straightblast/My-PoC-Exploits

Crash on Client 16 - 14320388

Opened this issue · 8 comments

meirtolpin11 commented

Hi,
so I am trying to run the PoC against build 14320388, but every time it crashes on this part -

 requests[14].put(close())

 requests[15].put(connect())

 requests[15].put(attribute_request(b'service:pwn', 0x20))

 requests[13].put(block(0x110))

 requests[16].put(connect())

 requests[17].put(connect())

Any Ideas why ? I tried to play with the timer, set it 1,5,8,10, but nothing helps. Everytime the same error :(
image

Any ideas?

straightblast commented
meirtolpin11 commented

Hi,

I just removed the threading, and tried to exploit it again -
image

Still crashing on SLP client 16 connect.
After the step of attribute_request of client 15 it's sending the 13's block and crashing.

meirtolpin11 commented

played a bit with a debugger - crashing when 15 is sending attribute_request(b'service:pwn', 0x20)

straightblast commented
meirtolpin11 commented

I already removed threading.
it's running exactly like the order in the exploit function.

slpclients[11].run(connect())
slpclients[12].run(connect())
slpclients[13].run(connect())
slpclients[11].run(block(0x810))
slpclients[14].run(connect())
slpclients[14].run(block(0x160))
slpclients[12].run(block(0x810))
slpclients[14].run(close())
slpclients[15].run(connect())
slpclients[15].run(attribute_request(b'service:pwn', 0x20))
slpclients[13].run(block(0x110))
slpclients[16].run(connect())
slpclients[17].run(connect())
slpclients[12].run(close())
slpclients[18].run(connect())

this is the code part, the order in the code is the same as in the terminal output. And the after every client's request there is the same client's recv (and only then the next client).

straightblast commented
meirtolpin11 commented

Yes it's really the problem.
When I run the slpd manually it's working perfect, but when its starting up by the os - the heap grooming not working.
you have any idea how to bypass this issue?

straightblast commented