0	02-02-08 19:19
iMesh 7.1.0.x (IMWeb.dll 7.0.0.x) Remote Heap Overflow Exploit	Heap	Public	0	20-12-07 02:16
BitDefender Online Scanner 8 ActiveX Heap Overflow Exploit	Heap	Public	0	28-11-07 03:26
A olly big problem when it is debuged for heap overflow	paris-ye	OllyDbg	1	20-05-06 20:25
Microsoft Windows Media Player BMP Handling Buffer Overflow	9 Below Zero	Public	0	16-02-06 07:14

heapoverflow.com - SEOmeter SEO tools

Locations of visitors to this page

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63