0x0c0c0c0c 03-08-2015, 05:40 AM
#1
Intro
Before I get started, I'd like to state that heap spraying is NOT heap exploitation/overflow. It is a technique for payload delivery. That being said, don't get the wrong idea. This isn't an exploitation tutorial.
What is heap spraying?
As mentioned above, heap spraying is a payload delivery technique. It places the payload in a predictable memory address in the heap so you can later jump or return to it. It's more than commonly used in browser exploitation because caching is a built-in feature of browsers. Why is the cache system important? When allocations occur to memory in the heap, the heap gets fragmented which is bad in terms of speed and efficiency. The caching system has a way of managing the heap by preventing fragmentation based on how big the allocated/freed memory is. Another reason why it's usually against browsers is because browsers have scripting support, allowing you to use javascript or vbscript to allocate something in memory. Heap spraying also used in java and adobe flash exploitation because they're also commonly built into browsers.
What makes heap spraying possible?
When multiple chunks of memory are allocated, the heap manager will attempt to minimize fragmentation and return as many adjacent blocks as possible. This is what is taken advantage of during a heap spray.
Basic Allocation
To allocate something into memory, you can (but aren't limited to) create a variable, for example:
That is basic allocation.
Anyways, I got lazy in the creation of this and decided to stop. Instead, enjoy this picture.
![[Image: l12ACUt.jpg]](http://i.imgur.com/l12ACUt.jpg)
Also, about the title "0x0c0c0c0c", 0x0c0c0c0c is just a commonly used NOP pattern in exploitation in the heap.
Before I get started, I'd like to state that heap spraying is NOT heap exploitation/overflow. It is a technique for payload delivery. That being said, don't get the wrong idea. This isn't an exploitation tutorial.
What is heap spraying?
As mentioned above, heap spraying is a payload delivery technique. It places the payload in a predictable memory address in the heap so you can later jump or return to it. It's more than commonly used in browser exploitation because caching is a built-in feature of browsers. Why is the cache system important? When allocations occur to memory in the heap, the heap gets fragmented which is bad in terms of speed and efficiency. The caching system has a way of managing the heap by preventing fragmentation based on how big the allocated/freed memory is. Another reason why it's usually against browsers is because browsers have scripting support, allowing you to use javascript or vbscript to allocate something in memory. Heap spraying also used in java and adobe flash exploitation because they're also commonly built into browsers.
What makes heap spraying possible?
When multiple chunks of memory are allocated, the heap manager will attempt to minimize fragmentation and return as many adjacent blocks as possible. This is what is taken advantage of during a heap spray.
Basic Allocation
To allocate something into memory, you can (but aren't limited to) create a variable, for example:
Code:
<html>
<body>
<script>
var mydong = "large";
</script>
</body>
</html>That is basic allocation.
Anyways, I got lazy in the creation of this and decided to stop. Instead, enjoy this picture.
Also, about the title "0x0c0c0c0c", 0x0c0c0c0c is just a commonly used NOP pattern in exploitation in the heap.
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
