Menu
I've read two articles about heap-spraying: Wikiepdia and this blog post. I understand how the shell code is introduced in to the program's memory. But how the program is made to jump/call to the address memory located on heap?
What kind of crash makes a call to heap?
Does such attack needs to be conducted with a kind of buffer overflow attack?
Is there any golden rule like the one with buffer overflow ie use the n version of functions (strncpy instead strcpy)?
978
There is a variety of heap spraying techniques, but basically, an attacker writes to the heap in memory for a running program, then exploits a different vulnerability to cause the exploit to call the commands in the heap memory. This basically makes it easier to exploit a vulnerability.
Heap spraying attacks fill large portions of the victim's heap memory with malicious code (e.g., NOP sleds), thus increasing the chance of hitting malicious code for hijacking the control flow [14, 15].
Explanation. While these are all susceptible, C programming languages are of the worst offenders.
Anti-HeapSpraying Enforcement: Reserves portions of memory to prevent abuse by heap spraying attack techniques. Dynamic Anti-HeapSpraying Enforcement: Analyzes the memory heap of a protected process to look for malicious shellcode.
If I understand correctly,
They commonly take advantage from the fact that these heap blocks will roughly be in the same location every time the heap spray is run. Execution flow can be redirected to the heap sprays via buffer overflow or heap overflow flaws.
They're talking about a situation like this:
char buffer[10];
FuncPtr p;
And when you read into buffer there's no overflow protection, and you can write directly into the memory location for p. Later on when your code tries to call p, it will jump to where the attacker wants it to jump, presumably where they injected executable code into your app.
Simple fix: Don't use static buffers (prefer the std:: collection classes) and always check for overflows.
86
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
