Write a testing program that contains a heap buffer overflow vulnerability.Show
ID: 3747770 • Letter: W
Question
Write a testing program that contains a heap buffer overflow vulnerability.Show what the heap layout looks like and explain how to exploit it. In particular, please include in yourdiagram: (1) each chunk of memory allocated by malloc(), (2) their sizes in bytes, (3) metadata of heap as it gets overwritten, (4) the sizes of this metadata in bytes, and (5) which metadata get overwritten
and how the attacker controls which value can get written to any arbitrary location in memory.
Address the data structure implemented in a heap memory. How are allocated and non-allocated
chunks structured? Is heap memory contiguous within memory architecture? Again, you do not need
to write and test the real exploit code, but you may want to use some figures to make your description
clear and concise.
Explanation / Answer
heap is a memory section that is utilized for putting away progressively dispensed information and worldwide factors. Each piece of memory in store comprises of limit labels that contain memory administration data.
At the point when a store based cushion is flooded the control data in these labels is overwritten. At the point when the heap administration routine liberates the support, a memory address overwrite happens prompting an entrance infringement. At the point when the flood is executed in a controlled manner, the weakness would enable a foe to overwrite a coveted memory area with a client controlled esteem. Practically speaking, an aggressor would have the capacity to overwrite work pointers and different locations put away in structures like GOT, .dtors or TEB with the address of a pernicious payheap.
There are various variations of the stack flood (store defilement) powerlessness that can permit anything from overwriting capacity pointers to abusing memory administration structures for self-assertive code execution. Finding pile floods requires nearer examination in contrast with stack floods, since there are sure conditions that need to exist in the code for these vulnerabilities to be exploitable.
The most effective method to Test
Black Box testing
The standards of discovery testing for store floods continue as before as stack floods. The key is to supply as info strings that are longer than anticipated. In spite of the fact that the test procedure continues as before, the outcomes that are obvious in a debugger are essentially extraordinary. While on account of a stack flood, a direction pointer or SEH overwrite would be clear, this does not remain constant for a store flood condition. While investigating a windows program, a pile flood can show up in a few distinct structures, the most widely recognized one being a pointer trade occurring after the store administration routine comes without hesitation. Appeared beneath is a situation that shows a store flood defenselessness.
The two registers appeared, EAX and ECX, can be populated with client provided addresses which are a piece of the information that is utilized to flood the heap cushion. One of the addresses can point to a capacity pointer which should be overwritten, for instance UEF (Unhandled Exception channel), and the other can be the address of client provided code that should be executed.
At the point when the MOV guidelines appeared in the left sheet are executed, the overwrite happens and, when the capacity is called, client provided code gets executed. As said beforehand, different strategies for testing such vulnerabilities incorporate figuring out the application doubles, which is a perplexing and monotonous process, and utilizing fluffing methods.
Gray Box testing
While assessing code, one must understand that there are a few roads where store related vulnerabilities may emerge. Code that appears to be harmless at the principal look can really be helpless under specific conditions. Since there are a few variations of this weakness, we will cover just the issues that are dominating.
More often than not, heap supports are viewed as protected by a great deal of designers who don't dither to perform shaky activities like strcpy( ) on them. The fantasy that a stack flood and direction pointer overwrite are the main intends to execute self-assertive code ends up being perilous if there should be an occurrence of code demonstrated as follows:-
int main(int argc, roast *argv[])
{
…
vulnerable(argv[1]);
return 0;
}
int vulnerable(char *buf)
{
HANDLE hp = HeapCreate(0, 0, 0);
HLOCAL lump = HeapAlloc(hp, 0, 260);
strcpy(chunk, buf); ''' Vulnerability'''
… ..
return 0;
}
For this situation, if buf surpasses 260 bytes, it will overwrite pointers in the neighboring limit tag, encouraging the overwrite of a discretionary memory area with 4 bytes of information once the store administration routine kicks in.
Recently, a few items, particularly against infection libraries, have been influenced by variations that are blends of a number flood and duplicate activities to a stack cradle. For instance, think about a helpless code bit, a piece of code in charge of handling TNEF filetypes, from Clam Anti Virus 0.86.1, source record tnef.c and work tnef_message( ):
string = cli_malloc(length + 1); ''' Vulnerability'''
if(fread(string, 1, length, fp) != length) {''' Vulnerability'''
free(string);
return - 1;
}
The malloc in line 1 allots memory in view of the estimation of length, which happens to be a 32 bit whole number. In this specific illustration, length is client controllable and a malevolent TNEF record can be made to set length to '- 1', which would result in malloc( 0 ). In this manner, this malloc would assign a little pile cushion, which would be 16 bytes on most 32 bit stages (as demonstrated in malloc.h).
What's more, now, in line 2, a store flood happens in the call to fread( ). The third contention, for this situation length, is relied upon to be a size_t variable. Yet, in the event that it will be '- 1', the contention wraps to 0xFFFFFFFF, therefore duplicating 0xFFFFFFFF bytes into the 16 byte cushion.
Static code investigation apparatuses can likewise help in finding pile related vulnerabilities, for example, "twofold free" and so on. An assortment of apparatuses like RATS, Flawfinder and ITS4 are accessible for breaking down C-style dialects.
Related Questions
drjack9650@gmail.com
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.