3 ms·
The exploited is detailed here: http://seclists.org/fulldisclosure/2010/Jan/341 http://seclists.org/fulldisclosure/2010/Jan/341 My favorite part comes at the
by mckilljoy 17y ago
The exploited is detailed here:
http://seclists.org/fulldisclosure/2010/Jan/341 http://seclists.org/fulldisclosure/2010/Jan/341
My favorite part comes at the end. The last step involves predicting where a specific BIOS handler lies in memory. It is a static address in all pre-Vista OS.
Starting in Vista, Windows introduced address space layout randomization to make hacks like this more difficult.
However:
"Unfortunately, this potentially useful exploit mitigation is trivial to defeat locally as unprivileged users can simply query the loaded module list via NtQuerySystemInformation()."
Whoops.