sexta-feira, 21 de agosto de 2020

C++ Std::String Buffer Overflow And Integer Overflow

Interators are usually implemented using signed integers like the typical "for (int i=0; ..." and in fact is the type used indexing "cstr[i]", most of methods use the signed int, int by default is signed.
Nevertheless, the "std::string::operator[]" index is size_t which is unsigned, and so does size(), and same happens with vectors.
Besides the operator[] lack of negative index control, I will explain this later.

Do the compilers doesn't warn about this?


If his code got a large input it would index a negative numer, let see g++ and clang++ warnings:



No warnings so many bugs out there...

In order to reproduce the crash we can load a big string or vector from file, for example:


I've implemented a loading function, getting the file size with tellg() and malloc to allocate the buffer, then in this case used as a string.
Let see how the compiler write asm code based on this c++ code.



So the string constructor, getting size and adding -2 is clear. Then come the operator<< to concat the strings.
Then we see the operator[] when it will crash with the negative index.
In assembly is more clear, it will call operator[] to get the value, and there will hapen the magic dereference happens. The operator[] will end up returning an invalid address that will crash at [RAX]



In gdb the operator[] is a  allq  0x555555555180 <_znst7__cxx1112basic_stringicst11char_traitsicesaiceeixem plt="">

(gdb) i r rsi
rsi            0xfffffffffffefffe  -65538


The implmementation of operator ins in those functions below:

(gdb) bt
#0  0x00007ffff7feebf3 in strcmp () from /lib64/ld-linux-x86-64.so.2
#1  0x00007ffff7fdc9a5 in check_match () from /lib64/ld-linux-x86-64.so.2
#2  0x00007ffff7fdce7b in do_lookup_x () from /lib64/ld-linux-x86-64.so.2
#3  0x00007ffff7fdd739 in _dl_lookup_symbol_x () from /lib64/ld-linux-x86-64.so.2
#4  0x00007ffff7fe1eb7 in _dl_fixup () from /lib64/ld-linux-x86-64.so.2
#5  0x00007ffff7fe88ee in _dl_runtime_resolve_xsavec () from /lib64/ld-linux-x86-64.so.2
#6  0x00005555555554b3 in main (argc=2, argv=0x7fffffffe118) at main.cpp:29

Then crashes on the MOVZX EAX, byte ptr [RAX]

Program received signal SIGSEGV, Segmentation fault.
0x00005555555554b3 in main (argc=2, argv=0x7fffffffe118) at main.cpp:29
29     cout << "penultimate byte is " << hex << s[i] << endl;
(gdb)


What about negative indexing in std::string::operator[] ?
It's exploitable!

In a C char array is known that having control of the index, we can address memory.
Let's see what happens with C++ strings:






The operator[] function call returns the address of string plus 10, and yes, we can do abitrary writes.



Note that gdb displays by default with at&t asm format wich the operands are in oposite order:


And having a string that is in the stack, controlling the index we can perform a write on the stack.



To make sure we are writing outside the string, I'm gonna do 3 writes:


 See below the command "i r rax" to view the address where the write will be performed.


The beginning of the std::string object is 0x7fffffffde50.
Write -10 writes before the string 0x7fffffffde46.
And write -100 segfaults because is writting in non paged address.



So, C++ std::string probably is not vulnerable to buffer overflow based in concatenation, but the std::string::operator[] lack of negative indexing control and this could create vulnerable and exploitable situations, some times caused by a signed used of the unsigned std::string.size()










Related news

  1. Pentest Tools Download
  2. How To Install Pentest Tools In Ubuntu
  3. Hack Tools
  4. Hacking Tools Usb
  5. Pentest Tools Online
  6. Pentest Tools
  7. Hacker Tools List
  8. Pentest Tools For Windows
  9. Pentest Tools Android
  10. Hacking Tools Online
  11. New Hack Tools
  12. Hacking Tools For Windows 7
  13. Pentest Tools For Android
  14. Pentest Tools Tcp Port Scanner
  15. Hacking Tools Download
  16. Pentest Tools Port Scanner
  17. Hacker Techniques Tools And Incident Handling
  18. Hacking Tools Hardware
  19. How To Hack
  20. Pentest Tools Subdomain
  21. Hacking Tools Usb
  22. Hacking Tools For Windows Free Download
  23. Pentest Tools Free
  24. Pentest Box Tools Download
  25. Pentest Tools Github
  26. Github Hacking Tools
  27. Hacking App
  28. Pentest Tools List
  29. Hacking Tools Name
  30. Pentest Recon Tools
  31. Hack Tools Github
  32. Hacker Tools Free Download
  33. How To Install Pentest Tools In Ubuntu
  34. Hacking Tools 2019
  35. Hacker Tools List
  36. Hacking Tools 2020
  37. Hacker Tool Kit
  38. Tools 4 Hack
  39. How To Make Hacking Tools
  40. Hacking Tools For Windows 7
  41. Nsa Hack Tools Download
  42. Install Pentest Tools Ubuntu
  43. Pentest Tools For Android
  44. Easy Hack Tools
  45. Pentest Tools Free
  46. Hacker Tools 2020
  47. Hak5 Tools
  48. Hacking Tools For Pc
  49. Hacker Hardware Tools
  50. Best Pentesting Tools 2018
  51. Hack Tools Download
  52. Hack Tools For Windows
  53. Best Hacking Tools 2019
  54. Hacking Tools Download
  55. Hacker Tools For Ios
  56. New Hacker Tools
  57. Hacker Search Tools
  58. Pentest Tools Tcp Port Scanner
  59. Hacker Tools Mac
  60. Hack Tools Download
  61. Hack Tool Apk No Root
  62. Pentest Tools Android
  63. Hacking Tools Windows
  64. Hack Tools Github
  65. Physical Pentest Tools
  66. Pentest Tools List
  67. Hacks And Tools
  68. Pentest Tools For Mac
  69. Pentest Tools Download
  70. Tools Used For Hacking
  71. Hacker Tools For Mac
  72. Hacker Tools Free
  73. Hacker Tools Mac
  74. Hacking Apps
  75. Underground Hacker Sites
  76. Hacker Tools Mac
  77. Hacking Tools And Software
  78. Bluetooth Hacking Tools Kali
  79. Pentest Tools Url Fuzzer
  80. Nsa Hack Tools
  81. Hacker Tools For Ios
  82. Hacker Tools Apk
  83. Pentest Tools Port Scanner
  84. Pentest Tools For Mac
  85. Tools 4 Hack
  86. Pentest Tools Kali Linux
  87. Hacker Tools Free
  88. Hack Tool Apk No Root
  89. Hack Tools For Mac
  90. Pentest Tools Port Scanner
  91. Pentest Tools Tcp Port Scanner
  92. Hackers Toolbox
  93. Underground Hacker Sites
  94. Hacker Tools Windows
  95. Hacker Tools
  96. Pentest Tools List
  97. Hacking Tools Download
  98. Hacker Tools Free
  99. Game Hacking
  100. Hack Tools For Games
  101. Pentest Tools Bluekeep
  102. Install Pentest Tools Ubuntu
  103. Hacking Tools For Windows
  104. Hack Tool Apk No Root
  105. Hacker Hardware Tools
  106. Pentest Tools For Mac
  107. Pentest Tools Bluekeep
  108. Pentest Tools Kali Linux
  109. Pentest Tools Website
  110. Top Pentest Tools
  111. Kik Hack Tools
  112. Pentest Tools Tcp Port Scanner
  113. Hack And Tools
  114. Hacking Tools For Mac
  115. Hacker Tools Apk Download
  116. Hacker Tools For Ios
  117. Wifi Hacker Tools For Windows
  118. Hacker Tools For Mac
  119. Game Hacking
  120. Hacking Tools 2019
  121. Hack Tools Mac
  122. Hacker
  123. Hacker Tools Hardware
  124. Hacking Tools For Mac
  125. Pentest Tools Alternative
  126. Hacking Tools For Beginners
  127. Hack Tools
  128. Hacking Tools Online
  129. Hacker
  130. New Hack Tools
  131. Pentest Reporting Tools
  132. Game Hacking
  133. Hacking Tools Download
  134. Hacker Tools Github

Nenhum comentário: