AOH :: HP Unsorted G :: BU-1485.HTM

GDT and LDT in Windows kernel vulnerability exploitation (paper)



GDT and LDT in Windows kernel vulnerability exploitation (paper)
GDT and LDT in Windows kernel vulnerability exploitation (paper)



Hi,

We've published a paper about using 1 or 4 byte write-what-where
condition to convert a custom Data-Segment Descriptor entry in LDT of
a process into a Call-Gate (with DPL set to 3 and RPL to 0).
The paper also contains information about a possible LDT redirecting
into user-land memory.

The paper is Windows NT family (starting from Windows 2000 and XP) and
x86 protected mode specific.

The paper DOES NOT contain information about new or old
vulnerabilities. It only proposes a way to convert a potential
write-what-where vulnerability into code execution, in a stable
manner.

http://vexillium.org/dl.php?call_gate_exploitation.pdf 

More information is available on our blogs:
http://gynvael.coldwind.pl/?id=274 
http://j00ru.vexillium.org/?p=290&lang=en 

Comments are welcomed :)

Take care,
-- 
gynvael.coldwind//vx and j00ru//vx

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.