Conversation

exploitation of CVE-2016-4478 is simple: generate an XMLRPC request that will generate exactly multiple of 64 bytes output,
excluding the nul terminator.

remember, this is a Pascal string used in the xmlrpc code because Trystan was smart and realized he should use Pascal strings when dealing with webshit.

later on some fuckwit "optimized" the code by dumping the raw string instead of converting properly, and probably didn't notice because the scratch buffer saved him.

(pascal strings are typically overallocated to ensure alignment and avoid spurious reallocs)

once you have such a response, you will also get back the contents of the vtable.

you can take it from there