CNIT 127 Ch 5: Introduction to heap overflows
0 likes158 views
This document discusses heap overflows and exploit development. It explains that the heap is an area of memory used to dynamically allocate data at runtime using functions like malloc() and free(). While the stack stores return addresses that can be controlled in a buffer overflow, the heap does not directly store EIP. However, it contains pointers that are written to when freeing memory chunks, which can be exploited if a chunk overflow is used to control those writes and modify arbitrary memory locations. Potential targets include return addresses on the stack, the global offset table, destructors table, and function pointers.
CNIT 127 Ch 5: Introduction to heap overflows
- 1. CNIT 127: Exploit Development Ch 5: Introduction to Heap Overflows Updated 3-14-21
- 2. What is a Heap?
- 3. Memory Map • In gdb, the "info proc map" command shows how memory is used • Programs have a stack, one or more heaps, and other segments • malloc() allocates space on the heap • free() frees the space
- 5. Heap Structure Size of previous chunk Size of this chunk Pointer to next chunk Pointer to previous chunk Data Size of previous chunk Size of this chunk Pointer to next chunk Pointer to previous chunk Data Size of previous chunk Size of this chunk Pointer to next chunk Pointer to previous chunk Data
- 6. A Simple Example (Proj ED 205)
- 8. Viewing the Heap in gdb
- 10. Crash in gdb
- 11. Targeted Exploit
- 12. The Problem With the Heap
- 13. EIP is Hard to Control • The Stack contains stored EIP values • The Heap usually does not • However, it has addresses that are used for writes – To fill in heap data – To rearrange chunks when free() is called
- 14. Action of Free() • Must write to the forward and reverse pointers • If we can overflow a chunk, we can control those writes • Write to arbitrary RAM – Image from mathyvanhoef.com, link Ch 5b
- 15. Target RAM Options • Saved return address on the Stack – Like the Buffer Overflows we did previously • Global Offset Table – Used to find shared library functions • Destructors table (DTORS) – Called when a program exits • C Library Hooks
- 16. Target RAM Options • "atexit" structure (link Ch 4n) • Any function pointer • In Windows, the default unhandled exception handler is easy to find and exploit