domingo, 28 de enero de 2024

C++ Std::String Buffer Overflow And Integer Overflow

Interators are usually implemented using signed integers like the typical "for (int i=0; ..." and in fact is the type used indexing "cstr[i]", most of methods use the signed int, int by default is signed.
Nevertheless, the "std::string::operator[]" index is size_t which is unsigned, and so does size(), and same happens with vectors.
Besides the operator[] lack of negative index control, I will explain this later.

Do the compilers doesn't warn about this?


If his code got a large input it would index a negative numer, let see g++ and clang++ warnings:



No warnings so many bugs out there...

In order to reproduce the crash we can load a big string or vector from file, for example:


I've implemented a loading function, getting the file size with tellg() and malloc to allocate the buffer, then in this case used as a string.
Let see how the compiler write asm code based on this c++ code.



So the string constructor, getting size and adding -2 is clear. Then come the operator<< to concat the strings.
Then we see the operator[] when it will crash with the negative index.
In assembly is more clear, it will call operator[] to get the value, and there will hapen the magic dereference happens. The operator[] will end up returning an invalid address that will crash at [RAX]



In gdb the operator[] is a  allq  0x555555555180 <_znst7__cxx1112basic_stringicst11char_traitsicesaiceeixem plt="">

(gdb) i r rsi
rsi            0xfffffffffffefffe  -65538


The implmementation of operator ins in those functions below:

(gdb) bt
#0  0x00007ffff7feebf3 in strcmp () from /lib64/ld-linux-x86-64.so.2
#1  0x00007ffff7fdc9a5 in check_match () from /lib64/ld-linux-x86-64.so.2
#2  0x00007ffff7fdce7b in do_lookup_x () from /lib64/ld-linux-x86-64.so.2
#3  0x00007ffff7fdd739 in _dl_lookup_symbol_x () from /lib64/ld-linux-x86-64.so.2
#4  0x00007ffff7fe1eb7 in _dl_fixup () from /lib64/ld-linux-x86-64.so.2
#5  0x00007ffff7fe88ee in _dl_runtime_resolve_xsavec () from /lib64/ld-linux-x86-64.so.2
#6  0x00005555555554b3 in main (argc=2, argv=0x7fffffffe118) at main.cpp:29

Then crashes on the MOVZX EAX, byte ptr [RAX]

Program received signal SIGSEGV, Segmentation fault.
0x00005555555554b3 in main (argc=2, argv=0x7fffffffe118) at main.cpp:29
29     cout << "penultimate byte is " << hex << s[i] << endl;
(gdb)


What about negative indexing in std::string::operator[] ?
It's exploitable!

In a C char array is known that having control of the index, we can address memory.
Let's see what happens with C++ strings:






The operator[] function call returns the address of string plus 10, and yes, we can do abitrary writes.



Note that gdb displays by default with at&t asm format wich the operands are in oposite order:


And having a string that is in the stack, controlling the index we can perform a write on the stack.



To make sure we are writing outside the string, I'm gonna do 3 writes:


 See below the command "i r rax" to view the address where the write will be performed.


The beginning of the std::string object is 0x7fffffffde50.
Write -10 writes before the string 0x7fffffffde46.
And write -100 segfaults because is writting in non paged address.



So, C++ std::string probably is not vulnerable to buffer overflow based in concatenation, but the std::string::operator[] lack of negative indexing control and this could create vulnerable and exploitable situations, some times caused by a signed used of the unsigned std::string.size()










Read more
  1. Hacker Search Tools
  2. Termux Hacking Tools 2019
  3. Ethical Hacker Tools
  4. Pentest Tools Website Vulnerability
  5. Pentest Tools Android
  6. Hacking Tools Windows
  7. Pentest Tools Nmap
  8. Hack Tools Download
  9. Nsa Hack Tools Download
  10. Hacking Tools Pc
  11. Hacker Tools Software
  12. Pentest Tools Apk
  13. Hacker Tools For Mac
  14. Hacker Tools 2019
  15. Hacker Tool Kit
  16. Hack Tools For Pc
  17. Best Hacking Tools 2020
  18. Hacking Tools Usb
  19. Pentest Tools List
  20. How To Install Pentest Tools In Ubuntu
  21. New Hack Tools
  22. Best Hacking Tools 2019
  23. Hacking Tools 2019
  24. Nsa Hack Tools Download
  25. Best Pentesting Tools 2018
  26. Hackrf Tools
  27. Hacker Tools Free Download
  28. Hacker Techniques Tools And Incident Handling
  29. Hacker Tools Github
  30. Hack Tools Github
  31. Hack Tool Apk No Root
  32. Pentest Box Tools Download
  33. Pentest Tools List
  34. Nsa Hacker Tools
  35. Hacker Tool Kit
  36. Hack Tools For Pc
  37. Underground Hacker Sites
  38. Hacking App
  39. Hacking Tools 2019
  40. Hacker Tools Free Download
  41. Hackrf Tools
  42. Hack App
  43. Pentest Box Tools Download
  44. Hacker Tools
  45. Tools 4 Hack
  46. Nsa Hack Tools
  47. Pentest Tools List
  48. Github Hacking Tools
  49. Install Pentest Tools Ubuntu
  50. Hacking Tools Pc
  51. Hack Tools
  52. Pentest Tools For Ubuntu
  53. How To Make Hacking Tools
  54. Hacking Tools Hardware
  55. Hacker Tools Mac
  56. Hacking Tools
  57. Pentest Tools Apk
  58. What Is Hacking Tools
  59. New Hack Tools
  60. Pentest Tools Url Fuzzer
  61. Hacker Tools Mac
  62. How To Make Hacking Tools
  63. Hack Tools 2019
  64. Computer Hacker
  65. Hacking Tools Kit
  66. Tools For Hacker
  67. Pentest Tools Subdomain
  68. Best Hacking Tools 2020
  69. Usb Pentest Tools
  70. How To Install Pentest Tools In Ubuntu
  71. Hacker Tools For Pc
  72. Hacker
  73. Black Hat Hacker Tools
  74. Pentest Tools Free
  75. Bluetooth Hacking Tools Kali
  76. Hacking Tools Download
  77. Hack Tools For Ubuntu
  78. Hack Tools Online
  79. Pentest Tools Review
  80. Hacker Tools Free
  81. Hack Rom Tools
  82. Hacking Tools For Kali Linux
  83. What Are Hacking Tools
  84. Hack Tools For Pc
  85. New Hacker Tools
  86. Android Hack Tools Github
  87. Hacker Tools Mac
  88. Pentest Tools Alternative
  89. Hacking Tools 2019
  90. What Is Hacking Tools
  91. Best Hacking Tools 2019
  92. Hacker Security Tools
  93. Pentest Tools Kali Linux
  94. New Hack Tools
  95. Hacking Tools 2020
  96. Hacking Tools Kit
  97. Hack Tools
  98. Hack Tools
  99. Top Pentest Tools
  100. Pentest Recon Tools
  101. Pentest Tools Github
  102. Hacker Tools Mac
  103. What Is Hacking Tools
  104. Pentest Tools For Android
  105. Hacker Tools For Pc
  106. Wifi Hacker Tools For Windows
  107. Hacking Tools Name
  108. Tools 4 Hack
  109. Tools For Hacker
  110. Hack Tool Apk No Root
  111. Hack Tools For Ubuntu
  112. Hacking Tools Windows
  113. Hacking Tools Name
  114. Hacking Tools Windows
  115. Hacking Tools Windows 10
  116. Hacker Tools Windows
  117. Hacker Tools Windows
  118. Hacking Tools Online
  119. Tools 4 Hack
  120. Hacking Tools Software
  121. Pentest Tools Subdomain
  122. Pentest Tools Tcp Port Scanner
  123. Hacking Tools
  124. Pentest Tools Review
  125. Pentest Tools Find Subdomains
  126. Hacking Tools For Windows
  127. Underground Hacker Sites
  128. Hack Tools 2019
  129. Hacker Tools Hardware
  130. Pentest Tools For Ubuntu
  131. Hacking Tools Pc
  132. Free Pentest Tools For Windows
  133. Install Pentest Tools Ubuntu
  134. Hack Tools 2019
  135. Hacking Tools Windows
  136. Hack Tools Download
  137. Pentest Tools Find Subdomains
  138. Hak5 Tools
  139. Pentest Tools Bluekeep
  140. Black Hat Hacker Tools
  141. Bluetooth Hacking Tools Kali
  142. Hacker Tools Software
  143. Pentest Tools For Windows
  144. Best Pentesting Tools 2018
  145. Growth Hacker Tools
  146. Pentest Tools Alternative
  147. Pentest Tools Url Fuzzer
  148. Termux Hacking Tools 2019
  149. Tools For Hacker

No hay comentarios:

Publicar un comentario