I recently acquired an exploit for an image viewer program and started analyzing.Specific details cannot be given, but basically it is a SEH overwrite exploit using malicious image file. Using immunity dbg, I saw that SEH being overwritten by 38 4c 5c 36. But dbg fails to execute that memory address. Exploit executes calc just fine, but by attaching a debugger to the viewer program, it hangs trying to execute 38 4c 5c 36.I tried to jump to that address but dbg says it is a unspecified address. I have a few questions about this memory addresswhat kind of data is loaded in memory address near 38 4c 5c 36 ? (looking at the memory map it is between loaded dll files and nothing is loaded it seems)is 38 4c 5c 36 where the exploit is loaded in the memory or am I making a wrong guess?If it is where exploit is loaded, what should I do to further analyze using a debugger?Thank you in advance :)
Need help analyzing an image viewer exploit
exploit;seh
Standard exploitation of SEH based BoF will try to point the SE Handler to a POP/POP/RET instruction. This is not always the case depending on enabled memory protections. (use Mona plugin for Immunity to check this using the command !mona mod, or simply inspect the vulnerable binary characteristics)If your SE Handler is pointing to 0x384c5c36, you should put a break point at that address and hit Shift+F9 to continue execution up to your breakpoint.The rest will greatly vary on the nature of the exploit and the kind of limitations it has to bypass. As it an image viewer, I doubt the exploit will use any techniques like heap spraying as it can execute any code that will spray the heap, like JavaScript, but you never know.For more information on SEH based overflows, I would strongly recommend the Corelan Tutorial.