I'm the one who wrote this.I originally tried submitting it here myself but without much luck so glad to see someone else shared it! Thanks for bringing it here.
also if anyone has another working PoC for that specific build I'd really appreciate if they could share it because looking at how the exploit works it does something that is not done on any other solution that i found for other builds, none of them hold the spot with a resize (key “1050” is sent twice) than make an intermediate buffer from the next field("1999") fall there.it’s the only approach I’ve seen that uses a repeated key like that.
I wonder whether there's a more direct way to achieve that as in the solutions for other builds. If there is, I think it would be interesting to compare the reliability of the different approaches based on the memory manipulation itself rather than how they reach the target
I'm the one who wrote this.I originally tried submitting it here myself but without much luck so glad to see someone else shared it! Thanks for bringing it here.
also if anyone has another working PoC for that specific build I'd really appreciate if they could share it because looking at how the exploit works it does something that is not done on any other solution that i found for other builds, none of them hold the spot with a resize (key “1050” is sent twice) than make an intermediate buffer from the next field("1999") fall there.it’s the only approach I’ve seen that uses a repeated key like that.
I wonder whether there's a more direct way to achieve that as in the solutions for other builds. If there is, I think it would be interesting to compare the reliability of the different approaches based on the memory manipulation itself rather than how they reach the target