HFS Heap Overflow - Revision history

5urd at 21:25, 31 January 2013

2013-01-31T21:25:12Z

IAdam1n: /* References */ Stub fix.

2013-01-31T20:29:31Z

‎References: Stub fix.

5urd at 21:27, 24 December 2012

2012-12-24T21:27:56Z

JonathanSeals: /* References */

2012-02-10T08:08:26Z

‎References

Http: initial page

2012-01-18T10:48:32Z

initial page

New page

By fuzzing the HFS btree parser, a heap overflow in the zone allocator was found.
Mounting a clean, overflowed and payload images in a Heap Feng Shui way worked.
The kernel heap overflow exploit copies 0x200 bytes from the vnimage.payload file to the kernel sysent, replacing a syscall to a write anywhere gadget. Some syscalls (first 0xA0 bytes and the last 6 bytes) are trashed in the operation because the HFS protocol needed to be respected.
So these bytes are restored as fast as possible to get a stable exploit, then the write anywhere is used to copy the kernel exploit and jump to it.
The kernel exploit just patches the kernel security features, as usual.

==Credit==
*[[pod2g]] for finding the vulnerability and writing the exploit
*[[i0n1c]] for his papers on Heap Feng Shui

==References==
*[http://pod2g-ios.blogspot.com/2012/01/details-on-corona.html pod2g's blog]
*ionic's Heap Feng Shui paper (can't find link right now)
*[https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/ All about Heap Spraying]

{{stub}}
[[Category:Exploits]]

@@ Line 14: / Line 14: @@
 *[https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/ All about Heap Spraying]
-{{stub|Exploit}}
+{{stub|exploit}}
 [[Category:Exploits]]

@@ Line 14: / Line 14: @@
 *[https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/ All about Heap Spraying]
-{{stub|exploits}}
+{{stub|Exploit}}
 [[Category:Exploits]]

@@ Line 11: / Line 11: @@
 ==References==
 *[http://pod2g-ios.blogspot.com/2012/01/details-on-corona.html pod2g's blog]
 *[https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/ All about Heap Spraying]