This is the second in a multi-part tutorial on developing a buffer overflow exploit using Bowcaster.  Here’s Part 1.

In part 1, we had gotten a crash by sending a 2048-byte pattern to the vulnerable program.

The saved return address had been overwritten with 0x41367241 and restored to the $ra register.  That value is located at an offset of 528 in our overflow buffer.  Now we need to start describing ROP gadgets and substituting them for parts of the 2048-byte overflow string.

This is the first in a multi-part tutorial on developing a buffer overflow exploit using Crossbow (now called Bowcaster), which I released earlier today.

For this tutorial I’ve written a simple program in C that overflows a buffer on the stack with whatever it reads from the network.  I cross-compiled it for MIPS Linux and ran it using QEMU chrooted into the unpacked filesystem of the Netgear WNDR3700v3 (Firmware 1.0.0.18).

The program, vulnerable.c contains the following function:

UPDATE: Crossbow has been renamed to Bowcaster. It turns out “Crossbow” is a popular word.  Who knew?  A company in California has the word registered as a trademark in the US in connection with computer software.  They might be cool with us using the word, since this is an open-source noncommercial product, but we’ve decided to change the name just in case.  Hopefully the new name is esoteric enough to avoid any naming conflicts, while still being cool and fun to say.  I’m leaving this post as-is, save for the new Github link.  The old Github project will stay up for a while, but you should use the new one from this point on.

I love hacking.  I love vulnerability research.  I love software exploitation.  I love finding creative ways to subvert control of an application or system to make it do something it wasn’t intended to do.

But this is research, and like any research, lots of things never pan out.  It’s weird because it involves hours, often hundreds or even thousands of hours, of frustration paid off by successes that last only moments.  And the cycle repeats.

With all the excitement regarding UPnP vulnerabilities lately, I though I’d write up this one I found a few weeks back.  I had kind of forgotten about it.  But it’s pretty straight forward, and kind of fun, so here it is.

In Tactical Network Solutions’ Intro to Embedded Device Exploitation class, we use the D-Link DIR-815 for the practical exercises since there are tons of great 0-days for the students to find.  The last time we taught the class, I thought I’d try my hand at finding a new one. Twenty minutes in, voila! Command injection in a single multicast packet!

Update: I received a personal communication from Mr. Flemming.  He makes the case that what I believed to be a subtextual threat was not intended.  Not necessarily speaking for TNS, I am inclined to take him at his word and that my initial read of the situation may have been unduly skeptical.  I hope to post additional updates as things develop.  I’m leaving the original text of this post intact, though, as it provides meaningful context for the situation that is unfolding.
**
Original Post:**
So here’s something awesome.  And by “awesome” I mean “kinda shitty.”

[NOTE: This was going to be a post about how to relocate a shared library that is loaded using LD_PRELOAD such that a program’s linked libraries get loaded at their normal addresses.  Sadly, the trick I thought would do that didn’t actually work for me.  The library got relocated, but the other libraries weren’t restored to their natural base addresses.  That said, it still is interesting and worth writing up.]

I decided to POP out all my Yahoo mail into my Google Apps account so I could stop paying for Yahoo’s “premium” service (WTF, it’s 2012, and POP is a paid feature–and there’s no IMAP?).  I have fetchmail then download all of my messages which get post-processed by procmail and re-served by dovecot.  Since a bunch of really old messages were just downloaded by fetchmail, they appeared to be “new” from dovecot’s perspective.  This is because the name of the message files stored in the Maildir format used by dovecot starts with a number representing when the messages were downloaded.  So years-old messages that were just downloaded will have a very recent timestamp encoded in their filenames.

Here are some long-form articles I’ve enjoyed this year.

The Hazards of Nerd Supremacy: The Case of Wikileaks (theatlantic.com)

The Octopus Conspiracy: One Woman’s Search for Her Father’s Killer (wired.com)

Confessions of a Prep School College Counselor (theatlantic.com)

The Great Rubber Robbery: How Julius Fromm’s Condom Empire Fell to the Nazis (berlinbooks.org)

Bursting the Bubble (about David Vetter, the “Bubble Boy”, houstonpress.com)

The Stutterer: How He Makes His Voice Heard (slate.com)

I was using up all of my accumulated credits on Audible.com just now, and realized I’ve listened to several great audiobooks over the last year. Here’s a list of what I’ve listened to in 2011, along with a link to the book on Audible.com. I recommend them all.

Judas Unchained, Peter F. Hamilton, Part 2 of the Commonwealth Saga (link)
The Gun, C. J. Chivers (link)
The Windup Girl, Paolo Bacigalupi (link)
Snow Crash, Neal Stephenson (link)
Embassytown, China Mieville (link)
Pattern Recognition, William Gibson (link)
Spook Country, William Gibson (link)
Zero History, William Gibson (link)