2

I have found a vulnerability that write access-violation to a non-null address, but I don't know how exploit.

I know that fault, is when pass to vulnerable function a value greater than 80000001, the crash occurs.

But my problem, I only know typical buffer stack overflow, and need learn how exploit this, and knowing what is vulnerability (heap, format string, integer overflow, etc).

I am confused because only crash when is 800000001 (negative), not with 80000000 or 80000002. With this response:

Exploitability Classification: EXPLOITABLE
    Recommended Bug Title: Exploitable - User Mode Write AV starting at myfunction!mycomponet+0x0000000000018204 (Hash=0xad0842a8.0x0as0d4ca)

User mode write access violations that are not near NULL are exploitable.

What vulnerability is and how exploit ? Any suggestion or recommended lecture ?

Improve this question

1 Answer 1

Reset to default
1

Sorry this should be a comment but dont have enough reputation.

This is too vague for people to help you. Do you have the disassembly around the crash? It only crashes when what is 8000000001? That makes it sound like potentially an integer overflow. Where is it writing? Can you control the address that its writing to? Do you have control of what is being written?

Improve this answer
9
  • Hi, thanks for your help, the problem is this, only crash when put 80000001, I don't see overwrite registers, only ebx = 80000000, but no 80000001. but don't fail with 8000002. I cant control address or data, or don't see at this moment ;-).
    – spider-45
    Jan 24, 2014 at 20:36
  • If you cant control either, then this bug wont lead to code execution and only a denial of service.
    – jbh
    Jan 24, 2014 at 20:54
  • But the exploitable msg?? a "dos" never is exploitable, only a "dos", but the problem it this, only crash when a specific value, I don't know how exploit this. Thanks for you advice.
    – spider-45
    Jan 24, 2014 at 21:36
  • Exploitable doesn't always mean code execution. DoS is an "exploit"... just not the ones most people want. If you cant control what is being written or where its getting written in some way in order to gain execution, then the vulnerability is only a DoS
    – jbh
    Jan 24, 2014 at 21:52
  • hi again, thanks for the clarification, but I have got a lot of crash, 30, 10 no exploitable, and 20 unknown, only one exploitable, all other crash are (dos??),, . I thought that the "dos" are not considered exploitable by that. I do not know if you can understand me. Regards
    – spider-45
    Jan 24, 2014 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.