bugtraq - "Writing JIT-Spray Shellcode for fun and profit" by DSecRG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1135422228.20100306141559@dsecrg.com>
Date: Sat, 6 Mar 2010 14:15:59 +0300
From: DSecRG <research@...crg.com>
To: bugtraq@...urityfocus.com, packet@...ketstormsecurity.org
Cc: pen-test@...urityfocus.com
Subject: "Writing JIT-Spray Shellcode for fun and profit" by DSecRG

"Writing JIT-Spray Shellcode for fun and profit"

by Alexey Sintsov from DSecRG (dsecrg.com)

Attacks on clients’ browsers have always been the real threat for everyone.
And here vulnerabilities have been not only in the browser but also in plug-ins.
Bank-clients, business software, antivirus software – all of them use ActiveX (for IE)
for clients and here have been and are still many vulnerabilities.
Vendors make steps to defend us from it. Software vendors patch vulnerabilities and OS vendors
use new mechanisms to prevent attacks at all. But security researchers are trying to find way to bypass these mechanisms.
The new versions of browsers (Internet Explorer 8 and FireFox 3.5) use permanent DEP.
And the new versions of OS use the ASLR mechanism. All this makes the old methods of attacks impossible.
But on BlackHat DC 2010 the interesting way to bypass DEP and ASLR in browsers (not only)
and Just-In-Time compilers was presented. This method is called JIT-SPRAY. But here was no one public PoC until now.

In this text we are describe how to write a shellcode for new JIT-Spray attacks and make universal STAGE 0 shellcode
that gives control to any common shellcode from MetaSploit, for example.

http://www.dsecrg.com/files/pub/pdf/Writing%20JIT-Spray%20Shellcode%20for%20fun%20and%20profit.pdf

As we give much attention on ERP and Business applications security
you can also download new exploits for popular client side Business applications
such as SAP GUI and Oracle Document Capture that use JIT-Spray
Shellcode.

SAP GUI 7.10 WebViewer3D ActiveX - JIT-Spray Exploit
http://dsecrg.com/files/exploits/SAP-Logon7-System.zip

Oracle Document Capture (EasyMail Objects EMSMTP.DLL 6.0.1) ActiveX Control BOF - JIT-Spray Exploit
http://dsecrg.com/files/exploits/QuikSoft-reverse.zip

Alexey Sintsov
Digital Security Research Group
______________________
DIGITAL SECURITY
phone:  +7 812 703 1547
        +7 812 430 9130
e-mail: research@...crg.com
www.dsec.ru
www.dsecrg.com
www.pcidss.ru

-----------------------------------
This message and any attachment are confidential and may be privileged or otherwise protected 
from disclosure. If you are not the intended recipient any use, distribution, copying or disclosure 
is strictly prohibited. If you have received this message in error, please notify the sender immediately 
either by telephone or by e-mail and delete this message and any attachment from your system. Correspondence 
via e-mail is for information purposes only. Digital Security neither makes nor accepts legally binding 
statements by e-mail unless otherwise agreed. 
-----------------------------------