1

Found a bug in a function in a loop where I can go past a loop in assignment where value is read from past malloced memory

The function has no call, int or other assembly instructions afterwards.

Instruction I control is movzbl. I control the source registry value. Pseudocode in C:

For(...) 
{
ptr=array[i] <---- here i go past ptr allocation
} 

Can this be exploited to get code execution?

Update 1:

This is the case, I control the ptr values and here arr[i]=inptr[0]; it overflows

#include <stdio.h>
#include <stdlib.h>
#include <string.h>


void main(void)
{
    char *ptr=NULL;

    ptr=malloc(10*sizeof(char));
    for(int i=0;i<10;i++)
    {
        ptr[i]=1;
    }


    char arr[11]={1,2,3,4,5,6,7,8,9,10,11};
    char *inptr = NULL;
    inptr= ptr;
    for(int i=0;i<1000;i++)
    {
        arr[i]=inptr[0];
        inptr+=1;
    }

    for(int i=0;i<10;i++)
    {
        printf("%i\n",arr[i]);
    }


}

Disassembly:

gef➤  disass
Dump of assembler code for function main:
   0x00000000004005d6 <+0>: push   rbp
   0x00000000004005d7 <+1>: mov    rbp,rsp
   0x00000000004005da <+4>: sub    rsp,0x40
=> 0x00000000004005de <+8>: mov    rax,QWORD PTR fs:0x28
   0x00000000004005e7 <+17>:    mov    QWORD PTR [rbp-0x8],rax
   0x00000000004005eb <+21>:    xor    eax,eax
   0x00000000004005ed <+23>:    mov    QWORD PTR [rbp-0x28],0x0
   0x00000000004005f5 <+31>:    mov    edi,0xa
   0x00000000004005fa <+36>:    call   0x4004c0 <malloc@plt>
   0x00000000004005ff <+41>:    mov    QWORD PTR [rbp-0x28],rax
   0x0000000000400603 <+45>:    mov    DWORD PTR [rbp-0x3c],0x0
   0x000000000040060a <+52>:    jmp    0x400620 <main+74>
   0x000000000040060c <+54>:    mov    eax,DWORD PTR [rbp-0x3c]
   0x000000000040060f <+57>:    movsxd rdx,eax
   0x0000000000400612 <+60>:    mov    rax,QWORD PTR [rbp-0x28]
   0x0000000000400616 <+64>:    add    rax,rdx
   0x0000000000400619 <+67>:    mov    BYTE PTR [rax],0x1
   0x000000000040061c <+70>:    add    DWORD PTR [rbp-0x3c],0x1
   0x0000000000400620 <+74>:    cmp    DWORD PTR [rbp-0x3c],0x9
   0x0000000000400624 <+78>:    jle    0x40060c <main+54>
   0x0000000000400626 <+80>:    mov    BYTE PTR [rbp-0x20],0x1
   0x000000000040062a <+84>:    mov    BYTE PTR [rbp-0x1f],0x2
   0x000000000040062e <+88>:    mov    BYTE PTR [rbp-0x1e],0x3
   0x0000000000400632 <+92>:    mov    BYTE PTR [rbp-0x1d],0x4
   0x0000000000400636 <+96>:    mov    BYTE PTR [rbp-0x1c],0x5
   0x000000000040063a <+100>:   mov    BYTE PTR [rbp-0x1b],0x6
   0x000000000040063e <+104>:   mov    BYTE PTR [rbp-0x1a],0x7
   0x0000000000400642 <+108>:   mov    BYTE PTR [rbp-0x19],0x8
   0x0000000000400646 <+112>:   mov    BYTE PTR [rbp-0x18],0x9
   0x000000000040064a <+116>:   mov    BYTE PTR [rbp-0x17],0xa
   0x000000000040064e <+120>:   mov    BYTE PTR [rbp-0x16],0xb
   0x0000000000400652 <+124>:   mov    QWORD PTR [rbp-0x30],0x0
   0x000000000040065a <+132>:   mov    rax,QWORD PTR [rbp-0x28]
   0x000000000040065e <+136>:   mov    QWORD PTR [rbp-0x30],rax
   0x0000000000400662 <+140>:   mov    DWORD PTR [rbp-0x38],0x0
   0x0000000000400669 <+147>:   jmp    0x400684 <main+174>
   0x000000000040066b <+149>:   mov    rax,QWORD PTR [rbp-0x30]
   0x000000000040066f <+153>:   movzx  edx,BYTE PTR [rax]
   0x0000000000400672 <+156>:   mov    eax,DWORD PTR [rbp-0x38]
   0x0000000000400675 <+159>:   cdqe   
   0x0000000000400677 <+161>:   mov    BYTE PTR [rbp+rax*1-0x20],dl
   0x000000000040067b <+165>:   add    QWORD PTR [rbp-0x30],0x1
   0x0000000000400680 <+170>:   add    DWORD PTR [rbp-0x38],0x1
   0x0000000000400684 <+174>:   cmp    DWORD PTR [rbp-0x38],0x3e7
   0x000000000040068b <+181>:   jle    0x40066b <main+149>
   0x000000000040068d <+183>:   mov    DWORD PTR [rbp-0x34],0x0
   0x0000000000400694 <+190>:   jmp    0x4006b8 <main+226>
   0x0000000000400696 <+192>:   mov    eax,DWORD PTR [rbp-0x34]
   0x0000000000400699 <+195>:   cdqe   
   0x000000000040069b <+197>:   movzx  eax,BYTE PTR [rbp+rax*1-0x20]
   0x00000000004006a0 <+202>:   movsx  eax,al
   0x00000000004006a3 <+205>:   mov    esi,eax
   0x00000000004006a5 <+207>:   mov    edi,0x400764
   0x00000000004006aa <+212>:   mov    eax,0x0
   0x00000000004006af <+217>:   call   0x4004a0 <printf@plt>
   0x00000000004006b4 <+222>:   add    DWORD PTR [rbp-0x34],0x1
   0x00000000004006b8 <+226>:   cmp    DWORD PTR [rbp-0x34],0x9
   0x00000000004006bc <+230>:   jle    0x400696 <main+192>
   0x00000000004006be <+232>:   nop
   0x00000000004006bf <+233>:   mov    rax,QWORD PTR [rbp-0x8]
   0x00000000004006c3 <+237>:   xor    rax,QWORD PTR fs:0x28
   0x00000000004006cc <+246>:   je     0x4006d3 <main+253>
   0x00000000004006ce <+248>:   call   0x400490 <__stack_chk_fail@plt>
   0x00000000004006d3 <+253>:   leave  
   0x00000000004006d4 <+254>:   ret    
End of assembler dump.
gef➤ 

I think this is not exploitable other than DoS/Crash? Any thoughts?

Update 2:

It is actually in a library code. In my PoC it overflows always to unmapped mem. So I guess I have to make a PoC that allocates a lot of mem. If you look at my question update 1 c code, how would u modify to make the oob read, write there exploitable?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.