6 ms·

I'd be extremely impressed if someone actually managed to get RCE out of this, considering you'd only be able to use '0' through '9', or 0x30 through 0x39, in y

I'd be extremely impressed if someone actually managed to get RCE out of this, considering you'd only be able to use '0' through '9', or 0x30 through 0x39, in your payload.

cozzyd 6y ago
Perhaps . too?
mleonhard 6y ago
If the float is part of an error message or logging message, the attacker may control portions of the string that appear after the float. This would let them inject a much larger range of bytes, perhaps even UTF-8.
- duckerude 6y ago
  It's not that powerful, if I'm reading it correctly: https://github.com/python/cpython/commit/34df10a9a16b38d54421eeeaf73ec89828563be7 https://github.com/python/cpython/commit/34df10a9a16b38d5442... The sprintf is to a temporary buffer that's converted to a PyUnicode object before returning, so subsequent portions of the string are written elsewhere.
herendin2 6y ago
It sounds like an extreme minimal instruction set computer (MISC), and it's surprising how much is possible with even just one or two opcodes - that can easily be Turing-complete
- SilasX 6y ago
  Semi-related: I discovered that you can divert control flow to an arbitrary point on the TI MSP430 using only the bytes in ascii alphanumeric range. https://docs.google.com/presentation/d/19K7SK1L49reoFgjEPKCFCPsJeL_p2coMAVlCLpzbriw/edit https://docs.google.com/presentation/d/19K7SK1L49reoFgjEPKCF...
jordyzomer 6y ago
Hey! Original discoverer here. I would like to clarify some things. It would certainly be possible given that we can have numeric shell-code (check the reference). The real problem in here is the security mechanisms like stack cookies, brute-forcing those would have been a PITA with only numbers. But I'd have to take a closer look at the stack god knows what GCC could have done there :) On a system without these protection mechanisms it would be a easy win. Reference: https://haxx.in/posts/numeric-shellcode/ https://haxx.in/posts/numeric-shellcode/
- Sohcahtoa82 6y ago
  Wow that's very impressive.

I'd be extremely impressed if someone actually managed to get RCE out of this, considering you'd only be able to use '0' through '9', or 0x30 through 0x39, in your payload.

cozzyd 6y ago

Perhaps . too?

mleonhard 6y ago

If the float is part of an error message or logging message, the attacker may control portions of the string that appear after the float. This would let them inject a much larger range of bytes, perhaps even UTF-8.

duckerude 6y ago
It's not that powerful, if I'm reading it correctly: https://github.com/python/cpython/commit/34df10a9a16b38d54421eeeaf73ec89828563be7 https://github.com/python/cpython/commit/34df10a9a16b38d5442... The sprintf is to a temporary buffer that's converted to a PyUnicode object before returning, so subsequent portions of the string are written elsewhere.

herendin2 6y ago

It sounds like an extreme minimal instruction set computer (MISC), and it's surprising how much is possible with even just one or two opcodes - that can easily be Turing-complete

SilasX 6y ago
Semi-related: I discovered that you can divert control flow to an arbitrary point on the TI MSP430 using only the bytes in ascii alphanumeric range. https://docs.google.com/presentation/d/19K7SK1L49reoFgjEPKCFCPsJeL_p2coMAVlCLpzbriw/edit https://docs.google.com/presentation/d/19K7SK1L49reoFgjEPKCF...

jordyzomer 6y ago

Hey! Original discoverer here. I would like to clarify some things. It would certainly be possible given that we can have numeric shell-code (check the reference). The real problem in here is the security mechanisms like stack cookies, brute-forcing those would have been a PITA with only numbers. But I'd have to take a closer look at the stack god knows what GCC could have done there :) On a system without these protection mechanisms it would be a easy win. Reference: https://haxx.in/posts/numeric-shellcode/ https://haxx.in/posts/numeric-shellcode/

Sohcahtoa82 6y ago
Wow that's very impressive.