unicode overflows - HeapOverflow Computer Security Community & Forums : Heap Overflow.com

HeapOverflow Computer Security Community & Forums : Heap Overflow.com

		HeapOverflow Computer Security Community & Forums : Heap Overflow.com > Computer Security: Discussions > Hacking
unicode overflows

Mark Forums Read

Notices

Welcome to you visitor! This community is mainly dedicated to the computer and security, if you're looking for DFind scanner or others exploits codes you will find them into the Projects section, feel free to start Blogging and remember to always keep an eye and start talking about security Advisories & public Exploits.

Hacking Discuss the art of hacking, your experiences, etc...

unicode overflows

This is a discussion on "unicode overflows" within the Hacking part of the Computer Security: Discussions section; once I wrote a PoC "http://www.milw0rm.com/id.php?id=908" for argosoft ftp to tell that the new version is still vuln . that time I really didnt give a try to get a shell . but ...

Reply

#1 (permalink)

Old

23-06-05

Guest

Posts: n/a

Default

unicode overflows

once I wrote a PoC "http://www.milw0rm.com/id.php?id=908" for argosoft ftp to tell that the new version is still vuln . that time I really didnt give a try to get a shell . but now for educatinal purpose I am giving a new try to get shell but listen to the story :
as it is a unicode overflow getting a shell is now easy and reliable . I went to the famus webdav unicode overflow exploits .
1) http://www.milw0rm.com/id.php?id=1 which is written by kralor , I went to undernet #coromputer and spoke to him about this he told me what to do , but as he is a bit lazy he didnt explained well (he is very nice) he mentined about high level memory addressing which could be useful , or finding a usable address which could be used in eip .
2) http://www.milw0rm.com/id.php?id=2 Roman explained very well but still many why's for me !
aha EIP = 0x00480004 he used ,
so I searched and I found some : ( xp sp1 addresses )
002E00F0 ==> call EAX
00460023 ==> call ESI
and other addresses for ESI
but I dont see any use in them

. not pointing to anywhere useful
note that we can use SEH too .
I can send the shellcode with the command like CD before the overflow command and they wont be *censored**censored**censored**censored*ed up with 00 , but pointing to them is another problem .
I want to know any of your ideas . specially about that high level memory addressing .
until 1.4.2.9 is vuln .

Reply With Quote

Sponsor

Advertiser

#2 (permalink)

Old

24-06-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

Quote:

Originally Posted by c0d3r

he did a wise job
every long char which would be send to server it will write a nullbyte
in the middle so we cant overwrite eip or other registers normally .
The eip would be overwrite like 00410041 which seems useless .

yes its all without a patch, SlimFTPD was already patched with a similiar way wich I had been able to exploit I remember, I guess the adress of your shellcode isnt fixed , I mean you can try to overwrite eip with the fixed up address of your shellcode but this isnt really realiable, hmm you should think that now on xp sp2 and the new os, if you are using a jmp , you should catch one outside of a loaded module, take the tool I attach
(from matt miller) it dumps every address of a loaded process, then you have to script a bit to find something usuable,
else what you can do is to debug a lot the ftp server, and to see if you can redirect eip to a server function wich will helps you then to get back to your execution code, hmmm
there is so much thing that u can do beeing able to overwrite 3 bytes , Im sure you will congrats to find something

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#3 (permalink)

Old

24-06-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

and binary

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#4 (permalink)

Old

24-06-05

Guest

Posts: n/a

Default

thank you for the information .
I am giving a try , wont be an easy job :!: , shellcode address differs in others systems in the normal overflow , as I remember webdav exploits not used to work in many systems ! . I will do as u said ,I will work with that tool .

Reply With Quote

#5 (permalink)

Old

25-06-05

Guest

Posts: n/a

Default

Another example of why I love exploit writing, theirs always so many challenges and so many ways of doing something. Constantly running ideas in attempts to better the severity of the exploit is quite enjoyable.

Reply With Quote

#6 (permalink)

Old

30-06-05

Guest

Posts: n/a

Default

sure nolimit !
I finished my univ entrance exam and now I am free free free to work and stick to the job heh .
a very handy tool , dumping every segment around :P

Reply With Quote

#7 (permalink)

Old

01-07-05

hx

hx is offline

Member

Join Date: Jun 2005

Location: Australia

Posts: 37

Thanks: 0

Thanked 2 Times in 2 Posts

Rep Power: 12

hx is on a distinguished road

Default

Check this -> http://www.milw0rm.com/id.php?id=1075

Was thinking of your writing, then this was planted on my desk..hehe, it actually works to, maybe move the file itself (PoC) i have bin/c here, to xpsp2k eip section, but then also, this is kinda advanced, and think it would be happier here , with some cool pizza eatin dudes

(Yes, it compiles, fine, and no dont ask how or what shellcode addys to change, is not needed on this version

)

I can supply help on this, in varied form of course depending on how/who, and yes,, it ill get shell, not tested outside my LAN but this is fine example of some advanced stuff wich is working.
rehgards,
hx

Reply With Quote

#8 (permalink)

Old

01-07-05

Guest

Posts: n/a

Default

I dont get the point the code you linked is not a unicode overflow nor related to this subject .

you want to help then try to help :wink:
and about those article they are great those you sent

Reply With Quote

#9 (permalink)

Old

26-11-05

Guest

Posts: n/a

Default

No way

How can you say that? No way!

Reply With Quote

Sponsor

Advertiser

Reply

Tags
overflows, unicode

« generating shellcode | Works -ban funktion in version 1.09? »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
CVE-2007-4771 (International Components for Unicode)	Heap	Advisories	0	29-01-08 19:31
CVE-2007-4770 (International Components for Unicode)	Heap	Advisories	0	29-01-08 19:31
heap plugin for olly		OllyDbg	7	26-11-05 09:15
Buffer overflows trying to get this right	h3llfyr3	Hacking	0	17-09-05 16:31

heapoverflow.com - SEOmeter SEO tools

Locations of visitors to this page

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72