4 ms·

I'm far from an expert security pentester but I know my basics... and I'm always amazed at how simple these exploits are. Guys, come on, it's 2014, if you're wr

by Morgawr 13y ago

I'm far from an expert security pentester but I know my basics... and I'm always amazed at how simple these exploits are. Guys, come on, it's 2014, if you're writing C and using strcat/strcpy/sprintf/fprintf/etcetc with non-sanitized input, you're pretty much asking for it. Even a rookie would spot such mistake and exploit it, it's always among the first obstacles to bypass at local CTFs and it's the #1 exploit that people think about when they think about a "security vulnerability".

ksk 13y ago
Well, its not quite that easy for a rookie as you say. Just because you can trigger a buffer overflow bug does not mean you can exploit it. Most modern processors will allow disabling execution with an IP-on-Stack test. Thats assuming you can actually control the IP... , and assuming you can actually deliver the payload in the corrupted program state and not crash the program, etc etc..
- annnnd 13y ago
  Even a rookie would spot this mistake, but he would need to learn a lot before exploiting it. But with a nice target like this one... :)
  - ksk 13y ago
    I don't agree that this is a valuable target. AFAIK most consumer routers disable access to the web interface from outside the LAN range (by default).
    - Stamy 13y ago
      Yes but you can break almost any routers wifi password in 24hrs.
      - sp332 13y ago
        But you have to be in range of the wifi to do it. This isn't something that's going to be a widespread problem.
    - pixl97 13y ago
      And now your weakest device can CSRF remote access back on. Most people don't take their router in to a repair shop when the get a virus on their computer.
pjmlp 13y ago
On top of that, if one really needs to use C, then: - Enable all warnings as errors - Sanitize all inputs via assertions, or similar - Provide proper unit tests - Have a static analyzer configured for the continuous build that breaks the build if issues are found - Specially don't allow anything to go through the static analyzer that is labeled as undefined or compiler specific according to the ANSI/ISO C standard - Read MISRA C

by Morgawr 13y ago

ksk 13y ago

Well, its not quite that easy for a rookie as you say. Just because you can trigger a buffer overflow bug does not mean you can exploit it. Most modern processors will allow disabling execution with an IP-on-Stack test. Thats assuming you can actually control the IP... , and assuming you can actually deliver the payload in the corrupted program state and not crash the program, etc etc..

annnnd 13y ago
Even a rookie would spot this mistake, but he would need to learn a lot before exploiting it. But with a nice target like this one... :)
- ksk 13y ago
  I don't agree that this is a valuable target. AFAIK most consumer routers disable access to the web interface from outside the LAN range (by default).
  - Stamy 13y ago
    Yes but you can break almost any routers wifi password in 24hrs.
    - sp332 13y ago
      But you have to be in range of the wifi to do it. This isn't something that's going to be a widespread problem.
  - pixl97 13y ago
    And now your weakest device can CSRF remote access back on. Most people don't take their router in to a repair shop when the get a virus on their computer.

pjmlp 13y ago

On top of that, if one really needs to use C, then: - Enable all warnings as errors - Sanitize all inputs via assertions, or similar - Provide proper unit tests - Have a static analyzer configured for the continuous build that breaks the build if issues are found - Specially don't allow anything to go through the static analyzer that is labeled as undefined or compiler specific according to the ANSI/ISO C standard - Read MISRA C