Introduction
Introduction Statistics Contact Development Disclaimer Help
python_feedgen_maxwelldulin.invades.space.rss.xml - sfeed_tests - sfeed tests a…
git clone git://git.codemadness.org/sfeed_tests
Log
Files
Refs
README
LICENSE
---
python_feedgen_maxwelldulin.invades.space.rss.xml (96900B)
---
1 <?xml version='1.0' encoding='UTF-8'?>
2 <rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl…
3
4 &lt;h2&gt;Introduction&lt;/h2&gt;
5 &lt;p&gt;
6 Recently, a friend of mine (from outside the United States) had a third …
7 &lt;/p&gt;
8
9 &lt;h2&gt;Back to the Basics&lt;/h2&gt;
10
11 &lt;p&gt;
12 If accounts exists on a website there are some basic features of it:
13 &lt;ul&gt;
14 &lt;li&gt;Create Account&lt;/li&gt;
15 &lt;li&gt;Login&lt;/li&gt;
16 &lt;li&gt;Forgot Password/ Password Reset&lt;/li&gt;
17 &lt;li&gt;Update Account&lt;/li&gt;
18 &lt;li&gt;Delete Account&lt;/li&gt;
19 &lt;li&gt;View Account&lt;/li&gt;
20 &lt;/ul&gt;
21
22 If any of these is done in insecure way, major havoc can occur. In this …
23 &lt;/p&gt;
24
25 &lt;h3&gt;
26 Basic Flow of Password Reset
27 &lt;/h3&gt;
28 &lt;p&gt;
29 What do you do if a user forgets their password? Well, you want them to …
30 &lt;/p&gt;
31 &lt;p&gt;
32 Generally, a users account is tied to an email. With this, the website c…
33 &lt;/p&gt;
34
35 &lt;!-break--&gt;
36
37 &lt;p&gt;
38 Once the link is clicked on, a user can select their new password. When …
39 &lt;/p&gt;
40
41 &lt;h2&gt;
42 What Went Wrong #1 - Email Enumeration (Low)
43 &lt;/h2&gt;
44 &lt;p&gt;
45 From the very beginning, the reset functionality had issues. The initial…
46 &lt;div style="width:98%; font-size:80%; text-align:center; float : left…
47
48 With a valid email, it just said that the email had been sent.
49 &lt;/p&gt;
50 &lt;p&gt;
51 But, why is this bad? Because it is trivial to distinguish between a val…
52 &lt;/p&gt;
53
54 &lt;h2&gt;
55 What Went Wrong #2 - Host Header Injection (High)
56 &lt;/h2&gt;
57
58 &lt;p&gt;
59 Now, this time, we are going to input a valid email address. Everything …
60 &lt;/p&gt;
61
62 &lt;h3&gt;
63 Host Header
64 &lt;/h3&gt;
65 &lt;p&gt;
66 HTTP sends a plethora of different headers on each request, such as the …
67 &lt;code&gt;Specifies the domain name of the server.
68 &lt;/code&gt; by Mozilla. In layman's terms, this simply means the host …
69 &lt;/p&gt;
70
71 &lt;p&gt;
72 Even though the Host is set in the browser on a normal request (and cann…
73 &lt;/p&gt;
74
75 &lt;h3&gt;
76 Havoc
77 &lt;/h3&gt;
78 &lt;p&gt;
79 The Host Header is sometimes used in order to create links from it. So, …
80 &lt;div style="width:98%; font-size:80%; text-align:center; float : left…
81 &lt;/p&gt;
82
83 &lt;p&gt;
84 What's the attack here though? Well, this means that when the link is cl…
85
86 &lt;div style="width:98%; font-size:80%; text-align:center; float : left…
87 &lt;/p&gt;
88
89 &lt;h2&gt;
90 What Went Wrong #3 - Short Reset Token (Medium/High)
91 &lt;/h2&gt;
92 &lt;p&gt;
93 If we ignore the first issue (that takes a single click from the user) w…
94 &lt;/p&gt;
95 &lt;p&gt;
96 Mathematically, this is 10^6 or 1,000,000 chances. With no throttling an…
97 &lt;/p&gt;
98
99 &lt;p&gt;
100 By requesting a reset email for a single user then attempting &lt;i&gt;e…
101 &lt;/p&gt;
102
103 &lt;h2&gt;
104 What Went Wrong #4 - Lack of Server Side Validation (Critical)
105 &lt;/h2&gt;
106
107 &lt;p&gt;
108 You are probably thinking &lt;i&gt;'There are already two ways to take o…
109 &lt;/p&gt;
110
111 &lt;p&gt;
112 Upon clicking on the link to go back to the website, the magic token was…
113
114 &lt;/p&gt;
115
116 &lt;h3&gt;
117 Lack of Validation of Token
118 &lt;/h3&gt;
119 &lt;p&gt;
120 The first request validates the password reset token. But, the second re…
121 &lt;div style="width:98%; font-size:80%; text-align:center; float : left…
122
123 Notice that the above request does not include the &lt;i&gt;magic value&…
124 &lt;/p&gt;
125
126
127 &lt;h2&gt;
128 Fixing
129 &lt;/h2&gt;
130 &lt;p&gt;
131 The creators of the website were from a third world country where Englis…
132 &lt;/p&gt;
133
134 &lt;p&gt;
135 After reporting the findings, the token was being validated on the backe…
136 &lt;/p&gt;
137
138 &lt;h2&gt;
139 Test Cases
140 &lt;/h2&gt;
141
142 &lt;p&gt;
143 Password reset functionality is one of the hardest aspects of the user e…
144 &lt;ul&gt;
145 &lt;li&gt;Username/email enumeration&lt;/li&gt;
146 &lt;li&gt;Host Header Injection&lt;/li&gt;
147 &lt;li&gt;Insufficient Length of Reset Tokens &lt;/li&gt;
148 &lt;li&gt;Lack of Validation of Magic Values&lt;/li&gt;
149 &lt;li&gt;Extended Expiration Time on Token&lt;/li&gt;
150 &lt;li&gt;Lack of Brute Force Protections&lt;/li&gt;
151 &lt;/ul&gt;
152
153 Besides the issues described above, there are a few more that should be …
154
155 &lt;ul&gt;
156 &lt;li&gt;Sending New Passwords over Email&lt;/li&gt;
157 &lt;li&gt;Lack of Two Factor Authentication&lt;/li&gt;
158 &lt;li&gt;Multiple Uses for a Single Reset Token&lt;/li&gt;
159 &lt;li&gt;Reset tokens Not Specific To User&lt;/li&gt;
160 &lt;/ul&gt;
161
162 This is a fairly good list for testing password reset functionality. But…
163 &lt;/p&gt;
164
165 &lt;h3&gt;
166 Defense In Depth
167 &lt;/h3&gt;
168 &lt;p&gt;
169 Some of the issues listed above do not lead to a direct compromise of th…
170 &lt;/p&gt;
171
172 &lt;p&gt;For instance, the &lt;i&gt;insufficient token length&lt;/i&gt; …
173 &lt;/p&gt;
174
175 &lt;p&gt;
176 Overall, adding slight security optimizations makes the overall security…
177 &lt;/p&gt;
178
179
180 &lt;h2&gt;
181 Conclusion
182 &lt;/h2&gt;
183 &lt;p&gt;
184 Security is hard to get right! This is why having hackers poke around is…
185 &lt;/p&gt;</description><guid isPermaLink="false">https://maxwelldulin.c…
186 Introduction
187 &lt;/h2&gt;
188 &lt;p&gt;
189 Exploiting different heap libraries tends to be difficult, complex and r…
190 &lt;/p&gt;
191
192 &lt;p&gt;In this article, I wanted to shed more light on the exploitatio…
193 &lt;/p&gt;
194
195 &lt;p&gt;
196 Just as a fair warning, this article has quite a bit of background knowl…
197 &lt;ul&gt;
198 &lt;li&gt;Malloc Chunk (general)&lt;/li&gt;
199 &lt;li&gt;Mmap and Munmap&lt;/li&gt;
200 &lt;li&gt;Malloc Mmap Chunks &lt;/li&gt;
201 &lt;li&gt;ELF Symbol Resolution&lt;/li&gt;
202 &lt;/ul&gt;
203 &lt;/p&gt;
204
205
206 &lt;p&gt;
207 The article also comes with a working POC on version 2.31 of Malloc on m…
208 &lt;/p&gt;
209
210 &lt;h2&gt;
211 GLibC Malloc Background
212 &lt;/h2&gt;
213
214 &lt;h3&gt;
215 Chunks
216 &lt;/h3&gt;
217
218 &lt;p&gt;
219 Chunks are the main object that users interact with. There are two main …
220 &lt;div style="width: 98%; font-size:80%; text-align:center; float : lef…
221
222
223 The first field is the size of the previous chunk (prev_size). This is o…
224 &lt;/p&gt;
225
226 &lt;p&gt;
227 On an allocated (non-free) chunk, the third and fourth field are used as…
228 &lt;/p&gt;
229
230 &lt;p&gt;
231 This is a very small background on chunks but is all that is needed for …
232 &lt;/p&gt;
233
234 &lt;h2&gt;
235 Mmap and Munmap
236 &lt;/h2&gt;
237 &lt;p&gt;
238 &lt;i&gt;Mmap&lt;/i&gt; is used in order to create a new address mapping…
239 &lt;/p&gt;
240
241 &lt;p&gt;
242 Munmap is the opposite of mmap: &lt;i&gt;munmap&lt;/i&gt; deletes the ma…
243 &lt;/p&gt;
244
245 &lt;h2&gt;
246 GLibC Malloc Mmap Chunks
247 &lt;/h2&gt;
248 &lt;p&gt;
249 In Malloc, if a requested size is above a certain threshold then a separ…
250 &lt;/p&gt;
251
252 &lt;h3&gt;
253 Mmap Chunks Differences
254 &lt;/h3&gt;
255
256 &lt;p&gt;
257 &lt;div style="width:97%; font-size:80%; text-align:center; border: 1px …
258
259 Once an mmap chunk is freed, they are sent back to system memory with a …
260 &lt;/p&gt;
261
262 &lt;p&gt;
263
264 With mmap chunks, the prev_size field is used for part of the chunk that…
265 &lt;/p&gt;
266
267 &lt;p&gt;
268 The final difference is that the second bit of the size is used in order…
269 &lt;/p&gt;
270
271 &lt;h3&gt;
272 Munmap Madness
273 &lt;/h3&gt;
274
275 &lt;p&gt;
276 With the funky handling of mmap chunks in GLibC, it was bound that someb…
277 &lt;/p&gt;
278
279 &lt;p&gt;
280 What we are taking from the the &lt;i&gt;Munmap Madness&lt;/i&gt; articl…
281 &lt;/p&gt;
282
283
284 &lt;h2&gt;
285 Symbol Lookup
286 &lt;/h2&gt;
287 &lt;p&gt;
288 With ELF files, one would think that Symbol Lookup would be a trivial ta…
289 &lt;/p&gt;
290
291 &lt;h3&gt;
292 PLT and GOT
293 &lt;/h3&gt;
294
295 &lt;p&gt;
296 Have you ever wondered &lt;b&gt;how&lt;/b&gt; library functions are magi…
297 &lt;/p&gt;
298
299 &lt;div style="width:97%; float:left; font-size:80%; text-align:center; …
300
301 &lt;p&gt;
302 First off, a library function call is replaced with a function stub, kno…
303 &lt;/p&gt;
304
305 &lt;p&gt;
306 The &lt;i&gt;first time&lt;/i&gt; a call is made, the process is passed …
307 &lt;/p&gt;
308
309 &lt;p&gt;
310 The next time that the PLT entry for a function is called, the entry is …
311 &lt;/p&gt;
312
313 &lt;p&gt;
314 For more information on the PLT and GOT, please refer to the &lt;a href=…
315 &lt;/p&gt;
316
317 &lt;h3&gt;
318 Symbol Resolving (ld)
319 &lt;/h3&gt;
320
321 &lt;p&gt;
322 Now, here is the black magic-y part: &lt;i&gt;how does the loader know w…
323 &lt;/p&gt;
324
325 &lt;h2&gt;
326 Game Plan
327 &lt;/h2&gt;
328 &lt;p&gt;
329 Whooo... that was a lot of background information just to understand thi…
330 &lt;/p&gt;
331
332 &lt;p&gt;
333 The plan for exploitation is as follows:
334 &lt;ol&gt;
335 &lt;li&gt;
336 Overwrite mmap chunk &lt;i&gt;size&lt;/i&gt; or &lt;i&gt;prev_size&lt;/i…
337 &lt;/li&gt;
338 &lt;li&gt;Free the mmap chunk (with munmap) to override part of the memo…
339 &lt;li&gt;Get mmap chunk over the top of LibC region.&lt;/li&gt;
340 &lt;li&gt;Rewrite &lt;code&gt;.gnu.hash&lt;/code&gt; and &lt;code&gt;.dy…
341 &lt;li&gt;Call previously uncalled function for code execution.&lt;/li&g…
342 &lt;/ol&gt;
343
344 At a high level, the steps are shown above. The goal is to rewrite the s…
345 &lt;/p&gt;
346
347 &lt;h2&gt;
348 Altering Mmap Chunk Size
349 &lt;/h2&gt;
350 &lt;h3&gt;
351 Why?
352 &lt;/h3&gt;
353 &lt;p&gt;
354 The purpose of this step is to change the size of the chunk to &lt;i&gt;…
355 &lt;/p&gt;
356
357 &lt;h3&gt;
358 Mmap Chunk Review
359 &lt;/h3&gt;
360 &lt;p&gt;
361 Mmap chunks have two main components that dictate the addresses to be fr…
362 &lt;/p&gt;
363
364 &lt;p&gt;
365 By altering the &lt;i&gt;size&lt;/i&gt; of a chunk, we can control the a…
366 &lt;/p&gt;
367
368 &lt;h3&gt;
369 Valid Chunks
370 &lt;/h3&gt;
371
372 &lt;p&gt;
373 For an mmap chunk, the following must to be true:
374 &lt;ul&gt;
375 &lt;li&gt;Mmap bit must be set (2nd bit of the size metadata)&lt;/li&gt;
376 &lt;li&gt;&lt;code&gt;prev_size + size&lt;/code&gt; must to be a page si…
377 &lt;/ul&gt;
378
379 The source code for both of these checks can be seen in Figure 2 (way ab…
380 &lt;/p&gt;
381
382 &lt;h3&gt;
383 Chunk Attack Size
384 &lt;/h3&gt;
385 &lt;p&gt;
386 The size of the chunk is different on a case by case basis. The importan…
387 &lt;/p&gt;
388
389 &lt;p&gt;
390 In general, the size to overwrite with can be calculated with the follow…
391 &lt;/p&gt;
392
393 &lt;h2&gt;
394 Free the Chunk
395 &lt;/h2&gt;
396 &lt;p&gt;
397 From the previous step, we have created an mmap chunk that has a size ov…
398 &lt;/p&gt;
399
400 &lt;h2&gt;
401 Overlap Chunk with LibC
402 &lt;/h2&gt;
403
404 &lt;p&gt;
405 &lt;div style="width:97%; font-size:80%; text-align:center; float : left…
406
407 From the previous step, we have removed a significant portion of LibC fr…
408 &lt;/p&gt;
409
410 Although the allocation appears to be simple, it is more complicated tha…
411 &lt;ul&gt;
412 &lt;li&gt;mmap_threshold&lt;/li&gt;
413 &lt;li&gt;Heap Locations&lt;/li&gt;
414 &lt;/ul&gt;
415
416 &lt;/p&gt;
417
418 &lt;h3&gt;
419 mmap_threshold
420 &lt;/h3&gt;
421 &lt;p&gt;
422 Very large chunks (&lt;i&gt;mmap chunks&lt;/i&gt;) are assigned in a com…
423 &lt;/p&gt;
424
425 &lt;p&gt;
426 When an mmap chunk is freed, the size of the chunk is checked with the &…
427 &lt;/p&gt;
428
429 &lt;p&gt;
430 If the size of the chunk being allocated is NOT larger than the mmap_thr…
431 &lt;/p&gt;
432 &lt;h3&gt;
433 Heap Locations
434 &lt;/h3&gt;
435 &lt;p&gt;
436 The heap locations is just about if the physical spot in memory is actua…
437 &lt;/p&gt;
438
439 &lt;p&gt;
440 Getting the mmap chunks directly behind LibC just requires some knowledg…
441
442 &lt;ul&gt;
443 &lt;li&gt;Memory above LibC and below the loader&lt;/li&gt;
444 &lt;li&gt;Below the mmap_base (practically, just below LibC). Allocation…
445 &lt;/ul&gt;
446 &lt;/p&gt;
447
448 &lt;p&gt;
449 Now that the chunk has been allocated into the proper location (over Lib…
450 &lt;/p&gt;
451
452 &lt;p&gt;
453 NOTE: Mmap initializes all memory to be NULL. So, all of the values from…
454 &lt;/p&gt;
455
456 &lt;h2&gt;
457 Rewriting LibC .gnu.hash and .dynsym
458 &lt;/h2&gt;
459 &lt;p&gt;
460 Recall, from the previous step, we control a chunk that overlaps with wh…
461 &lt;/p&gt;
462
463 &lt;p&gt;
464 Now begins the real fun :) Rewriting the symbol resolution process! In o…
465 &lt;ol&gt;
466 &lt;li&gt;Copy in the LibC sections byte for byte. Then, make several sm…
467 &lt;li&gt;Completely reverse the process and deterministically figure ou…
468 &lt;li&gt;Step through the code in GDB to understand the loader and writ…
469 &lt;/ol&gt;
470
471 Option 1 is likely easiest but would not help me understand the resolvin…
472
473 &lt;p&gt;
474 After ruling out the copy-paste method of 1 and the hard reversing of 2,…
475 &lt;/p&gt;
476
477 &lt;h3&gt;
478 What Is Actually Needed?
479 &lt;/h3&gt;
480 &lt;p&gt;
481 First, let's setup a nice debugging ENV. Viewing assembly by itself is v…
482 &lt;/p&gt;
483 &lt;p&gt;
484 After stepping through a program with the source code hooked up, I reali…
485 &lt;ul&gt;
486 &lt;li&gt;l_gnu_bitmask&lt;/li&gt;
487 &lt;li&gt;l_gnu_buckets&lt;/li&gt;
488 &lt;li&gt;l_gnu_chain_zero&lt;/li&gt;
489 &lt;li&gt;Symbol Table Entry&lt;/li&gt;
490 &lt;/ul&gt;
491
492 The first three entries have to do with &lt;b&gt;locating&lt;/b&gt; the …
493 &lt;/p&gt;
494
495 &lt;h3&gt;
496 Symbol Table Entry Locating
497 &lt;/h3&gt;
498 &lt;p&gt;
499 After setting up a version of LibC with debugging symbols and source cod…
500 &lt;div style="width:97%; font-size:80%; text-align:center; border: 1px …
501 &lt;/p&gt;
502
503 &lt;p&gt;
504 After reversing the symbol table resolving process for a while, it becam…
505 &lt;/p&gt;
506
507 &lt;p&gt;
508 The function &lt;code&gt;do_lookup_x&lt;/code&gt;
509 iterates all ELF files until it finds the one with the proper symbol. St…
510 &lt;ol&gt;
511 &lt;li&gt;Found a LibC value that is corrupted (this is going to be NULL…
512 &lt;li&gt;Found &lt;i&gt;proper&lt;/i&gt; value in non-corrupted version…
513 &lt;li&gt;Wrote proper value to the same exact location in LibC (corrupt…
514 &lt;li&gt;Repeat steps 1-3 until the entire symbol resolution process is…
515 &lt;/ol&gt;
516
517 After repeating this step a handful of times, the proper values will be …
518 &lt;/p&gt;
519
520 &lt;h3&gt;
521 Symbol Tables
522 &lt;/h3&gt;
523 &lt;p&gt;
524 Once the entry has been located, faking the symbol table entry is very s…
525 &lt;pre&gt;
526 typedef struct {
527 Elf64_Word st_name;
528 unsigned char st_info;
529 unsigned char st_other;
530 Elf64_Half st_shndx;
531 Elf64_Addr st_value;
532 Elf64_Xword st_size;
533 } Elf64_Sym;
534 &lt;/pre&gt;
535
536 It is recommended that the &lt;i&gt;entire&lt;/i&gt; symbol table entry …
537 &lt;/p&gt;
538
539 &lt;p&gt;
540 Assuming this is a relative offset entry (which can be altered with the …
541 &lt;/p&gt;
542
543 &lt;h2&gt;
544 Function Call
545 &lt;/h2&gt;
546 &lt;p&gt;
547 What can we call? We can call ANY function (or in the middle of a functi…
548 &lt;/p&gt;
549
550 &lt;p&gt;
551 The function that is going to be called must be a symbol table overwritt…
552 &lt;/p&gt;
553
554 &lt;p&gt;
555 This can be used to call &lt;i&gt;system&lt;/i&gt;, a one_gadget, anothe…
556 &lt;/p&gt;
557
558 &lt;h2&gt;
559 Thoughts
560 &lt;/h2&gt;
561 &lt;p&gt;
562 Overall, this technique is pretty devastating but is extremely technical…
563 &lt;/p&gt;
564 &lt;h3&gt;
565 Pros
566 &lt;/h3&gt;
567 &lt;p&gt;
568 Very large chunks (mmap) are typically not discussed much with heap expl…
569 &lt;/p&gt;
570
571 &lt;p&gt;
572 Here are some pros to the technique:
573 &lt;ul&gt;
574 &lt;li&gt;Bypasses &lt;u&gt;address space layout randomization&lt;/u&gt;…
575 &lt;li&gt;Requires NO leaks.&lt;/li&gt;
576 &lt;li&gt;A single buffer overflow can be enough to start this exploitat…
577 &lt;li&gt;Mmap chunk heap exploitation technique, which is not discussed…
578 &lt;/ul&gt;
579 &lt;/p&gt;
580
581 &lt;h3&gt;
582 Cons
583 &lt;/h3&gt;
584 &lt;p&gt;
585
586 &lt;ul&gt;
587 &lt;li&gt;This vulnerability does require the ability to overwrite the s…
588 &lt;li&gt;Known &lt;b&gt;relative&lt;/b&gt; location of the overwritten …
589 &lt;li&gt;Full RELRO or static compilation would prevent this attack fro…
590 &lt;li&gt;The LibC (or other library) version being attacked must be kno…
591 &lt;li&gt;Fairly good control over the size of allocations in order to g…
592 &lt;/ul&gt;
593
594 Being able to overwrite the size of an &lt;i&gt;mmap&lt;/i&gt; chunk is …
595 &lt;/p&gt;
596
597 &lt;h3&gt;
598 POC
599 &lt;/h3&gt;
600 &lt;p&gt;
601 Want to see an actual POC? As part of documenting this technique, the Gi…
602 &lt;/p&gt;
603
604 &lt;h2&gt;
605 Conclusion
606 &lt;/h2&gt;
607
608 &lt;p&gt;
609 Overall, this is an incredible technique for gaining code execution, alt…
610 &lt;/p&gt;
611
612 &lt;p&gt;
613 Major S/O's to the &lt;a href="https://dayzerosec.com/"&gt;Day[0]&lt;/a&…
614 &lt;/p&gt;
615 </description><guid isPermaLink="false">https://maxwelldulin.com/BlogPos…
616 Introduction
617 &lt;/h2&gt;
618
619 &lt;p&gt;
620 Have you ever discovered something amazing only to later realize that so…
621 &lt;/p&gt;
622
623 &lt;p&gt;
624 When I started looking for new ways to exploit the allocator via the &lt…
625 only to realize that there is a &lt;i&gt;fastbin&lt;/i&gt; variant of t…
626 &lt;/p&gt;
627
628 &lt;p&gt;
629 This post will (hopefully) have a POC in &lt;a href="https://github.com…
630 &lt;/p&gt;
631
632 &lt;p&gt;
633 Before we get to the meat of the technique, we will go over how the heap…
634 &lt;/p&gt;
635
636 &lt;h2&gt;
637 Chunks
638 &lt;/h2&gt;
639
640 &lt;p&gt;
641 Chunks are the main object that users interact with. There are two main …
642 &lt;div style="width: 98%; font-size:80%; text-align:center; float : lef…
643
644
645 The first field is the size of the previous chunk (prev_size). This is o…
646 &lt;/p&gt;
647
648 &lt;p&gt;
649 On an allocated (non-free) chunk, the third and fourth field are used as…
650 &lt;/p&gt;
651
652 &lt;h2&gt;
653 Bins
654 &lt;/h2&gt;
655
656 &lt;p&gt;When using Malloc, chunks that are freed are put into a local s…
657 &lt;/p&gt;
658
659 &lt;p&gt;
660 There are a multiple kinds of bins for different sizes and situations. A…
661 &lt;/p&gt;
662
663 &lt;h3&gt;
664 Fastbin
665 &lt;/h3&gt;
666
667 &lt;p&gt;
668 Prior to version 2.26 (current at 2.33), the fastbin was the first locat…
669 &lt;/p&gt;
670
671 &lt;p&gt;
672 Fastbins use a &lt;i&gt;singly linked list&lt;/i&gt;, while several of t…
673 &lt;/p&gt;
674
675 &lt;p&gt;
676 Only fastbins are necessary for understanding how this technique works. …
677 &lt;/p&gt;
678
679 &lt;h2&gt;Arenas&lt;/h2&gt;
680
681 &lt;p&gt;
682 Arenas are a &lt;code&gt;struct&lt;/code&gt; that is shared between thre…
683 &lt;/p&gt;
684
685 &lt;p&gt;
686 A single threaded process has a single arena called the &lt;i&gt;main ar…
687 &lt;/p&gt;
688
689 &lt;h3&gt;
690 Non-Main Arena Bit
691 &lt;/h3&gt;
692
693 &lt;p&gt;
694 First, we need to learn about the third bit of the &lt;i&gt;size&lt;/i&g…
695 &lt;/p&gt;
696
697 &lt;h3&gt;
698 Finding the Arena
699 &lt;/h3&gt;
700
701 &lt;p&gt;
702 &lt;div style="width: 500px; font-size:80%; text-align:center; padding: …
703 The &lt;a href="https://elixir.bootlin.com/glibc/glibc-2.23/source/mallo…
704 &lt;pre&gt;
705 #define arena_for_chunk(ptr) \
706 chunk_non_main_arena (ptr) ? \
707 heap_for_ptr (ptr)-&gt;ar_ptr : \
708 &amp;main_arena
709 &lt;/pre&gt;
710 &lt;/p&gt;
711
712 &lt;p&gt;
713 The else (second part of the conditional from the &lt;a href="https://ww…
714 &lt;/p&gt;
715
716 &lt;p&gt;
717 The first part of the conditional (line #3 above) is for a &lt;i&gt;non…
718 &lt;pre&gt;
719 #define heap_for_ptr(ptr) \
720 ((heap_info *) \
721 ((unsigned long) (ptr) &amp; \
722 ~(HEAP_MAX_SIZE - 1))) \
723 &lt;/pre&gt;
724 &lt;/p&gt;
725
726 &lt;p&gt;
727 The &lt;code&gt;heap_for_ptr&lt;/code&gt; macro takes the chunk being fr…
728 &lt;/p&gt;
729
730 &lt;p&gt;
731 This is quite clever! The user will always have a pointer to the malloc …
732 &lt;/p&gt;
733
734 &lt;p&gt;
735 To wrap this up, here are the important notes:
736 &lt;ul&gt;
737 &lt;li&gt;The &lt;code&gt;arena_for_chunk&lt;/code&gt; macro gets the ar…
738 &lt;li&gt; The &lt;i&gt;non-main arena&lt;/i&gt; bit specifies which fun…
739 &lt;li&gt;The &lt;i&gt;main arena&lt;/i&gt; is stored in a global variab…
740 &lt;/ul&gt;
741
742 For more information on GLibC arenas, sploitfun covers it extensively &l…
743 &lt;/p&gt;
744
745 &lt;h2&gt;
746 Flow of the Attack
747 &lt;/h2&gt;
748 &lt;p&gt;
749 The attack writes the pointer of a chunk being freed to a nearly arbitra…
750 &lt;/p&gt;
751
752 &lt;p&gt;
753 For the attack itself, it can be broken up into several stages:
754
755 &lt;ul&gt;
756 &lt;li&gt;Heap Feng Shui (aligning controllable data with &lt;code&gt;he…
757 &lt;li&gt;Creating a fake &lt;code&gt;heap_info&lt;/code&gt; and arena&…
758 &lt;li&gt;Corrupting a fastbin sized chunk&lt;/li&gt;
759 &lt;li&gt;Trigger the write via freeing the altered chunk&lt;/li&gt;
760 &lt;/ul&gt;
761
762 The steps for this attack will be broken down in the sections below.
763 &lt;/p&gt;
764
765 &lt;h2&gt;
766 Heap Feng Shui
767 &lt;/h2&gt;
768 &lt;p&gt;
769 As in the original House of Mind, our main goal is to create a fake aren…
770 &lt;/p&gt;
771
772 &lt;p&gt;
773 From looking at the macro &lt;code&gt;heap_for_ptr&lt;/code&gt; (shown a…
774 &lt;/p&gt;
775
776 &lt;h3&gt;
777 Alignment of Allocations
778 &lt;/h3&gt;
779 &lt;p&gt;
780 By allocating a large amount of chunks from the heap (ensure the size of…
781 All we have to do is manipulate the heap so that the
782 attacker controls the area of memory that the corrupted chunk is aligned…
783 &lt;/p&gt;
784
785 &lt;p&gt;
786 The &lt;code&gt;HEAP_MAX_SIZE&lt;/code&gt; value varies depending on man…
787 &lt;/p&gt;
788
789 &lt;p&gt;
790 Once we have a chunk at the proper location lined up, we need to setup t…
791 &lt;/p&gt;
792
793 &lt;h2&gt;
794 Setting Up Fake Heap_info
795 &lt;/h2&gt;
796
797 &lt;p&gt;
798 &lt;pre&gt;
799 typedef struct _heap_info
800 {
801 malloc_state ar_ptr; // Arena
802 ...
803 }
804 &lt;/pre&gt;
805
806 Once we have control of the aligned memory necessary for a &lt;code&gt;…
807 &lt;/p&gt;
808
809 &lt;h2&gt;
810 Fake Arena
811 &lt;/h2&gt;
812
813 &lt;h3&gt;
814 Fake Arena Location
815 &lt;/h3&gt;
816
817 &lt;p&gt;
818 From here, we will work backwards from the WRITE to the get to the prop…
819 &lt;/p&gt;
820
821 &lt;p&gt;
822 Because the fake arena is controlled directly by us and can be set to an…
823 &lt;/p&gt;
824
825 &lt;h3&gt;
826 Arena Writing Offset
827 &lt;/h3&gt;
828 &lt;p&gt;
829 &lt;pre&gt;
830 struct malloc_state
831 {
832 mutex_t mutex;
833 int flags; // Formly max_fast
834
835 mfastbinptr fastbinsY[NFASTBINS]; // Fastbins
836 ...
837 }
838 &lt;/pre&gt;
839 Besides the location of the arena, the writing of the chunk to a fastbin…
840 &lt;/p&gt;
841
842 &lt;p&gt;
843 Finally, we can deal with the fastbins offset itself. When the chunk is …
844 &lt;/p&gt;
845
846 &lt;p&gt;
847 When choosing the location of the arena, the offset (to overwrite the pr…
848 &lt;/p&gt;
849
850 &lt;h3&gt;
851 Numerical Example
852 &lt;/h3&gt;
853 &lt;p&gt;
854 Let's assume our target is the address &lt;code&gt;0x5555554444&lt;/code…
855 &lt;/p&gt;
856
857 &lt;p&gt;
858 At first, the subtraction on the location of the arena does not seem int…
859 &lt;/p&gt;
860
861 &lt;h3&gt;
862 Fixing the Size Sanity Check
863 &lt;/h3&gt;
864 &lt;p&gt;
865 &lt;pre&gt;
866 if next_chunk_size &lt;= 0x10 or
867 next_chunk_size &gt;= arena-&gt;system_mem
868
869 Crash
870 &lt;/pre&gt;
871
872 Using the fastbin variant of the House of Mind on recent versions of Lib…
873 &lt;/p&gt;
874
875 &lt;p&gt;
876 For the smaller end, the size of the &lt;i&gt;next chunk&lt;/i&gt; needs…
877 &lt;/p&gt;
878
879 &lt;p&gt;
880 The validation on the larger side is a little more complicated though. B…
881 &lt;/p&gt;
882
883 &lt;p&gt;
884 Once you find an alignment for the arena that has a proper value at the …
885 &lt;/p&gt;
886
887 &lt;h2&gt;
888 Corrupting a Fastbin Chunk
889 &lt;/h2&gt;
890
891 &lt;p&gt;
892 &lt;div style="width: 500px; font-size:80%; text-align:center; float: ri…
893 In order to force a fake arena to be used, we must free a chunk! So, wha…
894 &lt;ul&gt;
895 &lt;li&gt;Use the correct chunk size. This comes down to three things:
896 &lt;ul&gt;
897 &lt;li&gt;Setting up a size of the chunk being freed for the proper offs…
898 &lt;li&gt;Setting the chunk size to align with a valid &lt;code&gt;next_…
899 &lt;li&gt;Set the non-main arena bit (bit #3 as shown in figure 1) for a…
900 &lt;/li&gt;
901 &lt;/ul&gt;
902 &lt;/li&gt;
903 &lt;li&gt;The chunk MUST align down to the &lt;code&gt;HEAP_MAX_SIZE&lt;…
904 &lt;li&gt;Use the heap value being written in a smart way.&lt;/li&gt;
905 &lt;/ul&gt;
906
907
908 Everything above has already been discussed in previous sections besides…
909 &lt;/p&gt;
910
911 &lt;h3&gt;
912 Where to Write?
913 &lt;/h3&gt;
914 &lt;p&gt;
915 This is a WRITE-WHERE primitive. An attacker fully controls the &lt;i&gt…
916 &lt;/p&gt;
917
918 &lt;p&gt;
919 This primitive is usually a step in the chain, not the full exploit itse…
920 &lt;/p&gt;
921
922 &lt;p&gt;
923 The value being written is a heap memory pointer. Because this is a poin…
924 &lt;/p&gt;
925
926 &lt;h2&gt;
927 Boom Goes the Dynamite (Free)
928 &lt;/h2&gt;
929 &lt;p&gt;
930 &lt;center&gt;&lt;div style="width: 85%; font-size:80%; text-align:cente…
931
932 At this point, we have created the &lt;code&gt;heap_info&lt;/code&gt; st…
933 &lt;/p&gt;
934
935 &lt;h2&gt;
936 Profit
937 &lt;/h2&gt;
938 &lt;p&gt;
939 Once the chunk has been written, you can now use this to cause even more…
940 &lt;/p&gt;
941
942
943 &lt;h2&gt;
944 Pros &amp; Requirements
945 &lt;/h2&gt;
946
947 &lt;p&gt;
948 This attack allows for a WRITE-WHERE primitive of a heap pointer. This a…
949 &lt;/p&gt;
950 &lt;h3&gt;
951 Pros
952 &lt;/h3&gt;
953 &lt;p&gt;
954 &lt;ul&gt;
955 &lt;li&gt;
956 Works on all versions of Malloc! The bulk of techniques are version lock…
957 &lt;/li&gt;
958 &lt;li&gt;Only requires a single byte controlled value overflow of the s…
959 &lt;li&gt;Writes a large value to a nearly arbitrary location. This can …
960 &lt;li&gt;
961 Writes a heap pointer, which could be used in a similar way to the &lt;a…
962 &lt;/li&gt;
963 &lt;li&gt;If the vulnerability for corrupting the chunk can be triggered…
964 &lt;/ul&gt;
965 &lt;/p&gt;
966
967 &lt;h3&gt;
968 Requirements
969 &lt;/h3&gt;
970 &lt;p&gt;
971 Instead of a cons section, below is a list of requirements for this to w…
972 &lt;ul&gt;
973 &lt;li&gt;Ability to corrupt fastbin sized chunk size field. A single by…
974 &lt;li&gt;Known location to write to (fake arena location). This may req…
975
976 &lt;li&gt;Ability to create a fake &lt;code&gt;heap_info&lt;/code&gt; st…
977 &lt;ul&gt;
978 &lt;li&gt;An attacker needs to know their relative location on the heap …
979 &lt;li&gt;An attacker must be able to allocate a significant amount of h…
980 &lt;/li&gt;
981 &lt;/ul&gt;
982
983 &lt;li&gt;The overflown chunk MUST be in the &lt;i&gt;main arena&lt;/i&g…
984 &lt;li&gt;The next chunk (of the freed fastbin chunk) must be larger tha…
985 &lt;li&gt;The fake arena &lt;code&gt;system_mem&lt;/code&gt; value of th…
986 &lt;li&gt;With versions using TCache (2.26+), the TCache bin needs to be…
987 &lt;/ul&gt;
988
989 Although this feels like a lot of requirements, some of these are trivia…
990 &lt;/p&gt;
991
992 &lt;h2&gt;
993 Future Work
994 &lt;/h2&gt;
995
996 &lt;p&gt;
997 Heap exploitation techniques are awesome, but vastly complicated. Becau…
998 &lt;/p&gt;
999
1000 &lt;h2&gt;
1001 Conclusion
1002 &lt;/h2&gt;
1003 &lt;p&gt;
1004 This went from the heart-pounding &lt;i&gt;new discovery&lt;/i&gt; to a …
1005 &lt;/p&gt;
1006 &lt;p&gt;
1007 Feel free to reach out to me (contact information is in the footer) if y…
1008 &lt;/p&gt;</description><guid isPermaLink="false">https://maxwelldulin.c…
1009 The web is full of user reviewed rating websites that we trust with our …
1010 &lt;/p&gt;
1011
1012 &lt;p&gt;
1013 But, what if you could &lt;i&gt;sway&lt;/i&gt; the rating system? On Yel…
1014 &lt;/p&gt;
1015
1016 &lt;h2&gt;
1017 Vulnerability - The Case of Bad Input Validation
1018 &lt;/h2&gt;
1019
1020 &lt;h3&gt;
1021 Juice Shop Version
1022 &lt;/h3&gt;
1023
1024 &lt;p&gt;
1025 The company asked to remain anonymous and to have no screenshots of the …
1026 &lt;/p&gt;
1027
1028 &lt;p&gt;
1029 OWASP Juice Shop has a &lt;i&gt;customer feedback&lt;/i&gt; functionalit…
1030 &lt;/p&gt;
1031
1032 &lt;center&gt;&lt;div style="width:95%; font-size:80%; text-align:center…
1033
1034 &lt;p&gt;
1035 By changing the &lt;u&gt;rating&lt;/u&gt; to a non-expected value, such …
1036 The challenge for this is titled &lt;a href="https://github.com/apox64/O…
1037 &lt;/p&gt;
1038
1039 &lt;h3&gt;
1040 The Actual Site
1041 &lt;/h3&gt;
1042
1043 &lt;p&gt;
1044 The target website stores information about a location and allows for ra…
1045 &lt;/p&gt;
1046
1047 &lt;p&gt;
1048 This seemed like fertile testing ground to go through, as I remembered t…
1049 &lt;/p&gt;
1050
1051 &lt;h3&gt;
1052 Impact of Bug
1053 &lt;/h3&gt;
1054
1055 &lt;p&gt;
1056 Most rating systems are calculated by taking the &lt;i&gt;average&lt;/i&…
1057 &lt;/p&gt;
1058
1059 &lt;p&gt;
1060 In a community that relies upon the reviews of others, being able to hav…
1061 &lt;/p&gt;
1062
1063 &lt;h2&gt;
1064 Disclosure
1065 &lt;/h2&gt;
1066
1067 &lt;p&gt;
1068 From previous experiences, I am nervous when trying to report security …
1069 &lt;/p&gt;
1070
1071 &lt;p&gt;
1072 My initial communication with the company was to a senior engineer over …
1073 &lt;/p&gt;
1074
1075 &lt;p&gt;
1076 Since the initial LinkedIn message only allows for only 300 characters, …
1077 &lt;/p&gt;
1078
1079 &lt;p&gt;
1080 After this, the CTO of the company added me on LinkedIn and thanked me f…
1081 &lt;/p&gt;
1082
1083 &lt;h2&gt;
1084 Conclusion
1085 &lt;/h2&gt;
1086
1087 &lt;p&gt;
1088 Vulnerabilities are not always complicated injection attacks. Commonly, …
1089 &lt;/p&gt;
1090
1091 &lt;p&gt;
1092 Feel free to reach out to me (contact information is in the footer) if y…
1093 &lt;/p&gt;</description><guid isPermaLink="false">https://maxwelldulin.c…
1094 The root cause of many vulnerabilities are from the mishandling of numbe…
1095 &lt;/p&gt;
1096
1097 &lt;p&gt;
1098 Recently quite a few findings have caught my attention that fall into th…
1099 &lt;/p&gt;
1100
1101 &lt;p&gt;
1102 Yes, yes they can! GCC and Clang have compilation flags to find several …
1103 &lt;/p&gt;
1104
1105 &lt;h2&gt;
1106 Bug Classes
1107 &lt;/h2&gt;
1108 &lt;p&gt;
1109 The goal is to change a number in a way that the program does not expect…
1110 &lt;ul&gt;
1111 &lt;li&gt;&lt;b&gt;Overflow/underflow&lt;/b&gt;: Integers will simply wr…
1112 &lt;li&gt;&lt;b&gt;Truncation&lt;/b&gt;: Shrinking the storage capacity …
1113 &lt;li&gt;&lt;b&gt;Signedness conversion&lt;/b&gt;: Numbers are either s…
1114 &lt;/ul&gt;
1115 &lt;/p&gt;
1116
1117 &lt;!-break--&gt;
1118
1119 &lt;h2&gt;
1120 Static Analysis
1121 &lt;/h2&gt;
1122
1123 &lt;p&gt;
1124 Two of these bug classes can be determined at &lt;i&gt;compile time&lt;/…
1125 &lt;/p&gt;
1126
1127 &lt;h3&gt;
1128 Truncation
1129 &lt;/h3&gt;
1130
1131 &lt;p&gt;
1132
1133 &lt;div style="width:100%; box-sizing: border-box; display: flex; border…
1134 &lt;div style = "flex: 45%; margin: 6px"
1135 &gt;&lt;img src="https://live.staticflickr.com/65535/51444718168_8df5903…
1136 &lt;br/&gt;
1137 &lt;div style = "flex: 45%; margin: 6px"&gt;&lt;img src="https://live.st…
1138 &lt;/div&gt;
1139 &lt;/p&gt;
1140
1141 &lt;p&gt;
1142 Using the &lt;code&gt;Wconversion&lt;/code&gt; flag during compilation w…
1143 &lt;/p&gt;
1144
1145 &lt;p&gt;
1146 For example, code for the &lt;i&gt;truncation &lt;/i&gt; case can seen i…
1147 &lt;br/&gt;&lt;br/&gt;&lt;br/&gt;
1148 &lt;/p&gt;
1149
1150 &lt;p&gt;
1151 &lt;center&gt;
1152 &lt;div style="border: 1px solid black; margin: 10px; border-radius: 10p…
1153 &lt;img src="https://live.staticflickr.com/65535/51444209760_44eca2b1ff_…
1154 &lt;center&gt;Figure 3 - Truncation warning message&lt;/center&gt;&lt;/d…
1155 &lt;/center&gt;
1156 &lt;/p&gt;
1157
1158 &lt;p&gt;
1159 Another interesting item to consider is the case with &lt;code&gt;float&…
1160 &lt;/p&gt;
1161
1162 &lt;h3&gt;
1163 Signedness
1164 &lt;/h3&gt;
1165 &lt;p&gt;
1166 The &lt;code&gt;Wconversion&lt;/code&gt; flag can also be used in the de…
1167
1168 &lt;center&gt;
1169 &lt;div style="border: 1px solid black; margin: 10px; border-radius: 10p…
1170 &lt;img src="https://live.staticflickr.com/65535/51442547757_542b8beab9_…
1171 &lt;center&gt;Figure 4 - Signedness conversion warning message &lt;/cent…
1172 &lt;/center&gt;
1173 &lt;/p&gt;
1174
1175 &lt;h3&gt;
1176 Static Analysis Wrap Up
1177 &lt;/h3&gt;
1178 &lt;p&gt;
1179 These flags only check for &lt;i&gt;implicit&lt;/i&gt; conversions. Some…
1180 &lt;/p&gt;
1181
1182 &lt;p&gt;
1183 Although we have only been using &lt;code&gt;Wconversion&lt;/code&gt; fo…
1184 &lt;/p&gt;
1185
1186 &lt;h2&gt;
1187 Dynamic Instrumentation
1188 &lt;/h2&gt;
1189 &lt;p&gt;
1190 The static analysis is likely to pull up mostly false positives with a f…
1191 &lt;/p&gt;
1192
1193 &lt;h3&gt;
1194 ftrapv
1195 &lt;/h3&gt;
1196 &lt;p&gt;
1197 This option generates traps for signed overflows on addition, subtractio…
1198 &lt;pre&gt;
1199 int main(){
1200 int a = 0x7FFFFFFF;
1201 a = a + 1;
1202 printf("Value: %d\n", a);
1203 }
1204 &lt;/pre&gt;
1205 &lt;/p&gt;
1206
1207 &lt;p&gt;
1208 The code above will cause an integer overflow when the line &lt;code&gt;…
1209 &lt;/p&gt;
1210
1211 &lt;p&gt;
1212 It should also be noted that this flag detects &lt;a href="https://githu…
1213 &lt;/p&gt;
1214
1215 &lt;h3&gt;
1216 fsanitize=integer
1217 &lt;/h3&gt;
1218 &lt;p&gt;
1219 The &lt;a href="https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.h…
1220 &lt;/p&gt;
1221
1222 &lt;p&gt;
1223 While the &lt;code&gt;ftrapv&lt;/code&gt; catches only &lt;i&gt;signed&l…
1224 &lt;/p&gt;
1225
1226 &lt;p&gt;
1227 Besides the discovering of overflow/underflows in programs, we can find …
1228 &lt;/p&gt;
1229
1230 &lt;p&gt;
1231 Let's see this in action though! We will use the original signedness iss…
1232 &lt;/p&gt;
1233
1234 &lt;p&gt;
1235 &lt;center&gt;
1236 &lt;div style="border: 1px solid black; margin: 10px; border-radius: 10p…
1237 &lt;img src="
1238 https://live.staticflickr.com/65535/51444688718_88c594fa3e_b.jpg" width=…
1239 &lt;center&gt;Figure 5 - Truncation Conversion Crash&lt;/center&gt;&lt;/…
1240 &lt;/center&gt;
1241 &lt;/p&gt;
1242
1243 &lt;h2&gt;
1244 Are We Missing Anything?
1245 &lt;/h2&gt;
1246 &lt;p&gt;
1247 We have mentioned dynamic and static checks for integer overflows/underf…
1248 &lt;/p&gt;
1249
1250 &lt;p&gt;
1251 When a float is overflowed in C, it goes to &lt;a href="https://github.c…
1252 &lt;/p&gt;
1253
1254 &lt;p&gt;
1255 An additional uncaught bug is float truncation. For instance, the conver…
1256 &lt;/p&gt;
1257
1258 &lt;p&gt;Knowing about floats becoming &lt;code&gt;inf&lt;/code&gt; and…
1259 &lt;/p&gt;
1260
1261 &lt;h2&gt;
1262 Conclusion
1263 &lt;/h2&gt;
1264 &lt;p&gt;
1265 When trying to find vulnerabilities, any help from automated tools or in…
1266 &lt;/p&gt;
1267
1268 &lt;p&gt;
1269 I hope the knowledge of these compilation warnings and dynamic instrumen…
1270
You are viewing proxied material from codemadness.org. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.