This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits.

This is a good summary of the vulnerability. I have been able to control EIP but I'm not sure how to execute code.

My test machine is Ubuntu 11.10 and has ASLR enabled along with NX for the stack, heap, and libraries. The string I control (as described in the article) is stored on the heap so I cannot place any code in there since its not executable. Other than EIP I also control the EDI register but that's all. This is a 32 bit system so brute force is sufficient to defeat ASLR (plus I don't have any other security mechanisms in place; not very realistic, but a good start).


Just found this PoC. Basically the author gets to the same place where I am and then relies on code on the PHP server to take it a step furthur to be able to read the Apache process memory. He states that code execution is "highly possible" but doesn't go into much detail beyond that.

  • 3
    I guess the key question to ask is - what have you already tried, what material have you been using to learn here? Just using a vulnerability description is not enough unless you understand fully the way the OS uses registers, heaps, memory etc. As it stands this question seems far too broad, so I think you'd be best served by using training materials first, and then coming back when you have a specific problem.
    – Rory Alsop
    Jul 4, 2012 at 8:26
  • @Rory Alsop Well many of the sources I've looked at all seem to suggest that code execution is definitely possible, but there really isn't a "guide" I can follow since this vulnerablity isn't a true stack or heap overflow. I thought about a ret2text type of attack but I'm not sure what I could achieve with only control of EIP and EDI registers. I'm not looking for a specific solution, just general ideas of how to approach the problem. To answer your 2nd question I know how to exploit traditional vulnerabilities like stack overflows or dangling pointers so I have some knowledge in this area. Jul 4, 2012 at 19:15
  • okay - that's grand (better than me - my buffer overflow skills are over 10 years old :-) - I think this sounds like a valid question then. Lets see what answers you get :-)
    – Rory Alsop
    Jul 4, 2012 at 19:25

1 Answer 1


This is a nasty vulnerability that is very similar to a Dangling Pointer. In short, it allows a remote attacker to read and/or write to an arbitrary memory address. This is a lot more valuable than just a simple stack based buffer-overflow, especially in exploiting modern systems. A solid remote code execution exploit for this vulnerability has not surfaced to the public. However Vupen, a well known exploit dealer, may have developed such an exploit.

Because this is also a memory disclosure vulnerability you don't have to use brute force to bypass ASLR. An exploit has been written to read the ASLR'ed memory address of where your payload is in memory.

There is still the problem of controlling the EIP. I haven't seen an exploit that does this, but it looks like it maybe possible, perhaps with a GOT overwrite or corrupting the stack frame.

After you the EIP/RIP you have a few options. One option is to use Return Oriented Programming (ROP Chain) to execute arbitrary code. ROP Chains consist of useful "gadgets", or segments of assembler within the application that perform a useful task and these tasks are chained together. A common ROP gadget is controlling the EIP/RIP with a jmp edx. Another useful ROP gadget would be a call to system(), keep in mind that because of ASLR a ret2libc call to system() will fail because you don't know this function's address, hence the need for ROP gadget(s). These are some simple examples, however ROP chains can also be very complex. ROP Chains are useful because they consist of code that must be executable and isn't randomized. There are tools to help you find ROP gadgets within a target application. In an application like Apache, there are bound to be many useful ROP gadgets.

Or another option is to leak memory to find a memory address that you can place a payload. Then defeat the NX bit (which might need a ROP chain) to make your payload executable and point the EIP/RIP to your payload.


  • controlling eip was pretty easy. problem was corrupting the stack, so I took your advice and ended up using rop gadgets. metasploit had a pretty good rop finder. Jul 12, 2012 at 8:58
  • @Bhubhu Hbuhdbus cool, this is a neat exploit.
    – rook
    Jul 12, 2012 at 17:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .