[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Another new technique to bypass SEHOP. ( no 'xor pop pop ret' )

Lately, MS Windows SEH overflow attack technique only uses the methods.

[mostly used method]
win xp sp2(SEH): 'pop pop ret' - David Litchfield 2003.
win xp sp3(SafeSEH): unloaded module's 'pop pop ret' - Litchfield 2003.
win server 2008/Vista sp1(SEHOP): SYSDREAM(c)'s 'xor pop pop ret'.

[my new method to exploit SEHOP]
I researched SEH and any reference I found a way to exploit SafeSEH+SEHOP protections all at once.
below is the presentation PDF. :-)

Presentation URL:

 David Litchfield's 2003 presentation introduced similar method with my technique which using allowed _except_handler3. but it was applied SafeSEH only. and having a difference to my technique.

Thnak you lists.