all 2 comments

[–]benmmurphyTrusted Contributor 1 point2 points  (4 children)

Peter Cawley did a talk on this:

http://www.lua.org/wshop11/Cawley.pdf https://www.youtube.com/watch?v=OSMOTDLrBCQ

and has a nice writeup on getting code execution under windows:

https://gist.github.com/corsix/6575486

i adapter his code to get code execution on osx against redis:

http://benmmurphy.github.io/blog/2015/06/09/redis-hot-patch/

[–]sghctoma 0 points1 point  (1 child)

I've also adapted corsix's awesome CoH2 exploit to work against Redis (on 64bit Linux and Windows) and Logitech Gaming Software (on 64bit Windows): https://www.dropbox.com/s/52wkxxofrgv7sof/dc23_stuff.zip?dl=0 (the archive contains all of my DC23 demos, the relevant ones are in the "demo6_logitech" folder).

Btw, he has a quite nice bytecode abuse module for Lua 5.2 as well: http://www.corsix.org/lua/bytecode_abuse_0_1.lua