{"id":477438,"date":"2023-08-09T09:14:50","date_gmt":"2023-08-09T09:14:50","guid":{"rendered":""},"modified":"2023-09-05T11:14:42","modified_gmt":"2023-09-05T11:14:42","slug":"heap-spray","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/heap-spray\/","title":{"rendered":"phun \u0111\u1ed1ng"},"content":{"rendered":"<p>Phun \u0111\u1ed1ng l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt \u0111\u01b0\u1ee3c tin t\u1eb7c s\u1eed d\u1ee5ng \u0111\u1ec3 t\u1ea1o \u0111i\u1ec1u ki\u1ec7n cho vi\u1ec7c th\u1ef1c thi m\u00e3 t\u00f9y \u00fd, th\u01b0\u1eddng l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c l\u1ed7 h\u1ed5ng ph\u1ea7n m\u1ec1m. N\u00f3 ho\u1ea1t \u0111\u1ed9ng b\u1eb1ng c\u00e1ch ph\u00e2n b\u1ed5 nhi\u1ec1u c\u1ea5u tr\u00fac d\u1eef li\u1ec7u \u201cheap\u201d ch\u1ee9a t\u1ea3i tr\u1ecdng \u0111\u1ed9c h\u1ea1i, do \u0111\u00f3 l\u00e0m t\u0103ng kh\u1ea3 n\u0103ng x\u1ea3y ra l\u1ed7 h\u1ed5ng tr\u00e0n b\u1ed9 \u0111\u1ec7m, ch\u1eb3ng h\u1ea1n, s\u1ebd d\u1eabn \u0111\u1ebfn vi\u1ec7c th\u1ef1c thi m\u00e3 c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng.<\/p>\n<h2>Ngu\u1ed3n g\u1ed1c c\u1ee7a Heap Spray v\u00e0 s\u1ef1 \u0111\u1ec1 c\u1eadp \u0111\u1ea7u ti\u00ean c\u1ee7a n\u00f3<\/h2>\n<p>Heap Spray nh\u01b0 m\u1ed9t k\u1ef9 thu\u1eadt khai th\u00e1c c\u00f3 ngu\u1ed3n g\u1ed1c t\u1eeb cu\u1ed1i nh\u1eefng n\u0103m 1990 v\u00e0 \u0111\u1ea7u nh\u1eefng n\u0103m 2000, khi Internet ng\u00e0y c\u00e0ng ph\u1ed5 bi\u1ebfn v\u00e0 an ninh m\u1ea1ng ch\u01b0a m\u1ea1nh m\u1ebd nh\u01b0 ng\u00e0y nay. \u0110\u1ec1 c\u1eadp ch\u00ednh \u0111\u1ea7u ti\u00ean c\u1ee7a n\u00f3 l\u00e0 t\u00e1c ph\u1ea9m c\u1ee7a hacker c\u00f3 \u0111\u1ea1o \u0111\u1ee9c v\u00e0 chuy\u00ean gia an ninh m\u1ea1ng SkyLined, ng\u01b0\u1eddi \u0111\u00e3 cung c\u1ea5p c\u00e1c m\u00f4 t\u1ea3 v\u00e0 v\u00ed d\u1ee5 to\u00e0n di\u1ec7n v\u1ec1 k\u1ef9 thu\u1eadt n\u00e0y. Nh\u1eefng hi\u1ec3u bi\u1ebft s\u00e2u s\u1eafc c\u1ee7a SkyLined \u0111\u00e3 gi\u00fap minh h\u1ecda m\u1ee9c \u0111\u1ed9 nghi\u00eam tr\u1ecdng c\u1ee7a vi\u1ec7c phun \u0111\u1ed1ng d\u1eef li\u1ec7u nh\u01b0 m\u1ed9t vect\u01a1 \u0111e d\u1ecda, d\u1eabn \u0111\u1ebfn nh\u1eefng n\u1ed7 l\u1ef1c gia t\u0103ng nh\u1eb1m gi\u1ea3m thi\u1ec3u t\u00e1c \u0111\u1ed9ng c\u1ee7a n\u00f3.<\/p>\n<h2>Heap Spray: Ki\u1ec3m tra chuy\u00ean s\u00e2u<\/h2>\n<p>Phun v\u00f9ng heap li\u00ean quan \u0111\u1ebfn vi\u1ec7c \u0111i\u1ec1n v\u00e0o v\u00f9ng heap \u2013 m\u1ed9t v\u00f9ng b\u1ed9 nh\u1edb c\u1ee7a m\u00e1y t\u00ednh \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 ph\u00e2n b\u1ed5 b\u1ed9 nh\u1edb \u0111\u1ed9ng \u2013 v\u1edbi c\u00e1c kh\u1ed1i d\u1eef li\u1ec7u ch\u1ee9a m\u1ed9t chu\u1ed7i byte c\u1ee5 th\u1ec3, th\u01b0\u1eddng \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 \u201cNOP sled\u201d ho\u1eb7c \u201cNOP slide\u201d. T\u1ea3i tr\u1ecdng th\u1ef1c t\u1ebf c\u1ee7a vi\u1ec7c khai th\u00e1c, th\u01b0\u1eddng l\u00e0 shellcode, \u0111\u01b0\u1ee3c \u0111\u1eb7t \u1edf cu\u1ed1i chu\u1ed7i n\u00e0y. S\u1ef1 s\u1eafp x\u1ebfp n\u00e0y v\u1ec1 c\u01a1 b\u1ea3n l\u00e0 \u201ch\u01b0\u1edbng d\u1eabn\u201d lu\u1ed3ng th\u1ef1c thi \u0111\u1ebfn t\u1ea3i tr\u1ecdng n\u1ebfu l\u1ed7 h\u1ed5ng cho ph\u00e9p \u0111i\u1ec1u khi\u1ec3n con tr\u1ecf l\u1ec7nh.<\/p>\n<p>Phun \u0111\u1ed1ng ch\u1ee7 y\u1ebfu \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ch\u1ed1ng l\u1ea1i c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh ph\u1ea7n m\u1ec1m c\u00f3 l\u1ed7i b\u1ed9 nh\u1edb, \u0111i\u1ec3n h\u00ecnh l\u00e0 l\u1ed7i tr\u00e0n b\u1ed9 \u0111\u1ec7m ho\u1eb7c l\u1ed7 h\u1ed5ng use-after-free. Nh\u1eefng l\u1ed7i n\u00e0y c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng ghi \u0111\u00e8 l\u00ean m\u1ed9t \u0111\u1ecba ch\u1ec9 b\u1ed9 nh\u1edb, n\u1ebfu thao t\u00e1c ch\u00ednh x\u00e1c, \u0111\u1ecba ch\u1ec9 n\u00e0y c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 h\u01b0\u1edbng vi\u1ec7c th\u1ef1c thi v\u00e0o v\u00f9ng nh\u1edb heap. Vi\u1ec7c phun v\u00f9ng heap gi\u00fap \u201cchu\u1ea9n b\u1ecb\u201d v\u00f9ng heap cho vi\u1ec7c n\u00e0y, khi\u1ebfn cho vi\u1ec7c th\u1ef1c thi \u0111\u01b0\u1ee3c chuy\u1ec3n h\u01b0\u1edbng c\u00f3 nhi\u1ec1u kh\u1ea3 n\u0103ng x\u1ea3y ra tr\u00ean payload c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng h\u01a1n.<\/p>\n<h2>C\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a Heap Spray: Ph\u00e2n t\u00edch k\u1ef9 thu\u1eadt<\/h2>\n<p>T\u00ednh n\u0103ng phun v\u00f9ng heap ho\u1ea1t \u0111\u1ed9ng b\u1eb1ng c\u00e1ch l\u00e0m tr\u00e0n v\u00f9ng heap b\u1eb1ng c\u00e1c b\u1ea3n sao c\u1ee7a chu\u1ed7i byte mong mu\u1ed1n. \u0110\u00e2y l\u00e0 m\u1ed9t tr\u00ecnh t\u1ef1 \u0111\u01a1n gi\u1ea3n c\u1ee7a th\u1ee7 t\u1ee5c:<\/p>\n<ol>\n<li>Qu\u00e1 tr\u00ecnh phun \u0111\u1ed1ng \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t, th\u01b0\u1eddng th\u00f4ng qua JavaScript trong m\u00f4i tr\u01b0\u1eddng web.<\/li>\n<li>Heap Spray \u0111\u01b0a v\u00e0o heap nhi\u1ec1u kh\u1ed1i b\u1ed9 nh\u1edb ch\u1ee9a d\u1eef li\u1ec7u c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng.<\/li>\n<li>D\u1eef li\u1ec7u b\u1ecb l\u00e2y nhi\u1ec5m \u0111\u01b0\u1ee3c c\u1ea5u tr\u00fac b\u1eb1ng m\u1ed9t NOP sled d\u1eabn \u0111\u1ebfn t\u1ea3i tr\u1ecdng khai th\u00e1c.<\/li>\n<li>N\u1ebfu c\u00f3 l\u1ed7i c\u00f3 th\u1ec3 khai th\u00e1c \u0111\u01b0\u1ee3c, qu\u00e1 tr\u00ecnh th\u1ef1c thi c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c chuy\u1ec3n h\u01b0\u1edbng \u0111\u1ebfn m\u1ed9t \u0111\u1ecba ch\u1ec9 b\u1ed9 nh\u1edb t\u00f9y \u00fd.<\/li>\n<li>V\u1edbi s\u1ef1 hi\u1ec7n di\u1ec7n r\u1ed9ng r\u00e3i c\u1ee7a d\u1eef li\u1ec7u b\u1ecb r\u1ea3i, c\u00f3 kh\u1ea3 n\u0103ng cao vi\u1ec7c chuy\u1ec3n h\u01b0\u1edbng n\u00e0y s\u1ebd d\u1eabn \u0111\u1ebfn t\u1ea3i tr\u1ecdng c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng.<\/li>\n<li>Sau \u0111\u00f3, t\u1ea3i tr\u1ecdng s\u1ebd \u0111\u01b0\u1ee3c th\u1ef1c thi, cung c\u1ea5p cho k\u1ebb t\u1ea5n c\u00f4ng k\u1ebft qu\u1ea3 mong mu\u1ed1n, th\u01b0\u1eddng l\u00e0 \u0111i\u1ec1u khi\u1ec3n h\u1ec7 th\u1ed1ng t\u1eeb xa.<\/li>\n<\/ol>\n<h2>C\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a Heap Spray<\/h2>\n<p>Phun \u0111\u1ed1ng \u0111\u01b0\u1ee3c \u0111\u1eb7c tr\u01b0ng b\u1edfi m\u1ed9t s\u1ed1 t\u00ednh n\u0103ng ch\u00ednh:<\/p>\n<ol>\n<li><strong>T\u0103ng t\u1ef7 l\u1ec7 t\u1ea5n c\u00f4ng th\u00e0nh c\u00f4ng:<\/strong> Phun \u0111\u1ed1ng l\u00e0m t\u0103ng c\u01a1 h\u1ed9i khai th\u00e1c th\u00e0nh c\u00f4ng l\u1ed7 h\u1ed5ng h\u1ecfng b\u1ed9 nh\u1edb.<\/li>\n<li><strong>Thao t\u00e1c b\u1ed9 nh\u1edb:<\/strong> N\u00f3 thao t\u00e1c tr\u1ea1ng th\u00e1i c\u1ee7a b\u1ed9 nh\u1edb ti\u1ebfn tr\u00ecnh \u0111\u1ec3 t\u1ea1o \u0111i\u1ec1u ki\u1ec7n cho vi\u1ec7c th\u1ef1c thi m\u00e3 t\u00f9y \u00fd.<\/li>\n<li><strong>C\u00f3 th\u1ec3 khai th\u00e1c trong nhi\u1ec1u m\u00f4i tr\u01b0\u1eddng kh\u00e1c nhau:<\/strong> Phun \u0111\u1ed1ng c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c tri\u1ec3n khai trong nhi\u1ec1u m\u00f4i tr\u01b0\u1eddng, ch\u1eb3ng h\u1ea1n nh\u01b0 tr\u00ecnh duy\u1ec7t web ho\u1eb7c \u1ee9ng d\u1ee5ng m\u00e1y ch\u1ee7.<\/li>\n<li><strong>Th\u01b0\u1eddng \u0111\u01b0\u1ee3c k\u1ebft h\u1ee3p v\u1edbi c\u00e1c c\u00e1ch khai th\u00e1c kh\u00e1c:<\/strong> Phun \u0111\u1ed1ng th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng k\u1ebft h\u1ee3p v\u1edbi c\u00e1c c\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng kh\u00e1c \u0111\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c k\u1ebft qu\u1ea3 mong mu\u1ed1n.<\/li>\n<\/ol>\n<h2>C\u00e1c lo\u1ea1i phun \u0111\u1ed1ng<\/h2>\n<p>K\u1ef9 thu\u1eadt phun \u0111\u1ed1ng c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c ph\u00e2n lo\u1ea1i d\u1ef1a tr\u00ean m\u00f4i tr\u01b0\u1eddng khai th\u00e1c v\u00e0 t\u00ednh ch\u1ea5t c\u1ee7a vi\u1ec7c ph\u00e2n ph\u1ed1i t\u1ea3i tr\u1ecdng.<\/p>\n<table>\n<thead>\n<tr>\n<th>Ki\u1ec3u<\/th>\n<th>S\u1ef1 mi\u00eau t\u1ea3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>X\u1ecbt \u0111\u1ed1ng JavaScript<\/td>\n<td>\u0110\u01b0\u1ee3c s\u1eed d\u1ee5ng trong c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng d\u1ef1a tr\u00ean web, JavaScript \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 l\u1ea5p \u0111\u1ea7y \u0111\u1ed1ng t\u1ea3i tr\u1ecdng \u0111\u1ed9c h\u1ea1i.<\/td>\n<\/tr>\n<tr>\n<td>X\u1ecbt \u0111\u1ed1ng flash<\/td>\n<td>S\u1eed d\u1ee5ng Adobe Flash \u0111\u1ec3 ti\u1ebfn h\u00e0nh phun, th\u01b0\u1eddng l\u00e0 trong m\u00f4i tr\u01b0\u1eddng web.<\/td>\n<\/tr>\n<tr>\n<td>X\u1ecbt \u0111\u1ed1ng Java<\/td>\n<td>S\u1eed d\u1ee5ng c\u00e1c \u1ee9ng d\u1ee5ng Java \u0111\u1ec3 t\u1ea5n c\u00f4ng, m\u1ed9t ph\u01b0\u01a1ng ph\u00e1p kh\u00e1c \u0111\u1ec3 t\u1ea5n c\u00f4ng d\u1ef1a tr\u00ean web.<\/td>\n<\/tr>\n<tr>\n<td>X\u1ecbt \u0111\u1ed1ng ch\u00ednh x\u00e1c<\/td>\n<td>Nh\u1eafm m\u1ee5c ti\u00eau c\u00e1c \u0111\u1ed1i t\u01b0\u1ee3ng c\u1ee5 th\u1ec3 trong v\u00f9ng heap, h\u1eefu \u00edch trong vi\u1ec7c khai th\u00e1c l\u1ea7n s\u1eed d\u1ee5ng sau.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u1ee8ng d\u1ee5ng, th\u00e1ch th\u1ee9c v\u00e0 gi\u1ea3i ph\u00e1p c\u1ee7a Heap Spray<\/h2>\n<p>Vi\u1ec7c phun \u0111\u1ed1ng ch\u1ee7 y\u1ebfu \u0111\u01b0\u1ee3c nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng trong th\u1ebf gi\u1edbi m\u1ea1ng s\u1eed d\u1ee5ng \u0111\u1ec3 khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng ph\u1ea7n m\u1ec1m. N\u00f3 \u0111\u00e3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng r\u1ed9ng r\u00e3i trong vi\u1ec7c t\u1ea1o ra ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i tinh vi v\u00e0 th\u1ef1c hi\u1ec7n c\u00e1c m\u1ed1i \u0111e d\u1ecda li\u00ean t\u1ee5c n\u00e2ng cao (APT).<\/p>\n<p>Th\u00e1ch th\u1ee9c ch\u00ednh c\u1ee7a vi\u1ec7c phun \u0111\u1ed1ng d\u1eef li\u1ec7u t\u1eeb g\u00f3c \u0111\u1ed9 b\u1ea3o m\u1eadt l\u00e0 vi\u1ec7c ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n n\u00f3. C\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt d\u1ef1a tr\u00ean ch\u1eef k\u00fd truy\u1ec1n th\u1ed1ng g\u1eb7p kh\u00f3 kh\u0103n trong vi\u1ec7c x\u00e1c \u0111\u1ecbnh c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng phun \u0111\u1ed1ng do t\u00ednh ch\u1ea5t linh ho\u1ea1t c\u1ee7a ch\u00fang. Do \u0111\u00f3, c\u00e1c gi\u1ea3i ph\u00e1p hi\u1ec7n \u0111\u1ea1i d\u1ef1a v\u00e0o vi\u1ec7c ph\u00e1t hi\u1ec7n d\u1ef1a tr\u00ean h\u00e0nh vi v\u00e0 s\u1eed d\u1ee5ng c\u00e1c k\u1ef9 thu\u1eadt gi\u1ea3m thi\u1ec3u khai th\u00e1c nh\u01b0 Ng\u1eabu nhi\u00ean b\u1ed1 c\u1ee5c kh\u00f4ng gian \u0111\u1ecba ch\u1ec9 (ASLR) v\u00e0 Ng\u0103n ch\u1eb7n th\u1ef1c thi d\u1eef li\u1ec7u (DEP).<\/p>\n<h2>So s\u00e1nh v\u00e0 \u0111\u1eb7c \u0111i\u1ec3m<\/h2>\n<p>So s\u00e1nh vi\u1ec7c phun \u0111\u1ed1ng v\u1edbi c\u00e1c k\u1ef9 thu\u1eadt t\u01b0\u01a1ng t\u1ef1 kh\u00e1c nh\u01b0 xoay v\u00f2ng ng\u0103n x\u1ebfp v\u00e0 l\u1eadp tr\u00ecnh h\u01b0\u1edbng tr\u1ea3 v\u1ec1 (ROP), phun \u0111\u1ed1ng n\u1ed5i b\u1eadt v\u00ec t\u00ednh \u0111\u01a1n gi\u1ea3n v\u00e0 t\u1ef7 l\u1ec7 th\u00e0nh c\u00f4ng cao. M\u1eb7c d\u00f9 m\u1ed7i k\u1ef9 thu\u1eadt n\u00e0y c\u00f3 nh\u1eefng \u0111\u1eb7c \u0111i\u1ec3m v\u00e0 tr\u01b0\u1eddng h\u1ee3p s\u1eed d\u1ee5ng ri\u00eang nh\u01b0ng ch\u00fang \u0111\u1ec1u l\u00e0 nh\u1eefng k\u1ef9 thu\u1eadt khai th\u00e1c l\u1ed7 h\u1ed5ng h\u1ecfng b\u1ed9 nh\u1edb \u0111\u1ec3 th\u1ef1c thi m\u00e3 t\u00f9y \u00fd.<\/p>\n<table>\n<thead>\n<tr>\n<th>K\u1ef9 thu\u1eadt<\/th>\n<th>\u0110\u1eb7c tr\u01b0ng<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>X\u1ecbt \u0111\u1ed1ng<\/td>\n<td>\u0110\u01a1n gi\u1ea3n, \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 t\u0103ng t\u1ef7 l\u1ec7 khai th\u00e1c l\u1ed7i b\u1ed9 nh\u1edb th\u00e0nh c\u00f4ng.<\/td>\n<\/tr>\n<tr>\n<td>Xoay v\u00f2ng ng\u0103n x\u1ebfp<\/td>\n<td>Ph\u1ee9c t\u1ea1p, chuy\u1ec3n h\u01b0\u1edbng con tr\u1ecf ng\u0103n x\u1ebfp \u0111\u1ebfn v\u1ecb tr\u00ed kh\u00e1c, th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng tr\u00e0n b\u1ed9 \u0111\u1ec7m.<\/td>\n<\/tr>\n<tr>\n<td>ROP<\/td>\n<td>Ph\u1ee9c t\u1ea1p, t\u1eadn d\u1ee5ng c\u00e1c \u0111o\u1ea1n m\u00e3 hi\u1ec7n c\u00f3 (\u201cti\u1ec7n \u00edch\u201d) trong b\u1ed9 nh\u1edb, b\u1ecf qua m\u1ed9t s\u1ed1 bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u khai th\u00e1c nh\u1ea5t \u0111\u1ecbnh.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Quan \u0111i\u1ec3m v\u00e0 c\u00f4ng ngh\u1ec7 t\u01b0\u01a1ng lai<\/h2>\n<p>Hi\u1ec7u qu\u1ea3 c\u1ee7a vi\u1ec7c phun \u0111\u1ed1ng \u0111\u00e3 gi\u1ea3m d\u1ea7n theo th\u1eddi gian khi tri\u1ec3n khai c\u00e1c k\u1ef9 thu\u1eadt ng\u0103n ch\u1eb7n th\u1ef1c thi v\u00e0 ng\u1eabu nhi\u00ean h\u00f3a b\u1ed9 nh\u1edb. Tuy nhi\u00ean, nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng ti\u1ebfp t\u1ee5c ph\u00e1t tri\u1ec3n c\u00e1c ph\u01b0\u01a1ng ph\u00e1p c\u1ee7a ch\u00fang, t\u1ea1o ra c\u00e1c k\u1ef9 thu\u1eadt phun \u0111\u1ed1ng ph\u1ee9c t\u1ea1p v\u00e0 ch\u00ednh x\u00e1c h\u01a1n \u0111\u1ec3 v\u01b0\u1ee3t qua c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o v\u1ec7 n\u00e0y. V\u00ed d\u1ee5: phun \u0111\u00fang l\u00fac (JIT) l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt \u0111\u01b0\u1ee3c ph\u00e1t tri\u1ec3n \u0111\u1ec3 v\u01b0\u1ee3t qua DEP b\u1eb1ng c\u00e1ch thao t\u00e1c m\u00e3 do JIT bi\u00ean d\u1ecbch trong b\u1ed9 nh\u1edb.<\/p>\n<h2>M\u00e1y ch\u1ee7 proxy v\u00e0 Heap Spray<\/h2>\n<p>C\u00e1c m\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c t\u1eadn d\u1ee5ng trong b\u1ed1i c\u1ea3nh m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng r\u1ea3i \u0111\u1ed1ng \u0111\u1ec3 che gi\u1ea5u ngu\u1ed3n g\u1ed1c c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng, khi\u1ebfn c\u00e1c nh\u00e0 \u0111i\u1ec1u tra kh\u00f3 truy t\u00ecm ngu\u1ed3n g\u1ed1c c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng h\u01a1n. M\u1eb7t kh\u00e1c, m\u00e1y ch\u1ee7 proxy an to\u00e0n c\u0169ng c\u00f3 th\u1ec3 ho\u1ea1t \u0111\u1ed9ng nh\u01b0 m\u1ed9t l\u1edbp ph\u00f2ng th\u1ee7, ch\u1eb7n l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp \u0111\u1ed9c h\u1ea1i \u0111\u00e3 bi\u1ebft ho\u1eb7c c\u00e1ch ly h\u1ec7 th\u1ed1ng m\u00e1y kh\u00e1ch kh\u1ecfi ti\u1ebfp x\u00fac tr\u1ef1c ti\u1ebfp v\u1edbi n\u1ed9i dung c\u00f3 h\u1ea1i.<\/p>\n<h2>Li\u00ean k\u1ebft li\u00ean quan<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.corelan.be\/index.php\/2011\/12\/31\/exploit-writing-tutorial-part-11-heap-spraying-demystified\/\" target=\"_new\" rel=\"noopener nofollow\">Nguy\u00ean t\u1eafc c\u01a1 b\u1ea3n v\u1ec1 phun \u0111\u1ed1ng<\/a><\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/security\/blog\/2020\/03\/09\/understanding-exploit-mitigations\/\" target=\"_new\" rel=\"noopener nofollow\">Hi\u1ec3u c\u00e1c bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u khai th\u00e1c<\/a><\/li>\n<li><a href=\"https:\/\/www.usenix.org\/system\/files\/login\/articles\/105484-Stearns.pdf\" target=\"_new\" rel=\"noopener nofollow\">C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng v\u00e0 ph\u00f2ng th\u1ee7 tham nh\u0169ng b\u1ed9 nh\u1edb<\/a><\/li>\n<li><a href=\"https:\/\/owasp.org\/www-community\/attacks\/Heap_spraying\" target=\"_new\" rel=\"noopener nofollow\">OWASP v\u1ec1 phun \u0111\u1ed1ng<\/a><\/li>\n<\/ul>","protected":false},"featured_media":468527,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477438","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Heap Spray: A Comprehensive Exploration<\/mark>","faq_items":[{"question":"What is Heap Spray?","answer":"<p>Heap Spray is an exploit technique used by hackers to increase the chances of executing arbitrary code in a software program. This is done by populating a large section of memory with malicious code, typically to exploit software vulnerabilities like buffer overflows or use-after-free errors.<\/p>"},{"question":"What is the history of Heap Spray?","answer":"<p>Heap spraying has its origins in the late 1990s and early 2000s. It was first prominently mentioned by the cybersecurity expert SkyLined, who provided comprehensive descriptions and examples of the technique.<\/p>"},{"question":"How does Heap Spray work?","answer":"<p>Heap spray works by filling a region of a computer's memory (the heap) with multiple blocks of memory containing the attacker's data. This increases the likelihood that a vulnerability will lead to the execution of the attacker's payload.<\/p>"},{"question":"What are the key features of Heap Spray?","answer":"<p>Heap spray's key features include increasing the success rate of attacks, manipulating memory, being exploitable in various environments, and often being paired with other exploits.<\/p>"},{"question":"What types of Heap Spray exist?","answer":"<p>Heap spray techniques vary based on the exploitation environment and the nature of the payload delivery. They include JavaScript Heap Spray, Flash Heap Spray, Java Heap Spray, and Precision Heap Spray.<\/p>"},{"question":"How is Heap Spray used and what problems does it present?","answer":"<p>Heap spraying is primarily used by attackers to exploit software vulnerabilities. The main challenge from a security perspective is its detection and prevention. Modern solutions rely on behavior-based detection and exploit mitigation techniques like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP).<\/p>"},{"question":"How does Heap Spray compare to other similar techniques?","answer":"<p>Compared to techniques like stack pivoting and return-oriented programming (ROP), heap spraying stands out for its simplicity and high success rate. However, all these techniques aim to exploit memory corruption vulnerabilities to execute arbitrary code.<\/p>"},{"question":"What is the future of Heap Spray?","answer":"<p>The effectiveness of heap spray is being reduced over time with the implementation of memory randomization and execution prevention techniques. However, attackers continue to evolve their methods, creating more sophisticated heap spray techniques to bypass these protections.<\/p>"},{"question":"What is the relationship between proxy servers and Heap Spray?","answer":"<p>Proxy servers can be used in the context of a heap spray attack to mask the origin of the attack, making it harder for investigators to trace it back. On the other hand, secure proxy servers can also serve as a layer of defense, blocking known malicious traffic or isolating client systems from potentially harmful content.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477438\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media\/468527"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media?parent=477438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}