PHP 5.3.9 Vulnerability Help

Question

This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits.

This is a good summary of the vulnerability. I have been able to control EIP but I'm not sure how to execute code.

My test machine is Ubuntu 11.10 and has ASLR enabled along with NX for the stack, heap, and libraries. The string I control (as described in the article) is stored on the heap so I cannot place any code in there since its not executable. Other than EIP I also control the EDI register but that's all. This is a 32 bit system so brute force is sufficient to defeat ASLR (plus I don't have any other security mechanisms in place; not very realistic, but a good start).

EDIT:

Just found this PoC. Basically the author gets to the same place where I am and then relies on code on the PHP server to take it a step furthur to be able to read the Apache process memory. He states that code execution is "highly possible" but doesn't go into much detail beyond that.

Answer 1

This is a nasty vulnerability that is very similar to a Dangling Pointer. In short, it allows a remote attacker to read and/or write to an arbitrary memory address. This is a lot more valuable than just a simple stack based buffer-overflow, especially in exploiting modern systems. A solid remote code execution exploit for this vulnerability has not surfaced to the public. However Vupen, a well known exploit dealer, may have developed such an exploit.

Because this is also a memory disclosure vulnerability you don't have to use brute force to bypass ASLR. An exploit has been written to read the ASLR'ed memory address of where your payload is in memory.

There is still the problem of controlling the EIP. I haven't seen an exploit that does this, but it looks like it maybe possible, perhaps with a GOT overwrite or corrupting the stack frame.

After you the EIP/RIP you have a few options. One option is to use Return Oriented Programming (ROP Chain) to execute arbitrary code. ROP Chains consist of useful "gadgets", or segments of assembler within the application that perform a useful task and these tasks are chained together. A common ROP gadget is controlling the EIP/RIP with a jmp edx. Another useful ROP gadget would be a call to system(), keep in mind that because of ASLR a ret2libc call to system() will fail because you don't know this function's address, hence the need for ROP gadget(s). These are some simple examples, however ROP chains can also be very complex. ROP Chains are useful because they consist of code that must be executable and isn't randomized. There are tools to help you find ROP gadgets within a target application. In an application like Apache, there are bound to be many useful ROP gadgets.

Or another option is to leak memory to find a memory address that you can place a payload. Then defeat the NX bit (which might need a ROP chain) to make your payload executable and point the EIP/RIP to your payload.

Boom.