4 ms·
> Well, to be fair, if you don't want your binaries exploited, don't write the exploit into them. That's a bit naive and not the point of this PoC. The exploit
by _ak 13y ago
> Well, to be fair, if you don't want your binaries exploited, don't write the exploit into them.
That's a bit naive and not the point of this PoC. The exploit used a bug in the code generator. Normally, guard code would have been generated that would have caught that issue, but it just wasn't, and that's why the exploit worked.
So in theory, every program with that particular programming bug and the missing guard code (due to the code generator bug) is vulnerable.
- StavrosK 13y agoVulnerable to what? As far as I can see, it will crash or corrupt memory when it tries to read/write to it. An actual exploit of this requires intent.
- _ak 13y ago"Never ascribe to malice that which is adequately explained by incompetence" Imagine a programmer has a shitty day, lacks concentration, and adds code like this to his internet-facing server app: type Embedded struct { offset [0x400100]byte address uint32 } type Struct struct { *Embedded bar int } var instance Struct Later in the code, he forgets to initialize instance.Embedded. When handling an HTTP request that comes from the internet, instance.Embedded.address is filled from a GET parameter. Et voila, anyone who can do a GET request can overwrite memory, possibly leading to code execution. The bug in the code was unintentional, because programmers (like all humans) make mistakes, the HTTP request was intentional (it was done by the attacker), and the exploit worked because of a bug in the code generation. That's what I meant by vulnerable.
- StavrosK 13y agoAh, okay. I think this particular exploit falls a bit too far into the "you have to work to make it useful" spectrum (the "offset [0x400100]byte" part), but I see how it might be exploitable, thanks.
- saidajigumi 13y agoIt's also worth remembering that a complete exploit can often compose numerous "small" vulnerabilities into the realized breach. As such, it's easy to discount a seemingly hard-to-exploit vulnerability until you see it in action. It may be used in concert with other weaknesses or "widened" by an unforeseen technique. As a specific example, check out the two-part wrap-up of the Pwnium browser hacking competition[1] [2]. It's a great illustration of chaining weaknesses together to achieve a desired exploit. [1] http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.html http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.h... [2] http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.html http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.h...
- StavrosK 13y agoOh wow, that guy exploited 14 bugs to craft the exploit. That's some work...