{"id":477439,"date":"2023-08-09T09:14:50","date_gmt":"2023-08-09T09:14:50","guid":{"rendered":""},"modified":"2023-09-05T11:14:42","modified_gmt":"2023-09-05T11:14:42","slug":"heap-spraying","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/heap-spraying\/","title":{"rendered":"phun \u0111\u1ed1ng"},"content":{"rendered":"<p>Heap Spraying l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt \u0111\u01b0\u1ee3c c\u00f4ng nh\u1eadn r\u1ed9ng r\u00e3i v\u00e0 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong th\u1ebf gi\u1edbi khai th\u00e1c m\u00e1y t\u00ednh. N\u00f3 ch\u1ee7 y\u1ebfu li\u00ean quan \u0111\u1ebfn vi\u1ec7c l\u00e0m ng\u1eadp m\u1ed9t v\u00f9ng b\u1ed9 nh\u1edb heap c\u1ee7a ti\u1ebfn tr\u00ecnh b\u1eb1ng shellcode \u0111\u1ec3 t\u0103ng kh\u1ea3 n\u0103ng th\u1ef1c thi m\u00e3 t\u00f9y \u00fd khi c\u00e1c l\u1ed7 h\u1ed5ng, nh\u01b0 l\u1ed7i tr\u00e0n b\u1ed9 \u0111\u1ec7m, b\u1ecb khai th\u00e1c.<\/p>\n<h2>L\u1ecbch s\u1eed phun \u0111\u1ed1ng v\u00e0 s\u1ef1 \u0111\u1ec1 c\u1eadp \u0111\u1ea7u ti\u00ean c\u1ee7a n\u00f3<\/h2>\n<p>Phun \u0111\u1ed1ng l\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u01b0\u1ee3c c\u00f4ng ch\u00fang ch\u00fa \u00fd trong m\u1ed9t b\u00e0i b\u00e1o v\u1ec1 an ninh do Matt Conover v\u00e0 Oded Horovitz vi\u1ebft, c\u00f3 t\u1ef1a \u0111\u1ec1 \u201cPhun \u0111\u1ed1ng: K\u1ef9 thu\u1eadt ch\u1ed1ng l\u1ea1i c\u00e1c bi\u1ec7n ph\u00e1p an ninh chung\u201d \u0111\u01b0\u1ee3c xu\u1ea5t b\u1ea3n v\u00e0o \u0111\u1ea7u nh\u1eefng n\u0103m 2000. S\u1ef1 ra \u0111\u1eddi c\u1ee7a n\u00f3 \u0111\u01b0\u1ee3c th\u00fac \u0111\u1ea9y b\u1edfi vi\u1ec7c tri\u1ec3n khai ng\u00e0y c\u00e0ng nhi\u1ec1u c\u00e1c c\u01a1 ch\u1ebf b\u1ea3o m\u1eadt \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 ng\u1eabu nhi\u00ean h\u00f3a kh\u00f4ng gian \u0111\u1ecba ch\u1ec9 c\u1ee7a m\u1ed9t quy tr\u00ecnh \u0111ang ch\u1ea1y, do \u0111\u00f3 khi\u1ebfn k\u1ebb t\u1ea5n c\u00f4ng kh\u00f3 d\u1ef1 \u0111o\u00e1n v\u1ecb tr\u00ed shellcode c\u1ee7a ch\u00fang s\u1ebd n\u1eb1m trong b\u1ed9 nh\u1edb.<\/p>\n<h2>M\u1edf r\u1ed9ng ch\u1ee7 \u0111\u1ec1: Phun \u0111\u1ed1ng<\/h2>\n<p>Phun \u0111\u1ed1ng ch\u1ee7 y\u1ebfu \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng h\u1ecfng b\u1ed9 nh\u1edb. M\u1ee5c \u0111\u00edch c\u1ee7a n\u00f3 l\u00e0 thao t\u00fang \u0111\u1ed1ng quy tr\u00ecnh theo c\u00e1ch sao cho shellcode c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng \u0111\u01b0\u1ee3c tr\u1ea3i r\u1ed9ng tr\u00ean m\u1ed9t ph\u00e2n \u0111o\u1ea1n l\u1edbn c\u1ee7a quy tr\u00ecnh. \u0110i\u1ec1u n\u00e0y \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1eb1ng c\u00e1ch t\u1ea1o ra nhi\u1ec1u \u0111\u1ed1i t\u01b0\u1ee3ng ho\u1eb7c th\u1ec3 hi\u1ec7n trong v\u00f9ng heap, m\u1ed7i \u0111\u1ed1i t\u01b0\u1ee3ng mang m\u1ed9t b\u1ea3n sao c\u1ee7a shellcode mong mu\u1ed1n.<\/p>\n<p>K\u1ef9 thu\u1eadt n\u00e0y th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng k\u1ebft h\u1ee3p v\u1edbi c\u00e1c c\u00e1ch khai th\u00e1c kh\u00e1c cho ph\u00e9p th\u1ef1c thi m\u00e3 t\u00f9y \u00fd. Tuy nhi\u00ean, v\u1ea5n \u0111\u1ec1 v\u1edbi nh\u1eefng c\u00e1ch khai th\u00e1c n\u00e0y l\u00e0 ch\u00fang th\u01b0\u1eddng y\u00eau c\u1ea7u ki\u1ebfn th\u1ee9c v\u1ec1 v\u1ecb tr\u00ed b\u1ed9 nh\u1edb ch\u00ednh x\u00e1c c\u1ee7a m\u00e3 s\u1ebd \u0111\u01b0\u1ee3c th\u1ef1c thi, \u0111i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 kh\u00f3 x\u00e1c \u0111\u1ecbnh do c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt kh\u00e1c nhau. Vi\u1ec7c phun heap gi\u1ea3i quy\u1ebft v\u1ea5n \u0111\u1ec1 n\u00e0y b\u1eb1ng c\u00e1ch l\u1ea5p \u0111\u1ea7y m\u1ed9t ph\u1ea7n \u0111\u00e1ng k\u1ec3 c\u1ee7a heap b\u1eb1ng shellcode \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u, do \u0111\u00f3 l\u00e0m t\u0103ng v\u1ec1 m\u1eb7t th\u1ed1ng k\u00ea c\u01a1 h\u1ed9i khai th\u00e1c k\u00edch ho\u1ea1t vi\u1ec7c th\u1ef1c thi m\u00e3.<\/p>\n<h2>C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a phun \u0111\u1ed1ng<\/h2>\n<p>Ch\u1ee9c n\u0103ng phun \u0111\u1ed1ng th\u00f4ng qua quy tr\u00ecnh hai b\u01b0\u1edbc:<\/p>\n<ol>\n<li>\n<p><strong>X\u1ecbt n\u01b0\u1edbc<\/strong>: B\u1ed9 nh\u1edb heap ch\u1ee9a nhi\u1ec1u phi\u00ean b\u1ea3n c\u1ee7a shellcode mong mu\u1ed1n. \u0110i\u1ec1u n\u00e0y \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1eb1ng c\u00e1ch t\u1ea1o c\u00e1c \u0111\u1ed1i t\u01b0\u1ee3ng ho\u1eb7c th\u1ec3 hi\u1ec7n mang shellcode, sau \u0111\u00f3 \u0111\u01b0\u1ee3c ph\u00e2n b\u1ed5 v\u00e0o c\u00e1c \u0111\u1ecba ch\u1ec9 b\u1ed9 nh\u1edb kh\u00e1c nhau c\u1ee7a v\u00f9ng heap.<\/p>\n<\/li>\n<li>\n<p><strong>C\u00f2 s\u00fang<\/strong>: M\u1ed9t l\u1ed7 h\u1ed5ng b\u1ecb khai th\u00e1c \u0111\u1ec3 th\u1ef1c thi m\u00e3 t\u00f9y \u00fd. V\u00ec b\u1ed9 nh\u1edb \u0111\u00e3 ch\u1ee9a \u0111\u1ea7y c\u00e1c phi\u00ean b\u1ea3n c\u1ee7a shellcode n\u00ean kh\u1ea3 n\u0103ng m\u00e3 \u0111\u01b0\u1ee3c th\u1ef1c thi s\u1ebd l\u00e0 shellcode c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng t\u0103ng l\u00ean \u0111\u00e1ng k\u1ec3.<\/p>\n<\/li>\n<\/ol>\n<h2>C\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a phun \u0111\u1ed1ng<\/h2>\n<p>C\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a phun \u0111\u1ed1ng bao g\u1ed3m:<\/p>\n<ul>\n<li>Ph\u1ea7n l\u1edbn n\u00f3 kh\u00f4ng ph\u1ee5 thu\u1ed9c v\u00e0o t\u1ea3i tr\u1ecdng, c\u00f3 ngh\u0129a l\u00e0 n\u00f3 c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 th\u1ef1c thi h\u1ea7u nh\u01b0 b\u1ea5t k\u1ef3 lo\u1ea1i shellcode n\u00e0o.<\/li>\n<li>N\u00f3 l\u00e0m t\u0103ng \u0111\u00e1ng k\u1ec3 kh\u1ea3 n\u0103ng th\u1ef1c thi m\u00e3 th\u00e0nh c\u00f4ng khi khai th\u00e1c l\u1ed7 h\u1ed5ng.<\/li>\n<li>N\u00f3 b\u1ecf qua c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt nh\u1ea5t \u0111\u1ecbnh nh\u01b0 ng\u1eabu nhi\u00ean h\u00f3a b\u1ed1 c\u1ee5c kh\u00f4ng gian \u0111\u1ecba ch\u1ec9 (ASLR) b\u1eb1ng c\u00e1ch kh\u00f4ng y\u00eau c\u1ea7u ki\u1ebfn th\u1ee9c v\u1ec1 \u0111\u1ecba ch\u1ec9 b\u1ed9 nh\u1edb ch\u00ednh x\u00e1c.<\/li>\n<\/ul>\n<h2>C\u00e1c ki\u1ec3u phun \u0111\u1ed1ng<\/h2>\n<p>C\u00f3 m\u1ed9t s\u1ed1 bi\u1ebfn th\u1ec3 c\u1ee7a phun \u0111\u1ed1ng, m\u1ed7i bi\u1ebfn th\u1ec3 kh\u00e1c nhau d\u1ef1a tr\u00ean c\u00e1c ph\u01b0\u01a1ng ph\u00e1p \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 phun \u0111\u1ed1ng. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ed1 lo\u1ea1i:<\/p>\n<table>\n<thead>\n<tr>\n<th>Lo\u1ea1i phun \u0111\u1ed1ng<\/th>\n<th>S\u1ef1 mi\u00eau t\u1ea3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Phun \u0111\u1ed1ng c\u1ed5 \u0111i\u1ec3n<\/strong><\/td>\n<td>Li\u00ean quan \u0111\u1ebfn vi\u1ec7c ph\u00e2n b\u1ed5 l\u1eb7p l\u1ea1i c\u00e1c kh\u1ed1i b\u1ed9 nh\u1edb, m\u1ed7i kh\u1ed1i ch\u1ee9a shellcode.<\/td>\n<\/tr>\n<tr>\n<td><strong>Phun \u0111\u1ed1ng tu\u1ea7n t\u1ef1<\/strong><\/td>\n<td>Ph\u00e2n b\u1ed5 m\u1ed9t kh\u1ed1i l\u1edbn b\u1ed9 nh\u1edb v\u00e0 l\u1ea5p \u0111\u1ea7y n\u00f3 b\u1eb1ng shellcode.<\/td>\n<\/tr>\n<tr>\n<td><strong>Phun \u0111\u1ed1ng xe tr\u01b0\u1ee3t NOP<\/strong><\/td>\n<td>S\u1eed d\u1ee5ng NOP-sled (m\u1ed9t chu\u1ed7i h\u01b0\u1edbng d\u1eabn kh\u00f4ng thao t\u00e1c) tr\u01b0\u1edbc shellcode \u0111\u1ec3 t\u0103ng t\u1ef7 l\u1ec7 th\u00e0nh c\u00f4ng.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>C\u00e1ch s\u1eed d\u1ee5ng phun \u0111\u1ed1ng, v\u1ea5n \u0111\u1ec1 v\u00e0 gi\u1ea3i ph\u00e1p<\/h2>\n<p>Phun \u0111\u1ed1ng ch\u1ee7 y\u1ebfu \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong b\u1ed1i c\u1ea3nh khai th\u00e1c b\u1ea3o m\u1eadt, \u0111\u1eb7c bi\u1ec7t l\u00e0 khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng h\u1ecfng b\u1ed9 nh\u1edb. \u0110\u00f3 l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt m\u1ea1nh m\u1ebd, \u0111\u1eb7c bi\u1ec7t khi k\u1ebft h\u1ee3p v\u1edbi c\u00e1c l\u1ed7 h\u1ed5ng cho ph\u00e9p th\u1ef1c thi m\u00e3 t\u00f9y \u00fd.<\/p>\n<p>Tuy nhi\u00ean, vi\u1ec7c s\u1eed d\u1ee5ng phun \u0111\u1ed1ng kh\u00f4ng ph\u1ea3i l\u00e0 kh\u00f4ng c\u00f3 th\u00e1ch th\u1ee9c. M\u1ed9t v\u1ea5n \u0111\u1ec1 l\u00e0 khi k\u00edch th\u01b0\u1edbc heap t\u0103ng l\u00ean, k\u1ef9 thu\u1eadt n\u00e0y tr\u1edf n\u00ean d\u1ec5 b\u1ecb ph\u00e1t hi\u1ec7n h\u01a1n. M\u1ed9t th\u00e1ch th\u1ee9c kh\u00e1c l\u00e0 vi\u1ec7c tri\u1ec3n khai ng\u00e0y c\u00e0ng nhi\u1ec1u c\u00e1c k\u1ef9 thu\u1eadt gi\u1ea3m thi\u1ec3u khai th\u00e1c nh\u01b0 ASLR v\u00e0 DEP (Ng\u0103n ch\u1eb7n th\u1ef1c thi d\u1eef li\u1ec7u), khi\u1ebfn vi\u1ec7c th\u1ef1c thi shellcode t\u1eeb v\u00f9ng heap tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n.<\/p>\n<p>\u0110\u1ec3 v\u01b0\u1ee3t qua nh\u1eefng th\u00e1ch th\u1ee9c n\u00e0y, nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng c\u00e1c ph\u01b0\u01a1ng ph\u00e1p phun heap ph\u1ee9c t\u1ea1p h\u01a1n, ch\u1eb3ng h\u1ea1n nh\u01b0 phun JIT, t\u1eadn d\u1ee5ng c\u00e1c tr\u00ecnh bi\u00ean d\u1ecbch \u0111\u00fang l\u00fac \u0111\u1ec3 l\u00e0m cho heap c\u00f3 th\u1ec3 th\u1ef1c thi \u0111\u01b0\u1ee3c. M\u1eb7t kh\u00e1c, nh\u1eefng ng\u01b0\u1eddi th\u1ef1c hi\u1ec7n b\u1ea3o m\u1eadt c\u1ea7n kh\u00f4ng ng\u1eebng c\u1ea3i ti\u1ebfn v\u00e0 ph\u00e1t tri\u1ec3n c\u00e1c k\u1ef9 thu\u1eadt gi\u1ea3m thi\u1ec3u m\u1edbi.<\/p>\n<h2>C\u00e1c \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh v\u00e0 so s\u00e1nh v\u1edbi c\u00e1c thu\u1eadt ng\u1eef t\u01b0\u01a1ng t\u1ef1<\/h2>\n<p>Phun \u0111\u1ed1ng th\u01b0\u1eddng \u0111\u01b0\u1ee3c so s\u00e1nh v\u00e0 \u0111\u1ed1i chi\u1ebfu v\u1edbi c\u00e1c k\u1ef9 thu\u1eadt khai th\u00e1c t\u01b0\u01a1ng t\u1ef1 nh\u01b0 ph\u00e1 v\u1ee1 ng\u0103n x\u1ebfp v\u00e0 l\u1eadp tr\u00ecnh h\u01b0\u1edbng tr\u1edf l\u1ea1i (ROP).<\/p>\n<table>\n<thead>\n<tr>\n<th>K\u1ef9 thu\u1eadt<\/th>\n<th>S\u1ef1 mi\u00eau t\u1ea3<\/th>\n<th>\u0110i\u1ec3m t\u01b0\u01a1ng \u0111\u1ed3ng\/kh\u00e1c bi\u1ec7t v\u1edbi phun \u0111\u1ed1ng<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>\u0111\u1eadp v\u1ee1 ng\u0103n x\u1ebfp<\/strong><\/td>\n<td>Li\u00ean quan \u0111\u1ebfn vi\u1ec7c l\u00e0m h\u1ecfng ng\u0103n x\u1ebfp \u0111\u1ec3 thay \u0111\u1ed5i vi\u1ec7c th\u1ef1c thi ch\u01b0\u01a1ng tr\u00ecnh.<\/td>\n<td>Kh\u00f4ng gi\u1ed1ng nh\u01b0 heap heap, stack smash \u0111\u00f2i h\u1ecfi ki\u1ebfn th\u1ee9c v\u1ec1 c\u00e1ch b\u1ed1 tr\u00ed b\u1ed9 nh\u1edb ch\u00ednh x\u00e1c.<\/td>\n<\/tr>\n<tr>\n<td><strong>L\u1eadp tr\u00ecnh h\u01b0\u1edbng tr\u1ea3 v\u1ec1 (ROP)<\/strong><\/td>\n<td>Li\u00ean quan \u0111\u1ebfn vi\u1ec7c s\u1eed d\u1ee5ng c\u00e1c \u0111o\u1ea1n m\u00e3 (ti\u1ec7n \u00edch) hi\u1ec7n c\u00f3 \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i.<\/td>\n<td>ROP, gi\u1ed1ng nh\u01b0 phun \u0111\u1ed1ng, c\u00f3 th\u1ec3 v\u01b0\u1ee3t qua DEP nh\u01b0ng kh\u00f4ng y\u00eau c\u1ea7u l\u1ea5p \u0111\u1ea7y b\u1ed9 nh\u1edb b\u1eb1ng shellcode.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Quan \u0111i\u1ec3m v\u00e0 c\u00f4ng ngh\u1ec7 c\u1ee7a t\u01b0\u01a1ng lai li\u00ean quan \u0111\u1ebfn phun \u0111\u1ed1ng<\/h2>\n<p>M\u1eb7c d\u00f9 phun \u0111\u1ed1ng v\u1eabn l\u00e0 m\u1ed9t m\u1ed1i \u0111e d\u1ecda nh\u01b0ng t\u01b0\u01a1ng lai h\u01b0\u1edbng t\u1edbi c\u00e1c chi\u1ebfn l\u01b0\u1ee3c gi\u1ea3m thi\u1ec3u hi\u1ec7u qu\u1ea3 h\u01a1n. C\u00e1c k\u1ef9 thu\u1eadt nh\u01b0 Control Flow Integrity (CFI) v\u00e0 ASLR c\u1ea3i ti\u1ebfn c\u00f3 th\u1ec3 khi\u1ebfn vi\u1ec7c khai th\u00e1c l\u1ed7 h\u1ed5ng tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n. Ngo\u00e0i ra, thu\u1eadt to\u00e1n m\u00e1y h\u1ecdc v\u00e0 AI c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 ph\u00e1t hi\u1ec7n t\u1ed1t h\u01a1n h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng trong v\u00f9ng heap.<\/p>\n<p>M\u1eb7t kh\u00e1c, khi c\u00f4ng ngh\u1ec7 ti\u1ebfn b\u1ed9, nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng c\u00e1c k\u1ef9 thu\u1eadt ph\u1ee9c t\u1ea1p h\u01a1n nh\u01b0 phun JIT v\u00e0 c\u00e1c l\u1ed7 h\u1ed5ng use-after-free, \u0111i\u1ec1u n\u00e0y \u0111\u1eb7t ra nh\u1eefng th\u00e1ch th\u1ee9c ri\u00eang c\u1ee7a ch\u00fang.<\/p>\n<h2>M\u00e1y ch\u1ee7 proxy v\u00e0 phun \u0111\u1ed1ng<\/h2>\n<p>B\u1ea3n th\u00e2n c\u00e1c m\u00e1y ch\u1ee7 proxy kh\u00f4ng li\u00ean quan tr\u1ef1c ti\u1ebfp \u0111\u1ebfn vi\u1ec7c phun \u0111\u1ed1ng. Tuy nhi\u00ean, ch\u00fang c\u00f3 th\u1ec3 \u0111\u00f3ng m\u1ed9t vai tr\u00f2 trong c\u1ea3 vi\u1ec7c th\u1ef1c hi\u1ec7n v\u00e0 gi\u1ea3m thi\u1ec3u c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng t\u00ednh n\u0103ng phun \u0111\u1ed1ng.<\/p>\n<p>T\u1eeb g\u00f3c \u0111\u1ed9 c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng, m\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 \u1ea9n v\u1ecb tr\u00ed c\u1ee7a ch\u00fang v\u00e0 khi\u1ebfn cu\u1ed9c t\u1ea5n c\u00f4ng tr\u1edf n\u00ean kh\u00f3 theo d\u00f5i h\u01a1n. V\u1ec1 m\u1eb7t ph\u00f2ng th\u1ee7, m\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng b\u1ea3o m\u1eadt l\u1edbn h\u01a1n, ghi d\u1eef li\u1ec7u l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp \u0111\u1ec3 ph\u00e2n t\u00edch, c\u00f3 th\u1ec3 gi\u00fap ph\u00e1t hi\u1ec7n h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng ho\u1eb7c c\u00e1c ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c ti\u1ec1m \u1ea9n trong giai \u0111o\u1ea1n \u0111\u1ea7u.<\/p>\n<h2>Li\u00ean k\u1ebft li\u00ean quan<\/h2>\n<p>\u0110\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin v\u1ec1 phun \u0111\u1ed1ng v\u00e0 c\u00e1c ch\u1ee7 \u0111\u1ec1 li\u00ean quan, b\u1ea1n c\u00f3 th\u1ec3 tham kh\u1ea3o c\u00e1c t\u00e0i nguy\u00ean sau:<\/p>\n<ul>\n<li>Conover, M., &amp; Horovitz, O. (2004). Phun \u0111\u1ed1ng: K\u1ef9 thu\u1eadt ch\u1ed1ng l\u1ea1i c\u00e1c bi\u1ec7n ph\u00e1p an ninh chung. Gi\u1ea5y b\u1ea3o m\u1eadt.<\/li>\n<li>\u201cHeap Spraying\u201d tr\u00ean OWASP (D\u1ef1 \u00e1n b\u1ea3o m\u1eadt \u1ee9ng d\u1ee5ng web m\u1edf): <a href=\"https:\/\/www.owasp.org\/index.php\/Heap_spraying\" target=\"_new\" rel=\"noopener nofollow\">https:\/\/www.owasp.org\/index.php\/Heap_spraying<\/a><\/li>\n<li>\u201cAn to\u00e0n b\u1ed9 nh\u1edb\u201d tr\u00ean Mozilla Developer Network (MDN): <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Memory_safety\" target=\"_new\" rel=\"noopener nofollow\">https:\/\/developer.mozilla.org\/en-US\/docs\/Memory_safety<\/a><\/li>\n<li>\u201cKhai th\u00e1c c\u00e1c c\u1ea3i ti\u1ebfn gi\u1ea3m nh\u1eb9 trong Windows 8\u201d tr\u00ean Trung t\u00e2m ph\u1ea3n h\u1ed3i b\u1ea3o m\u1eadt c\u1ee7a Microsoft (MSRC): <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-us\/\" target=\"_new\" rel=\"noopener nofollow\">https:\/\/msrc.microsoft.com\/update-guide\/en-us\/<\/a><\/li>\n<\/ul>\n<p>Xin l\u01b0u \u00fd r\u1eb1ng \u0111\u1ec3 hi\u1ec3u s\u00e2u v\u1ec1 k\u1ef9 thu\u1eadt phun \u0111\u1ed1ng v\u00e0 c\u00e1c k\u1ef9 thu\u1eadt t\u01b0\u01a1ng t\u1ef1 \u0111\u00f2i h\u1ecfi ph\u1ea3i c\u00f3 ki\u1ebfn th\u1ee9c v\u1eefng ch\u1eafc v\u1ec1 ng\u00f4n ng\u1eef l\u1eadp tr\u00ecnh v\u00e0 qu\u1ea3n l\u00fd b\u1ed9 nh\u1edb m\u00e1y t\u00ednh. Lu\u00f4n \u0111\u1ea3m b\u1ea3o lu\u00f4n c\u1eadp nh\u1eadt c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt v\u00e0 chi\u1ebfn l\u01b0\u1ee3c gi\u1ea3m thi\u1ec3u m\u1edbi nh\u1ea5t.<\/p>","protected":false},"featured_media":468529,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477439","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Heap Spraying: A Detailed Analysis<\/mark>","faq_items":[{"question":"What is Heap Spraying?","answer":"<p>Heap Spraying is a technique used in computer exploitation. It involves flooding a region of a process's heap memory with shellcode to increase the likelihood of executing arbitrary code when vulnerabilities are exploited.<\/p>"},{"question":"Who first introduced Heap Spraying?","answer":"<p>Heap spraying was first introduced in a security paper written by Matt Conover and Oded Horovitz, published in the early 2000s.<\/p>"},{"question":"How does Heap Spraying work?","answer":"<p>Heap spraying functions through a two-step process: the Spray and the Trigger. During the spray, the heap memory is filled with multiple instances of the desired shellcode. The trigger is then used to exploit a vulnerability, executing arbitrary code. Since the memory has been filled with instances of the shellcode, the likelihood that the executed code will be the attacker's shellcode is significantly increased.<\/p>"},{"question":"What are some key features of Heap Spraying?","answer":"<p>Heap spraying is payload-agnostic, it increases the probability of successful code execution, and it bypasses certain security measures like address space layout randomization (ASLR) by not requiring knowledge of exact memory addresses.<\/p>"},{"question":"What are the types of Heap Spraying?","answer":"<p>Heap spraying can be divided into types based on the methods used to spray the heap, including Classic Heap Spraying, Sequential Heap Spraying, and NOP-sled Heap Spraying.<\/p>"},{"question":"What problems are associated with Heap Spraying and how can they be solved?","answer":"<p>As heap size increases, heap spraying becomes more detectable and mitigation techniques like ASLR and DEP make executing shellcode from the heap more difficult. To overcome these challenges, attackers may resort to more sophisticated methods of heap spraying, such as JIT spraying. On the defensive side, constant improvement and development of new mitigation techniques are necessary.<\/p>"},{"question":"How do Heap Spraying and Proxy Servers relate?","answer":"<p>While proxy servers themselves are not directly associated with heap spraying, they can play a role in both the perpetration and mitigation of attacks that use heap spraying. Proxy servers can be used by attackers to hide their location and by defenders to log traffic data for analysis, which can help in detecting potential exploits.<\/p>"},{"question":"What are some resources for further information about Heap Spraying?","answer":"<p>Resources include security papers such as \"Heap Spraying: A Technique to Counter Common Security Measures\" by Conover and Horovitz, OWASP, Mozilla Developer Network (MDN), and the Microsoft Security Response Center (MSRC).<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477439\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media\/468529"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media?parent=477439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}