Exploiting new IE Object Type Overflow

From: Dave (chaboyd77_at_yahoo.com)
Date: 06/05/03

  • Next message: wirepair: "win32 command line overflows: (ex: ollydbg.exe)" 
    Date: 5 Jun 2003 03:44:40 -0000
To: vuln-dev@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Hi,

    I've had really good success with basic overflows and have been trying to
    attempt something moderate+. I've successfully duplicated the overflow (IE
    Object Type) (ESP doesn't seem to be overwritten, but EDI is). However,
    since the value located in EDI is referenced then program flow can be
    controlled?? I just can't seem to do anything with EDX as stated in the
    EEYE Advisory..

    "This allows us to take control of key registers so as to run code that we
    specify, which will be available at the EDX register.

    On my system (2000 Pro SP3) EDX always has a value of 0 and nothing I do
    changes its value or any other registers value (besides EDI). Also, this
    is different from a regular stack overflow as placing the address of a JMP
    ESP in EDI doesn't always seem to be gauranteed to point to my code.

    Is there something really easy I'm missing here?
    Thanks,
    Dave

     

  • Next message: wirepair: "win32 command line overflows: (ex: ollydbg.exe)"

    Relevant Pages

    • Re: NASM 0.98.39 vs. NASM 2.03.01 disassembly
      ... was using only 32-bit registers, but at the time I needed an instruction ... It's not so simple to make SETcc orthogonal for for esi, edi, ebp, esp, ...
      (alt.lang.asm)
    • Re: Inspecting messages
      ... Lines 171-175 copies registers onto the stack so they can be restored to ... destination address in edi. ... the pointer before doing an interrupt. ... What happens is that some values are pullled of the stack and stored in ax ...
      (comp.os.minix)
    • Re: NASM 0.98.39 vs. NASM 2.03.01 disassembly
      ... was using only 32-bit registers, but at the time I needed an instruction ... It's not so simple to make SETcc orthogonal for for esi, edi, ebp, esp, ...
      (alt.lang.asm)
    • Re: Hehe. Final solution
      ... But the fact is, I do not save, consciously, any of the registers, ... EDI will be set to point to MEMORY in my code. ... cmp edi &NULL|je @ItsAWindowHit ...
      (alt.lang.asm)
    • Re: integer limit
      ... If we do this in 32 bit registers, and do not worry about overflow, we ... so in a twos complement machine 2147483648 is negative, ... I am not surprised that Google turns up nothing for 139586437119. ...
      (comp.unix.shell)