microsoft has offered a lot of help in this, by providing their dll library
which tells which dll's were shipped with x sp or os version. check on
msdn.microsoft.com. I tend to perfer looking for useable jump points in
application provided code(provided dll's), preferably in the code you are
overflowing. This seems to work best for me, because if the code contains
an overflow, and there is a useable jump point, if the overflow is there, so
is the jump point:)

As far as i've seen, there is no "magic bullet" of jumppoints, a pretty
decent choice if you need to hit an os dll is often kernel32.dll, or msvcrt.
Another technique you may chose to use is to avoid application code
altogether, and jump directly to the stack or the heap. Often, you don't
know your specific addresses, but if size isn't an issue, a decent nop sled
can compensate for slight deviations.

Signed,
Ryan Permeh
eEye Digital Security Team
http://www.eEye.com/Retina -Network Security Scanner
http://www.eEye.com/Iris -Network Traffic Analyzer
http://www.eEye.com/SecureIIS -Stop Known and Unknown IIS Vulnerabilities

----- Original Message -----
From: <foobreturn0.net>
To: "Franklin DeMatto" <franklin.listsqDefense.com>
Cc: <vuln-devsecurityfocus.com>
Sent: Monday, September 24, 2001 4:30 AM
Subject: Re: static dll's for windows buffer overflows

>
> > Windows buffer overflows almost always require knowledge of offsets in
> > dll's. Even if rva is used, usually one offset is still known, to jmp
to
> > where the code is (e.g., let's say the shellcode is pointed to by eax,
we
> > need to know the offset of somewhere to jmp eax). Which dll's are the
most
> > static? For the jmp instruction, we can use any dll, as long as it has
> > those bytes (i.e., we are not limited to kernel, user, and gdi). Which
> > dll's are the best to use, and why?
>
> Using dll's for the jmp's causes problems when different service packs are
> encountered. I usually grab a list of all the dlls loaded by a process
> (dumpbin, pex or msvc will do this), narrow down the to the ones
> containing a usuable jmp/call instruction, and then pick the one with the
> oldest date in the newest service pack. This way, the same dll will be
> used in most (all?) earlier service packs.
>
> Also, dll's with addresses that are ascii printable are good for filtered
> buffer overflows - ie 0x77500000 (clbcatq.dll) == 'gP..' in internet
> explorer 6.
>
> Usually the choices are limited however.
>
> - foob
>
>
>

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]