6 ms·
Exploiting a Go Binary
- bishop_mandible 13y agoNon-executable heap and stack in Go 1.1 - nice!
- gngeal 13y agoHuh, there goes my plan to write a dynamic assembler in Go...
- snaky 13y agoLike a DynASM?
- gngeal 13y agoWell, more like iburg, I guess.
- cthom06 13y agoYou can still use mmap/equivalent to allocate executable memory and package unsafe to use it; the difference is that the memory allocated normally by the runtime won't be executable. Or I missed the sarcasm.
- gngeal 13y agoWhat sarcasm? Well, if I could mmap it, that would be fine, although it would mean that I'd have to manage the memory for the machine code fragments by hand, as opposed to having them as part of GCd values.
- laumars 13y agoThis is what should happen in IT. Someone looks for a vulnerability; find it. Determine if the project owners need prior warning; then go public. Everyone becomes aware of the issue and upgrades their systems accordingly. Problem solved. Criminalizing those who are only looking to harden the security of public facing infrastructures from those who don't have good intentions doesn't help anyone. And while I'm sure that Geohot and Reece took on this challenge as more of a fun exercise, we've all benefited from the results. So I look forward to reading more articles where hackers attempt to exploit Go binaries; and subsequently how to avoid my own Go binaries from being exploited the same way. (i should add, this is a more generalized comment. I'm aware that this specific attack isn't a practical real-world vulnerability)
- StavrosK 13y agoWell, to be fair, if you don't want your binaries exploited, don't write the exploit into them. I can't see a case where this could be used, unless you're letting people execute arbitrary code on your system, in which case you're screwed anyway.
- laumars 13y ago> Well, to be fair, if you don't want your binaries exploited, don't write the exploit into them. That was my point. But without researchers investigating potential exploits, then developers have a harder time writing secure code.
- StavrosK 13y agoHmm, I must be missing something. This isn't a normal binary that can be exploited by a malicious user. This is a binary that exploits the compiler to write to memory to places it shouldn't. This can only happen if the developer is malicious relatively to the compiler. Since you're the developer, and you're trying to avoid this exploit happening to you, there's no need to worry: Just don't perform the exploit. It sounds to me like you're saying "we need to have more research so I can avoid exploiting the Go compiler".
- cheez 13y agoYou don't automatically get ripped without working out. Same way, software doesn't become secure without being attacked. It may seem pointless to you, but it makes the ecosystem stronger.
- laumars 13y ago> Hmm, I must be missing something. Yes, you missed the part where I said this that was a generalised comment and that I'm aware this specific attack isn't a practical real-world vulnerability. What you're doing is that typical thing that people do online when they're so busy trying to assert their intellectual superiority that you completely miss the point that was being raised.
- tptacek 13y agoTo be clear: this is an attack that works if you're compiling and executing malicious Golang code, as if it were Javascript.
- NateDad 13y agoOr if you happen to have some fairly odd code in your executable. All that this really needs is really big array of bytes in one struct of your code. While anything that big should be unusual, you never know what crazy stuff people will write.
- tptacek 13y agoOdd code like that will crash your executable, and may set up the conditions for some other exploit, but this one requires the code to be very specifically written to maliciously overwrite a function pointer.
- pcwalton 13y agoWhat if, instead of a function pointer, an interface happened to be at that address? Given that interfaces are extremely common in Go, it seems plausible to me that many addresses in the heap could contain interfaces (and if they don't, then it may be possible to manipulate an application to create many interfaces so that they do). An attacker could overwrite the vtable pointer to point to attacker-supplied memory, and then an indirect call through the vtable could jump to shellcode.
- tptacek 13y agoSure, that's a plausible vulnerability concept for Go. Someone just has to find a way to do that. :)
- deleted 13y ago[deleted]
- AYBABTME 13y agoFor some reason, the website is not loading here and Google's cache dates from before the release of the exploit, so the post is hidden. Anybody has a mirror or some way to access the post?
- _ak 13y agoIt was accidently deleted. https://groups.google.com/d/msg/golang-nuts/wZILkqFbbus/j9WqQZQdaGwJ https://groups.google.com/d/msg/golang-nuts/wZILkqFbbus/j9Wq...
- onlydnaq 13y agoIf we are writing programs to write to arbitrary memory, wouldn't it be easier to write them in C? :) int main(int argc, char *argv) { *((char *)addr_to_write) = val_to_write; } On a more serious note: this is a fun compiler bug, but I wouldn't call it a valid exploit. If you have the power to run your own binary on a system, then of course you can write to any memory the process has access to.
- tptacek 13y agoIt's valid in the sense of, if you tried to use an in-language sandbox to keep people from running arbitrary code on your machine, this would bypass it.
- ancarda 13y agoI'm a little confused, does this work on 64-bit binaries too?
- mvzink 13y agoI'm really excited to see people working on security in Go. Security by default is supposed to be one of Go's "features" at some level. (The typical example: your first several C programs probably had many buffer overflow vulnerabilities, but it's very likely none of your Go programs ever will.) Still, Go hasn't been very thoroughly tested and security hardened, so I'm hoping to see many more exploits like this discovered and ironed out in the near future.