4

I'm doing a demonstration of memory corruption attacks, and would like to show some working examples of exploits that feature heap corruption (such as use-after-free). My requirements are:

  • A working exploit (remote or local)
  • on Linux (this is crucial, because I want to take people through it using Linux tools)
  • for a real application (i.e. not a dummy application made to be vulnerable, but something real)
  • that can be easily downloaded (open source, still available -- older versions are fine)

Preferably, I'd like:

  • an application that they've heard of (something fairly common, not something obscure)
  • with a metasploit exploit available
  • and, if possible, a server application or daemon (not a browser)

Surprisingly, I'm having trouble finding a good example. Can you recommend a good example to use to teach and demonstrate heap corruption attacks? The main requirement is that an exploit should be available that works on a real Linux application.

UPDATE: Before posting, I searched exploitdb and metasploit, and was unable to find something that met even the requirements (let alone the desired points). However, the search interfaces there are somewhat coarse, so there may be one lurking that I can't find.

1

Here are a couple exploits for remote heap overflows for some older Linux daemons.

Both of these will work for your demonstration, and could be easily setup by compiling older versions from source, or installing older RedHat/Debian ISO's in a VM.

  • Welcome to Information Security SE @movsx. These are link-dependent answers. Could you include the relevant descriptions in the article body? – Jedi Jan 12 '17 at 20:00
0

It doesn't really qualify as memory corruption but it's definititely in the memory-exploit domain if that is enough for you.

I've always thought Heartbleed is a great example of a memory exploit - there's even an xkcd that does a fine job at explaining it.

It should be fairly easy to set up by compiling any SSL-capable server of your choosing against a vulnerable version of OpenSSL and then firing at it with a client that can exploit it (there's a few links available on the metasploit).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.