Other nomination
Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine
Turns an output-less PHP file-read into remote code execution using a one-byte glibc iconv overflow. Heap grooming through php filters overwrites a stream bucket so its buffer points anywhere, giving a crashless arbitrary read via an error oracle; the exploit then walks ELF tables to reach system and overwrites the engine's heap free handler.
Record
- Published by
- blog.lexfo.fr
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of blog.lexfo.fr, first published at the original source. Preserved copies are kept so the citation survives its host.