FUZZING.IN
- A vm having vulnerable Windows 2012 server installation. it has DHCP server installed. i was using it for some other purpose but then this came in handy as i didn't need to do anything to configure the environment.
- A vm having windows 7, from where i used to run POC code. i have coded my own poc based up on analysis done by https://t.co/qc1ZClWiTd
- first it allocated heap:
2. After that it calls the memcpy:
if you notice here, r15 has the address of memory location where first tag data is saved and rcx has the length of first tag. then rcx is added to r15 i.e. r15 will contain the address of end of first data + 1 memory location.
but as you can see in image one, total memory allocated is of 0xa bytes only.
3. program then calls memcpy and tries to copy data from second tag but since the memory is only of 0xa bytes and therefore we get the error (if page heap is enabled, you should be able to get this error in first try, otherwise you need to keep sending malicious packet multiple times):
4. in the fix they added check if calculated length is less then mentioned length then program terminates:
Thanks,
Hardik