1

I was trying to write an exploit for Crossfire (a game on Linux which has BOF vulnerability) to practice for a CTF.

While fuzzing the game, I found out that if you increase the buffer size you send over constant value, the game in the debugger will behave in a way similar to Windows' applications behavior when the buffer writes over SEH. (EIP not being overwritten, register values are corrupted and execution stops)

The solution to this, according to the CTF, is to use a small buffer pointed to by ESP to jump to the rest of the shellcode which resides at the beginning of the buffer.

However, this led me to a question: Does Linux have a similar way to handle exceptions which is exploitable?

P.S. When I tried to google "SEH with Linux", the pages I got where mentioning Linux as the attacking machine, not the victim.

3

No. Structured Exception Handlers (SEH) are a Windows-only thing, so Linux cannot be exploited in the same way.

1

There are many instances of exception handler exploitations in Linux:

Floating point exception handler in linux kernel:

https://www.securityfocus.com/bid/10538/exploit

this is exception handler involving returning to usermode from kernel:

https://blogs.bromium.com/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/

https://www.cs.dartmouth.edu/~trdata/reports/TR2011-688.pdf

etc

PS: I suspect your context is Linux-based. Windows used the name "SEH", but underlying all these is still hardware-triggered exceptions, as listed here:

https://wiki.osdev.org/Exceptions

And Linux have its own way of handling exception - in user mode and kernel mode. And since all these are implemented as function pointers, it can always be overwritten and exploited.

  • Windows uses SEH, Linux uses POSIX signals. – forest May 22 '18 at 4:38
  • agreed. i am just trying to avoid using the Windows term "SEH" but technically underlying mechnism is still the same: CPU handle it as fault exception. And the long list of hardware-triggered "exceptions" is here: wiki.osdev.org/Exceptions, and since this is hardware-triggered, it is the same for both Windows and Linux. – Peter Teoh May 22 '18 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.