Comment by darkamaul
9 hours ago
Orange is a legend and this chain is extremely impressive here.
No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader.
As a bonus, they also posted a reverse chain: popping Edge from calc [0].
> As a bonus, they also posted a reverse chain: popping Edge from calc [0].
What the hell is going on there? Apparently they are spawning new and new and new instances of calc.exe until one random (?) instance is vulnerable to some sort of attack, then they inject some shellcode into it from outside, and manage to trigger it by inputting "1"s until there's an overflow?
Really looking forward to the writeup lol