Services Vulnerabilities Exploits Publications News Blog About DSecRG


Writing JIT-Spray Shellcode for fun and profit

Writing JIT-Spray Shellcode for fun and profit In this text we describe how to write a shellcode for new JIT-Spray attacks and make universal STAGE 0 shellcode that gives control to any common shellcode from MetaSploit, for example.

Author: Alexey Sintsov

Attacks on clients’ browsers have always been the real threat for everyone. And here vulnerabilities have been not only in the browser but also in plug-ins. Bank-clients, business software, antivirus software – all of them use ActiveX (for IE) for clients and here have been and are still many vulnerabilities. Vendors make steps to defend us from it. Software vendors patch vulnerabilities and OS vendors use new mechanisms to prevent attacks at all. But security researchers are trying to find way to bypass these mechanisms. The new versions of browsers (Internet Explorer 8 and FireFox 3.5) use permanent DEP. And the new versions of OS use the ASLR mechanism. All this makes the old methods of attacks impossible. But on BlackHat DC 2010 the interesting way to bypass DEP and ASLR in browsers (not only) and Just-In-Time compilers was presented. This method is called JIT-SPRAY. But here was no one public PoC untill now.

Writing JIT-Spray Shellcode for fun and profit.pdf, 465 KB

Publications RSS RSS
06.06.2012
Presentation "Light and Dark side of Code Instrumentation" from CONFidence Krakow 2012

26.04.2012
Whitepaper "Python arsenal for Reverse Engineering" version 1.1

12.08.2011
Whitepaper "Architecture and program vulnerabilities in SAP’s J2EE engine" from BlackHat USA 2011

06.07.2011
Whitepaper "Python arsenal for Reverse Engineering" version 1.0

Publications list


© 2002—2014, ERPScan
For quoting or using materials from this site
link is obligatory

+44 (20) 81334493    e-mail: research@dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary
Search