Skip to main content

Exploiting Double Free Vulnerabilities...





Alsalam alikom wa ra7mat Allah wa barakatoh



Huh!! that's what I said when I first saw that title... but let me explain...


Double Free means that you try to free a pointer two times (which is logically can't work).
Actually windows SP2 and later (even Vista) this can be done (in somehow) and can actually corrupt the heap (Vista will shout at your face if u did) and that can make you able to use and browse the heap as you want..

Facts to know about how Windows frees your pointers:
- There is something called Lookaside buffer (fast access, small size) and another thing is FreeList(slower access, the whole memory).
- Chunk is an object of the DataStructure that holds mainly 2 things: pointer to where the next free Chunk is and pointer to the previous free one (think about it like a node in a linked list)
- The first 4 bytes of the Chunk is the BLink (BackLink) and the second 4 bytes is the FLink
- delete ptr1;
delete ptr2;
Windows takes your Chunk (for ptr1) and puts it in the Lookaside slot (and mark it as Busy), then takes ur second chunk and puts it in another free slot (if exists, if not it'll be sent to the FreeList)

Now, the Vulnerability:
If we succeeded to make something like this :
delete ptr;
delete ptr;
And to ensure that the second delete will be sent to the FreeList, guess what, we have two locations pointing to the same chunk (so what ??.. just wait and c)
Now, if we can then re-allocate a chunk
ptr = new Whatever;
Guess what !! u will take the Chunk in the lookAside back to u.. and u still have those precious 8 bytes that you can play with and actually corrupt or control the freeList entries..

* One last note, about Windows Vista:
- They are using random address for FreeList.
- They are using encoded BLink & FLink after XOR'ing them with a random value generated when the process starts
- The Windows Shout when the heap is corrupted (previous windows just ignore this)


All what is above is a quick review after reading these two articles :
Double Free Vulnerabilities Part1 (Symantec.. what is the bug)
Double Free Vulnerabilities Part2 (Symantec.. how to exploit the bug)

That's it... stay away hackers !!!

Alsalam alikom wa ra7mat Allah wa barakatoh

Comments

Popular posts from this blog

Windows7 adds Math Input Panel

Alsalam alikom wa ra7mat Allah wa barakatoh…I was reading a windows team post about Input Panels improvements in Windows7 [here]. When at the end I saw a very interesting –intuitive if you wish- new thing… which is, as you guessed, the Math Input Panel…Yes, that crappy font is mine… I “drew” that by mouse as I don’t have a tablet pen/pc.You can then paste it directly into word and it’ll recognize it as an editable equation…During my tests, the output panel (the top part) hanged, but I liked that the drawing panel was still responsive and I could still write/erase… till the top one started to respond again…One other thing to know, after you click Insert (that button down there) it copies the equation in MathML [Wikipedia link] format.. which is a standard way of representing equations and hence any application that recognizes the format can insert it not as an image but as a nice editable equation…If you think it recognized something wrong, you can click “Select and Correct” then draw …

Visual Studio 2008 Not saving changes or project properties?

Alsalam alikom wa ra7mat Allah wa barakatoh (Peace upon you)I’ve recently ran into problems with VS 2008. Summarized here:When you try to edit the project properties (specially C++ projects) you are faced with a little nice message saying “Exception from HRESULT: 0xF9F0F308”. Sometimes when you are editing a file (specially large ones), VS doesn’t recognize you’ve made changes (ie doesn’t display that ‘*’ in the files tabs) hence, when you save, nothing actually gets saved. For those 2 problems, a friend explained the problem and a work around (till they officially release a fix)…Open up a Visual Studio 2008 Command Prompt Run cd "C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE" Make a backup copy of devenv.exe in case something does not work right.
ie. copy devenv.exe devenv.exe.bak Run editbin /largeaddressaware:no devenv.exe Happy VSing… :)