rip1s / vmware_escape Goto Github PK

Hi. First, thanks for your post. I have learning exploitation from your code.
In your code, There are heap spray code with size of 0xA0, 0x90, 0xA8.
The target object(DnD or CP) size is 0xA8, so I think it's sufficient with just spraying chunk size of 0xA8.
Maybe I'm lacking something. Is there any reason that you made chunk size of 0xA0 and 0x90 ?
Thanks for your code and wiki.

First of all - great repo! Thanks for sharing.
About the stability issue - you exploited the vulnerability in the DND/CopyPaste mechanism, right? you have corruption in the memcpy in DnDCPMsgV4_UnserializeMultiple(), due to the flawed check in DnDCPMsgV4IsPacketValid(). The issue is that the LFH allocations in the userblocks are randomized, since win8 drop the FreeEntryOffset. But - you have alloc and free primitives. Why not using the randomization vulnerability, and do something like that - https://github.com/saaramar/Deterministic_LFH ?
(It would work until build 16179, but still, that would be pretty cool, isn't it? :) )
Thanks!

hello, thank you for this post which helps me a lot in learning software security.
As a beginner, I have been thinking about how you can achieve the function symbols. I loaded it into winBDG and IDA but not found any symbols. Neither could I found any pdb files any where.
So, I try to explain it in three different way:

1. you compiled vmware from source code, so that can get symbols. (I view the source code that offered by vmware.com, :( but all separated tgz file)
2. you found some symbol file anyhow.
3. there is indeed symbols in the vmware.exe, I just didn't do it right.

Just some confusions when I try to analyzing the processing of this POC. I would appreciate if someone can show me the way.

访问一下你