Re: odd exploitation question

[Alexander Sotirov <asotirov () determina com>]

Jeremy Kelley wrote:
> I'm a little stumped writing an exploit for an ActiveX object and so I
> figured I'd pester this list for a bit of help.
>
> My exploit works flawlessy when attached to the process in the
> debugger.  Doesn't exec calc.exe when run w/o a debugger.

I don't have an answer, but I have a shellcode debugging hint:

First you need to find out if the program if crashing in your shellcode, or
before it. Put a JMP instruction that jumps to itself (\xEB\xFE)in the beginning
of the shellcode. If your exploit causes IE to consume 100% CPU, you'll know
that the execution reached the shellcode. If IE crashes, you have a problem
before the shellcode.

I can't think of a reason for the different behavior if you are attaching the
debugger after the application is already running.

Good luck,
Alex
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave