0

It is my current understanding that in order to successfully exploit a stack-based buffer overflow vulnerability, we must first overflow the buffer, thus overwriting the return pointer and gaining control of EIP. Once we control EIP, we can utilize a JMP ESP instruction in order to jump to the beginning of our stack, executing our shellcode (let's assume DEP or ASLR are not in place just for simplicity and theoretic sake).

Now for the heap, I understand that overflows are still present. My question is: Does the exploitation of a buffer overflow look different upon the heap? If so, what are the finer details?

  • Have you read the Wikipedia page? It seems a good start. – Neil Smithline Apr 7 '18 at 2:30
  • I have, it doesn’t address my question of what the differences are – Henry F Apr 7 '18 at 2:50
2

With a stack overflow - if you just keep overflowing - you overflow first locals vars, then saved registers, then return address, then function arguments, then stuff further down the stack, maybe exception handlers, etc. Usually as an attacker you indeed use the overwritten return address to jump somewhere interesting.

With a heap overflow you overflow ... whatever lies beyond your piece of memory. In old or bad heap implementations that might be heap metadata that can give you e.g. the power to write stuff into memory (which you could use to overwrite a function pointer). In other heap implementations you will have to engineer a pattern of allocations and deallocations to get the heap into a state where there is an interesting allocated piece to the right side of your piece of memory. Maybe a vtable or some other function pointers.

Heap overflows are highly specific to heap implementation and application. On linux there are the „house of ...“ techniques because glibc malloc is a joke (sorry!), on windows the heap got very well secured and well randomized and you have to hope for applications to bring their own insecure heap implementations to get 1% more performance. They often do.

0

Gaining execution ability is indeed not the only way to exploit a buffer overflow. The heartbleed bug is a recent well known example of a heap buffer overflow type situation, where all the attacker could do was read beyond the buffer. Not write or gain execution ability. http://heartbleed.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.