Exploit Potential?

[hypnotoad]

I have just found a persistent, reproducible, bug for a chat client on Windows 7 starter that causes a BSoD every time.

I don't know anything about exploit development, so i have a question.

How should I go about exploring the potential of turning this into an exploit, and if there is, how does one create an exploit.

[digip]

I have just found a persistent, reproducible, bug for a chat client on Windows 7 starter that causes a BSoD every time.

I don't know anything about exploit development, so i have a question.

How should I go about exploring the potential of turning this into an exploit, and if there is, how does one create an exploit.

Well, the BSOD should give you an indication into what file it has a problem with, usually a driver, so that would be your starting point. I know shit about this stuff, but what I do know is that you should look into "fuzzing" and debugging the program to find places in memory to add exploit code. Offensive Security offers courses on this sort of thing and Mati is the guy you would want to learn from as he writes a lot of shell code and does egg hunting for exploits.

http://www.offensive-security.com/

Watch this video: http://www.offensive-security.com/videos/d..._controller.swf

[H@L0_F00]

I don't think fuzzing will be necessary since the bug is reproduceable already

[mubix]

Here is a quick link to some tutorials on how to progress:

http://www.room362.com/mubixlinks/2009/12/...g-tutorial.html

[hypnotoad]

thanks guys.

Any recommendations on a good fuzzing utility for win 7. Or is it something I would be better of doing by hand?

What would be the pro's/con's of each?

[dr0p]

Well since you already got it to crash, fuzzing isn't necessary. Attach Olly or another debugger to whatever it is that's crashing and see what actually goes down...

[H@L0_F00]

You need to debug the crash and see if any arbitrary code can be run from it.

[hypnotoad]

Thanks for all the info guys, I'm going to play with this a lot more to see what I can come up with. I have found no reference to this bug on the dev's website, so.... if I manage to turn this into an exploit... would it be 0day? coz that would be cool :P

[dr0p]

Thanks for all the info guys, I'm going to play with this a lot more to see what I can come up with. I have found no reference to this bug on the dev's website, so.... if I manage to turn this into an exploit... would it be 0day? coz that would be cool :P

Yup, it would be a 0day.