tl;dr - fuzzy is a "super secure parsing engine", that includes a histogram function. The histogram ascii text uses a buffer on the stack, but will increment
buckets past the end of the buffer if non ascii text is provided, allowing us to
rop. Binary and exploit available here.
Cross …
Recent articles
Ghost in the Shellcode 2014 -
read moreGhost in the Shellcode 2014 -
gitsmsgread moretl;dr -
gitsmsgis a messaging server. A heap overflow led to arbitrary read / write and eventual code exec after circumventing RELRO. Binary and exploit available here. Cross post from PPP blog.The program
First, we reverse engineered much of the binary. You "login" as a user, then can compose …