Learn, hack!

URL

https://media.blackhat.com/bh-us-10/whitepapers/Shelton/BlackHat-USA-2010-Shelton-IBM-AIX-Heap-Overflow-Methods-wp.pdf

File name

BlackHat-USA-2010-Shelton-IBM-AIX-Heap-Overflow-Methods-wp.pdf

File size

130.9 KB

MD5

30c4a6b68ce0357214cb167f469b39b8

SHA1

f24654add07a15db70caead1023fa93e9f6b81cd

With the ever increasing importance of providing and maintaining reliable services for both infrastructure support as well as business continuity, companies rely upon the IBM AIX operating system. In most cases, these machines hold the most critical data available for their business which makes IBM AIX a highly valued target from a hacker’s perspective. Over the past decade, hackers have increasingly focused on infiltrating valuable data such as proprietary databases, credit information, product pricing information and more. As such, the importance of protecting the IBM AIX operating system should be priority one. Initial heap exploitation research was first documented and published by David Litchfield, in August of 2005. His paper entitled, ”An Introduction to Heap overflows on AIX 5.3L” focused on AIX heap abuse within the utilization of heap’s free()/rightmost() functions. While Litchfield’s method solves one scenario, there is an additional scenario that has been left out. So what is the difference between the leftmost call versus rightmost? A stack trace will show leftmost is utilized when a fresh heap segment is requested, while rightmost is utilized when the application requests the heap to remove a previously allocated chunk from memory.