[A+][TUT] Ken Ward Zipper Stack BOF 0day – a not so typical SEH exploit

[begood]

March 18 2010 by corelanc0d3r//cel mai bun "profesor" de exploit writing din cati am gasit pe internet.

About 2 weeks ago, I published a somewhat detailed explanation about an exploit I wrote for a – what some people would call “lame” - bug which I discovered in quickzip. In case you missed these articles, the articles were posted on the Offensive Security Blog : Part 1 and Part 2.

Ok, I agree, there are a lot more impressive bugs than this one, but the process of writing a working exploit was interesting to say the least. I had to deal with all kinds of hurdles, but by blending a little bit of creativity and persistence, I managed to pull it off.

Interestingly enough, I found a similar “lame” bug in another unzipper. The author decided to ignore my emails, so today I will disclose the details and explain how to write the exploit for this vulnerability.

If you’ve read the articles I wrote on the Offensive Security Blog, then you will discover that this particular exploit is quite similar to the one for quickzip… but this time we will even have to push things a little bit further.

I have received quite some feedback about the writing style I applied to those 2 articles. Apparently people like the combination of a detailed explanation, with the concept of making the document look like a some kind of exercise at the same time.

Based on that feedback, I decided to apply the same concept on this post. This translates into the fact that I have put a marker on some “strategic” places in this article, indicating that you should stop reading and that you should think about the current issue/situation/… and try to figure out for yourself how you would approach a given problem.

DOWNLOAD PDF 2shared - download Ken Ward Zipper Stack BOF 0day ? a not so typical SEH exploit.pdf

READ ONLINE : Ken Ward Zipper Stack BOF 0day – a not so typical SEH exploit | Security Researches

Edited March 22, 2010 by begood