MS08-067 Utilization Technology

Yuan Ge

This vulnerability has never seen very stable code. in fact, to be stable, there must be two fixed x5cx00 In the heap. The solution is to control the length variable which is just 0x005c, And to buffer the pointer with a 0x005c. after analyzing the memory allocation, it is clear that the large memory allocation requires re-applying for a virtual page, so that we can control the two lower bytes of the memory pointer, which can meet the needs of 0x005c.

The other details are the identification of patching, the identification of windows versions, and the overflow path, which can truly attack all rpc interfaces and interfaces that are not rpc interfaces.