Re: [VulnDiscuss] Main thread's exception handler

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[email protected] wrote:

| I have a question. Does someone know something about this WinZip32
| MIME Parsing Overflow Proof of Concept Exploit The author say: /*
| In this exploit, I've chosen to install our code as the main
| thread's top exception handler so that when exception is triggered
| at 0049C012,our code will be called to 'handle' it... =p */
|
| Does someone know where in memory is this "main thread's top
| exception handler"?
|
I haven't read this particular exploit, but if the overflow occurs in
the main thread, then he probably knows the offset from the start of
his string that the SEH structure is.

Otherwise, he can always setdefaultexeptionhandler() if his shellcode
has already been run. You'll have to provide a link of some kind to
the code for actual analysis.

Ah, found it: http://www.k-otik.com/exploits/04162004.wz_ex.c.php

Ok.  I believe he uses the technique of overwriting the Thread
Environment Block's pointer to the SEH chain to make it point to a
pointer to his code. I originally used this technique in a poorly
working heap overflow in CANVAS which Greg Hoglund documented here
http://www.rootkit.com/newsread.php?newsid=45 . Halvar might have
mentioned this technique in his 3rd-Generation-Attacks presentation as
well, but I can't quite remember and I don't have time to look it up.

In any case, go read Oded's cansecwest presentation. This exploit is
probably going to work 1/5000 times as this technique has typically
been fairly unreliable (as it was in the original Abyss CANVAS
exploit). Unless something magic with winzip's environment and use of
threads prevails, you'll want to do a complete rewrite.

Dave Aitel
Immunity, Inc.
www.immunitysec.com - "The exploit development kit everyone else
writes papers on." :>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAqiBFzOrqAtg8JS8RAnPvAJ4h9SpodSDNEX8qOu3bkaQ+WZpo8ACgjsJI
h91MiYtin6QTPpq6o2ur3g4=
=1nuE
-----END PGP SIGNATURE-----