1

It is my current understanding that in order to successfully exploit a stack-based buffer overflow vulnerability, we must first overflow the buffer, thus overwriting the return pointer and gaining control of EIP. Once we control EIP, we can utilize a JMP ESP instruction in order to jump to the beginning of our stack, executing our shellcode (let's assume DEP or ASLR are not in place just for simplicity and theoretic sake).

Now for the heap, I understand that overflows are still present. My question is: Does the exploitation of a buffer overflow look different upon the heap? If so, what are the finer details?

Improve this question
2
  • Have you read the Wikipedia page? It seems a good start.
    – Neil Smithline
    Commented Apr 7, 2018 at 2:30
  • I have, it doesn’t address my question of what the differences are
    – Henry F
    Commented Apr 7, 2018 at 2:50

2 Answers 2

Reset to default
5

With a stack overflow - if you just keep overflowing - you overflow first locals vars, then saved registers, then the return address, then function arguments, then stuff further down the stack, maybe exception handlers, etc. Usually as an attacker you indeed use the overwritten return address to jump somewhere interesting.

With a heap overflow you overflow ... whatever lies beyond your piece of memory. In old or bad heap implementations that might be heap metadata that can give you e.g. the power to write stuff into targeted memory locations (which you could use to overwrite a function pointer). In other heap implementations you will have to engineer a pattern of allocations and deallocations to get the heap into a state where there is an interesting allocated piece to the right side of your piece of memory. Maybe a vtable or some other function pointers.

Heap overflows are highly specific to heap implementation and application. On linux there are the „house of ...“ techniques because glibc malloc is a joke (sorry!), on windows 7 the heap got very well secured and well randomized and you have to hope for applications to bring their own insecure heap implementations to get 1% more performance. They often do.

Improve this answer
0

Gaining execution ability is indeed not the only way to exploit a buffer overflow. The heartbleed bug is a recent well known example of a heap buffer overflow type situation, where all the attacker could do was read beyond the buffer. Not write or gain execution ability. http://heartbleed.com

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .