{"id":3530,"date":"2010-03-27T13:28:49","date_gmt":"2010-03-27T12:28:49","guid":{"rendered":"http:\/\/www.corelan.be:8800\/?p=3530"},"modified":"2010-03-27T13:28:49","modified_gmt":"2010-03-27T12:28:49","slug":"exploiting-ken-ward-zipper-taking-advantage-of-payload-conversion","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2010\/03\/27\/exploiting-ken-ward-zipper-taking-advantage-of-payload-conversion\/","title":{"rendered":"Exploiting Ken Ward Zipper : Taking advantage of payload conversion"},"content":{"rendered":"

In the article I wrote on the abysssec.com<\/a> website, I explained the steps and techniques needed to build a working exploit for Ken Ward's zipper.<\/p>\n

One of the main difficulties I had to overcome when building the exploit, was the character set limitation.  I basically could only use a subset of the ascii characters (only the characters that are allowed in a filename) in my payload, because the other characters got converted to something else. And that may either break the exploit structure or change the behaviour of the payload inside the application.<\/p>\n

As a result of that, I simply tried to avoid using those "bad chars" altogether and found some ways to make it work, using chained jumps, custom ascii decoders and alpha2-encoded code. Lot's of complexity, but nevertheless it works fine.<\/p>\n

Today, I will explain an alternative way to approach character set limitations, and perhaps take advantage of the behaviour of the character set conversion process to make the exploit less complex.  Basically, I'll try to use the conversion as a benefit instead of a problem.<\/p>\n

2 of my friends from Corelan Team (TecR0c and mr_me) pointed out that we can take advantage of this, and TecR0c documented the result of the conversion process.  You can find his table here.  Shortly after, my friend _sinn3r (also from Corelan Team) applied this technique to write an exploit<\/a> for the Ken Ward vulnerability.<\/p>\n

So I guess this is a good time to throw my 2 cents in as well, and look at how we can document the conversion process and what we can do with this.<\/p>\n

\n

Important : Before reading this post, I would strongly suggest you to read the article on the abysssec.com blog.  If you don't read that article, it will be impossibe for you to understand certain concepts, assumptions and decisions in this post.<\/p>\n<\/blockquote>\n

Summarizing the abysssec.com article, we know that<\/p>\n