16 lines
No EOL
685 B
Text
16 lines
No EOL
685 B
Text
# tiffsplit (libtiff <= 3.8.2) local stack buffer overflow PoC
|
|
|
|
tiffsplit from libtiff (http://www.remotesensing.org/libtiff/)
|
|
is vulnerable to a bss-based and stack-based overflow, but, I just
|
|
wrote the concept c0de for stack-based b0f 'cause I don't know how
|
|
to take advantage of the overwritten bss data (after the overflow,
|
|
that data is overwritten again correctly by a program' function).
|
|
|
|
.bss section is in higher addresses than .dtors section, so, we
|
|
can't hijack .dtors to....
|
|
|
|
PoC: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/1831.tar.gz (05262006-tiffspl33t.tar.gz)
|
|
|
|
nitr0us <nitrousenador[at]gmail[dot]com>
|
|
|
|
# milw0rm.com [2006-05-26] |