转：NVidia Display Driver Service (Nsvr) Exploit - C
/* NVidia Display Driver Service (Nsvr) Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE ============================================================= (@peterwintrsmith) ** Initial release 25/12/12 ** Update 25/12/12 - Target for 30 Aug 2012 nvvsvc.exe Build - thanks @seanderegge! Hey all! Here is an interesting exploit for a stack buffer overflow in the NVidia Display Driver Service. The service listens on a named pipe (\pipe\nsvr) which has a NULL DACL configured, which should mean that any logged on user or remote user in a domain context (Windows firewall/file sharing permitting) should be able to exploit this vulnerability. The buffer overflow occurs as a result of a bad memmove operation, with the stack layout effectively......
阅读全文 →