{"id":135,"date":"2007-09-24T20:34:41","date_gmt":"2007-09-25T04:34:41","guid":{"rendered":"http:\/\/outflux.net\/blog\/archives\/2007\/09\/24\/0x41-0x41-0x41-0x41\/"},"modified":"2007-09-24T20:34:41","modified_gmt":"2007-09-25T04:34:41","slug":"0x41-0x41-0x41-0x41","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2007\/09\/24\/0x41-0x41-0x41-0x41\/","title":{"rendered":"0x41 0x41 0x41 0x41"},"content":{"rendered":"

When trying to find buffer overflows, it is common practice to try and fill memory with lots of “A” characters. I first saw this when learning basic stack smashing techniques from Smashing the Stack for Fun and Profit<\/a>, and have long wondered who did it first. Ever since, I’ve always used long strings of “A”s too (sometimes “B”s), and only recently started using better things like Metasploit’s pattern generator<\/a> and offset reporter<\/a>.<\/p>\n

I’m fairly used to seeing things like this from my gdb sessions:<\/p>\n

\nProgram received signal SIGSEGV, Segmentation fault.
\n0x41414141 in ?? ()
\n(gdb)\n<\/p><\/blockquote>\n

It means I’ve managed to gain control of the instruction pointer, and I’m now to the stage of needing to locate and deliver a shellcode.<\/p>\n

Over the weekend I had the pleasure of causing my kernel to do something similar, via an unprivileged userspace process, using the vulnerability discovered<\/a> by Wojciech Purczynski:<\/p>\n

\n[119647.578349] general protection fault: 0000 [3] SMP
\n[119647.578357] CPU 0
\n…
\n[119647.578759] Code: Bad RIP value.
\n[119647.578774] RIP [<4141414141414141>]\n<\/p><\/blockquote>\n

I hadn’t had an opportunity to play with kernel shellcode<\/a> before, so I ended up learning a lot from Brad Spengler. Before the day was up, I was left staring at a root shell.<\/p>\n

This was a nasty bug. Luckily, it’s “only” a local exploit, and only for x86_64 kernels. But that’s still a very large number of installations. Please make sure your x86_64 machines are patched<\/a> against CVE-2007-4573<\/a> (for Ubuntu, this is USN-518-1<\/a>).<\/p>\n

© 2007, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

When trying to find buffer overflows, it is common practice to try and fill memory with lots of “A” characters. I first saw this when learning basic stack smashing techniques from Smashing the Stack for Fun and Profit, and have long wondered who did it first. Ever since, I’ve always used long strings of “A”s […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,14,12],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/135"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=135"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/135\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}