Attacking the Vista Heap - 2008

More documents

Recommendations

Info

Segment Allocation RtlpExtendHeap: 1 2 3 NtAllocateVirtualMemory(INVALID_HANDLE_VALUE, &allocAddr, 0, &hHeap->segmentReserve, MEM_RESERVE, rwProt); … NtAllocateVirtualMemory(INVALID_HANDLE_VALUE, &allocAddr, 0, &segmentCommit, MEM_COMMIT, rwProt); … return allocAddr;
Large Chunk Allocation RtlpAllocateHeap (large chunk): 1 2 3 dwSize += BASE_STRUCT_SIZE; … NtAllocateVirtualMemory(INVALID_HANDLE_VALUE, &baseAddr, 0, &dwSize, MEM_COMMIT, rwProt); … hHeap->largeTotal += dwSize; … chunk = (LPVOID) baseAddr + BASE_STRUCT_SIZE + HEAP_ENTRY_SIZE; … return chunk;
Page 1 and 2:
Attacking the Vista Heap Ben Hawkes
Page 3 and 4:
The Heap
Page 5 and 6: Heap Exploit • An “exploit” p
Page 7 and 8: Intro-clusion 2 • Heap exploits a
Page 9 and 10: Heap Chunk • HeapAlloc returns a
Page 11 and 12: Unlink • Solar Designer haxed net
Page 13 and 14: Unlink • HISTORY: control the fwd
Page 15 and 16: Current Heap Exploitation • So ev
Page 17 and 18: Attacking the Application • At th
Page 19 and 20: Attacking the Vista Heap • The te
Page 21 and 22: hHeap HANDLE payload
Page 23 and 24: Heap API
Page 25 and 26: Heap API HANDLE hHeap LPVOID chunk
Page 27 and 28: Heap HANDLE II • Unfortunately th
Page 29 and 30: Heap HANDLE II • Set a Heap HANDL
Page 31 and 32: Arbitrary Free
Page 33 and 34: Arbitrary Free I • Assume you can
Page 35 and 36: Arbitrary Free III Arbitrary Free (
Page 37 and 38: Vista Arbitrary Free II • Is ther
Page 39 and 40: Vista Arbitrary Free IV • Partial
Page 41 and 42: Vista Arbitrary Free VI Vista Arbit
Page 43 and 44: Vista Heap Changes • List integri
Page 45 and 46: Securing the Heap II - Generic •
Page 47 and 48: Food for Thought • Fundamentally
Page 49 and 50: Rant Off • We need an architectur
Page 51 and 52: Summary • Heap vulnerabilities ar
Page 53 and 54: Appendix 1 - page 54 - hHeap overfl
Page 55: ASLR HeapCreate: 1 2 3 4 randPad =
Page 59 and 60: Heap Spray II - the stats • Say N
Page 61 and 62: Guarding hHeap • Notice lack of g
Page 63 and 64: hHeap overflows I • Overflow in c
Page 65 and 66: hHeap overflows IV • Pattern 1: -
Page 67 and 68: hHeap overflows VI • Pattern 3: -
Page 69 and 70: hHeap payload hHeap (X) … A … B
Page 75 and 76: hHeap payload hHeap (X) … B … C
Page 77 and 78: Adjusted Double Free I • Applicat
Page 79 and 80: Adjusted Double Free III • At thi
Page 81 and 82: Adjusted Double Free V Adjusted Dou
Page 83 and 84: Heap termination I BOOL SetHeapOpti
Page 85 and 86: Heap termination III • Must opt-i
Page 87 and 88: Off-by-one II • Modify free chunk
Page 89 and 90: Off-by-one IV Off-by-one overflow r
Page 91 and 92: Vista Chunks • Every chunk has a
Page 93 and 94: Canary leak • Leak of a chunk hea
Page 95 and 96: LFH bucket overflow I • LFH bucke
Page 97 and 98: LFH bucket overflow II • LFH buck
Page 99 and 100: LFH bucket overflow IV • Set ent_
Page 101 and 102: LFH bucket overflow V • Y is used
Page 103 and 104: LFH header overflow I • Given an
Page 105 and 106: LFH header overflow II LFH_HEAP_ENT
Page 107 and 108:
LFH header overflow IV LFH Chunk la
Page 109:
LFH header overflow VI LFH header o
show all

Attacking the Vista Heap - 2008

Create successful ePaper yourself

Delete template?

Save as template?