Questions tagged [heapspray]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
46 views

Can deleting a non-inherited object more than once be exploited for code execution?

When assigning priority for a bug, we had an internal discussion whether in C++ deleting an object more than once can result in code execution if the pointer to object can be corrupted. For the ...
1
vote
2answers
89 views

Exploitation tactics for heap over-reading?

One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction: Any non-exploitable read overflow get CVSS of 9.8, like VLC is a ...
1
vote
0answers
41 views

Why does hydraqs exploit put “abc” in its x1 array?

Here there is a thorough description of the exploit I am talking about. There is this step: var x1 = new Array(); for (i = 0; i < 200; ++i) { x1[i] = document.createElement("COMMENT"); x1[...
1
vote
0answers
85 views

Need help in exploiting an overflow on Linux [closed]

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
0
votes
1answer
215 views

Is Heap Spraying only valid for browser applications?

Since heap spraying takes advantage of javascript's predictability in allocating heap chunks, does this mean that heap spraying only works for browser applications and not other usual applications?
3
votes
1answer
669 views

Bitmap heap spray technique

I was recently reading up a PDF (https://www.owasp.org/images/0/01/OWASL_IL_2010_Jan_-_Moshe_Ben_Abu_-_Advanced_Heapspray.pdf) heap spray techniques when they mentioned heap spray with bitmaps. Now ...
1
vote
0answers
88 views

Why makes many copies of the code block in Heap Spray?

I Understand that adding NOP-Sled will increase the possibility of the attack, but why do we need to add more than a copy of NOP-sled + shellcode? if we have one big NOP_sled+shellcode it will be more ...
7
votes
1answer
1k views

Are Heap addresses randomized by ASLR?

I have been reading this article about an Internet Explorer exploit and I am a little confused about why the memory addresses effected by the heap-spray "work". The paper states that the attack uses ...
2
votes
1answer
155 views

Heap Spray in Documents

I was watching Kevin Mitnick demonstrate the results of an exploit via Heap Spray in a PDF https://www.youtube.com/watch?v=0EKTCg7yQ_Y and was wondering what exactly is going on in the PDF and whether ...
3
votes
1answer
58 views

Reason behind HeapSpray format

I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs ...