mailing list archives
Re: Apache Exploit
From: Ben Laurie <ben () algroup co uk>
Date: Fri, 21 Jun 2002 10:15:09 +0100
Stefan Esser wrote:
i heard several people looking at the gobbles exploit and believing it
can only be fake:
here is my little explanation how bsd memcpy can be exploited:
first a snipset of the bsd memcpy code:
addl %ecx,%edi /* copy backwards. */
 andl $3,%ecx /* any fractional bytes? */
[X] movl 20(%esp),%ecx /* copy remainder by words */
In Apache we trigger exactly this piece of code: bsd thinks the two
buffers are overlapping and so it wants to copy backward.
The problem is that you are able to overwrite the call to memcpy
including the supplied paramters (dst, src, length). With up to
3 bytes () depending on alignment. if you align everything perfectly
you can set the 3 high bytes of length to zero and so change how many
dwords memcpy tries to copy in our case 0x000000??
This is only possible because the code reads the length param again from
stack [X]... This way you can easily survive the call and overwrite
the saved instruction pointer before the memcpy call...
I should just point out the slight error in this analysis - in fact, the
exploit only overwrites two bytes of the length (incidentally, the
length is also constrained to be its own stack offset, leaving no room
for manouver at all) - so the length is initially -146 (ffffff6e), and
after overwriting becomes 0000ff6e, copying just under 64k onto the
stack, which is plenty for a standard stack-based shellcode exploit.
I've also checked, and FreeBSD is indeed vulnerable in the same way, but
the glibc implementation I have seen of memcpy is not, so if Linux is
vulnerable, its by another route. I haven't looked at Solaris.
"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff
- Apache Exploit Stefan Esser (Jun 20)
- Re: Apache Exploit Ben Laurie (Jun 21)