Reliable Windows Heap Exploits.ppt

Reliable Windows Heap Exploits Matt Conover Oded Horovitz Agenda Introduction to heap exploits Windows heap internals Arbitrary memory overwrite explained Applications for arbitrary memory overwrite + exploitation demos Special notes for heap shellcodes XP SP2 Q A Introduction Heap vulnerabilities become mainstream DCOM, Messenger, MSMQ, Script Engine Need to be an expert to exploit them David Litchfield – “Windows Heap Overflows” LSD – “Microsoft windows RPC security vulnerabilities” Dave Aitel – “Exploiting the MSRPC heap overflow I,II” Halvar – “3rd Generation exploits” Introduction Even experts use some Voodoo magic as main ingredient of exploits Making 4 byte overwrite is a guess work Failures are not well understood Available exploits are service pack dependents Shellcode address is not known During exception handling, pointer to buffer can be found on the stack (in exception record) Address of instruction that access the stack is needed, which is SP dependent Windows Heap Internals What Is Covered Heap internals that can aid in exploitations Heap process relations The heap main data structures The algorithms for allocate free Not Covered Heap internals that will bore you to death Stuff that is not directly related to exploit reliability Algorithms for “slow” allocation or heap debugging Windows Heap Internals Many heaps can coexist in one process Windows Heap Internals Heap starts with one big segment Most segment memory is only reserved Heap management is allocated from the heap! Windows Heap Internals Important heap structures Windows Heap Internals Segment management Segment limits (in pages) List of uncommitted blocks Free/Reserved pages count Pointer to “Last entry” Windows Heap Internals Free List management 128 double linked list of free chunks Chunk size is table row index * 8 bytes Entry [0] is an exception, contains buffers of 1024 size “Virtual allocation threshold”, sorted from small to big Windows Heap Internals Free List Usa