Skip to content

Instantly share code, notes, and snippets.

View compoterhacker's full-sized avatar

Jaime Cochran compoterhacker

View GitHub Profile
@compoterhacker
compoterhacker / KEK.md
Created March 9, 2016 21:25
old ass irssi-otr heap exploit

OLD ASS nonsense, but in the spirit of hacking otr...

irssi/xchat/weechat-otr include a heap corruption vulnerability, which is triggered when a PRIVMSG is sent to a victim with "?OTR:", but without a terminating char such as "." or ",". The plug-in will then sit and wait for the rest of the message to come in -- thinking it's just SUPER FUCKING LONG -- waiting for the "." or "," terminator, which never comes.

This allows us to load a junkshot 440 chars at a time via PM, adding to the msg buffer, eventually overflowing and corrupting the fuck outta mem.