[B! glibc] trashsuiteã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

trashsuite id:trashsuite

glibcã«é–¢ã™ã‚‹trashsuiteã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

malloc(3)ã®ãƒ¡ãƒ¢ãƒªç®¡ç†æ§‹é€ ã€€VA Linux Systems Japan
malloc()ã¨ã„ãˆã°ï¼£è¨€èªžã§ã¯ãŠé¦´æŸ“ã¿ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã§ã€æœ€ã‚‚è‰¯ãä½¿ç”¨ã•ã‚Œã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ä¸€ã¤ã§ã™ã€‚ã—ã‹ã—ãã®åˆ†ã ã‘ä½•ã‚‰ã‹ã®ä¸å…·åˆã‚’çµŒé¨“ã—ãŸäººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚æœ¬æ›¸ã§ã¯malloc()ã€free()ã§ç¢ºä¿ã€è§£æ”¾ã•ã‚Œã‚‹ãƒ¡ãƒ¢ãƒªãƒªã‚½ãƒ¼ã‚¹ãŒå†…éƒ¨çš„ã«ã©ã®ã‚ˆã†ã«ç®¡ç†ã•ã‚Œã¦ã„ã‚‹ã‹ã‚’èª¬æ˜Žã—ã¦ã„ãã¾ã™ã€‚mallocãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ä»•æ§˜ã‚’ç†è§£ã™ã‚‹äº‹ã§ã€ãƒ©ã‚¤ãƒ–ãƒ©ãƒªä½¿ç”¨æ™‚ã«ä½•ã‚‰ã‹ã®ä¸å…·åˆãŒç™ºç”Ÿã—ãŸéš›ã®æ‰‹åŠ©ã‘ã«ãªã‚Œã°ã¨æ€ã„ã¾ã™ã€‚ ã“ã“ã§ã¯Linuxãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã§æ¨™æº–çš„ã«ä½¿ç”¨ã•ã‚Œã¦ã„ã‚‹glibcã®mallocãƒ©ã‚¤ãƒ–ãƒ©ãƒªã‚’æ‰±ã„ã¾ã™ã€‚ä»Šå›žã®èª¿æŸ»ã§ã¯æ¬¡ã®ç’°å¢ƒã‚’ä½¿ç”¨ã—ã¦ã„ã¾ã™ã€‚ ãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ :Debian sarge ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãƒãƒ¼ã‚¸ãƒ§ãƒ³ :glibc-2.3.2.ds1-22 OS : i386 Linux æœ¬æ›¸ã§ã¯ã€ä¸Šè¨˜ã®é€šã‚Ši386ã‚¢ãƒ¼ã‚ãƒ†ã‚¯ãƒãƒ£ã®å ´åˆã«ã¤ã„ã¦è¨˜è¿°ã—ã¦ã„ã¾ã™ã€‚
trashsuite 2009/01/16
ã†ã‚“ï¼Œã•ã£ã±ã‚Šç€ã„ã¦è¡Œã‘ãªã„

glibc

malloc

C
ãƒªãƒ³ã‚¯
__atexit in memory bugs
Memory Bugs : __atex it Written by : Pascal Bouchareine Summary Basic knowledge of atex it() Implementation Exploitation concept Eggshell location independant method - no more NOPs. Exploitation example This is a very short paper showing a way to execute arbitrary instructions using atex it(). This is not of high interest and there may be a plenty of errors in it, as I wrote this while I was playing
trashsuite 2008/09/25
security

glibc

C
ãƒªãƒ³ã‚¯
æœ€è¿‘ã®glibcã§ã¯atexité–¢æ•°ã‚„jmp_bufã‚’ç‹™ã£ãŸæ”»æ’ƒã¯åŠ¹ã‹ãªã„ (PTR_MANGLE) - memologue
å°ãƒã‚¿ã€‚MSã®ä¸ã®äººã®blogã‚’ãªã‚“ã¨ãªãçœºã‚ã¦ã„ãŸã‚‰ã€ Address Space Layout Randomization in Windows Vista - Function Pointer Obfuscation http://blogs.msdn.com/michael_howard/archive/2006/05/26/608315.aspx Protecting against Pointer Subterfuge http://blogs.msdn.com/michael_howard/archive/2006/01/30/520200.aspx ã¨ã„ã†è¨˜äº‹ãŒã‚ã‚Šã¾ã—ãŸã€‚è¦ç´„ã™ã‚‹ã¨ã€ã€Œé•·ç”Ÿãã™ã‚‹ãƒã‚¤ãƒ³ã‚¿ï¼ˆç‰¹ã«é–¢æ•°ãƒã‚¤ãƒ³ã‚¿ï¼‰ã¯æ‚ªç”¨ã•ã‚Œã‚„ã™ã„ã®ã§ã€å€¤ã‚’ç´ ã®ã¾ã¾æ ¼ç´ã—ãªã„ã»ã†ãŒã‚ˆã„ã€ã¨ã„ã†è©±ã§ã™ã€‚é•·ç”Ÿããªãƒã‚¤ãƒ³ã‚¿ã¨ã„ã†ã®ã¯ã€ atex ité–¢æ•°ã§ç™»éŒ²ã•ã‚ŒãŸé–¢æ•°ã¸ã®ãƒã‚¤ãƒ³ã‚¿ (ãƒ—ãƒ
trashsuite 2008/09/24
linux

security

glibc
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (4)

glibcã«é–¢ã™ã‚‹trashsuiteã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬3é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬2é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (4)

glibcã«é–¢ã™ã‚‹trashsuiteã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

malloc(3)ã®ãƒ¡ãƒ¢ãƒªç®¡ç†æ§‹é€ ã€€VA Linux Systems Japan

__atexit in memory bugs

æœ€è¿‘ã®glibcã§ã¯atexité–¢æ•°ã‚„jmp_bufã‚’ç‹™ã£ãŸæ”»æ’ƒã¯åŠ¹ã‹ãªã„ (PTR_MANGLE) - memologue

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬3é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬2é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (4)

glibcã«é–¢ã™ã‚‹trashsuiteã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

malloc(3)ã®ãƒ¡ãƒ¢ãƒªç®¡ç†æ§‹é€ ã€€VA Linux Systems Japan

æœ€è¿‘ã®glibcã§ã¯atexité–¢æ•°ã‚„jmp_bufã‚’ç‹™ã£ãŸæ”»æ’ƒã¯åŠ¹ã‹ãªã„ (PTR_MANGLE) - memologue

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬3é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬2é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹