(25 points) Robust Refactor

In this problem, you will be refactoring the qlib library that we looked at in class.

The source files can be found in this zip file:

• fqlib: “Fragile Queue Library” contains a functional but fragile queue library implementation (reference only).
• qlib: “Queue Library” contains a robust implementation of an integer queue library to be refactored.

1. (25 points) Complete Exercise 16 from the Robust Programming reading:

   You should base your code on the qlib implementation in the robust.zip files, but that is not guaranteed to be free of issues.

   • Report what changes you made to the library and why, noting any new sanity and consistency checks you needed to make in particular.

   • Include your header and source files in your PDF submission, with the names dqlib.h and dqlib.c, respectively.

   • Bonus (2pts): What is wrong with the qlib implementation as provided?

   
   

(25 points) Bypassing Memory Safety Features

Consider the following code snippet:

void foo(void) {
  char foobuf[256];
  fgets(foobuf, 257, stdin);
}

void bar(void) {
  foo();
}

void main(void) {
  char * buf = (char *) malloc(128);
  fgets(buf, 128, stdin);
  printf("%p", buf);
  bar();
}

Assume the following:

• ASLR is enabled.
• All other memory safety features disabled.
• Assume ASLR will always randomize the value of the saved base pointer of foo to have a LSB in the inclusive range 0x20 - 0xf8.
• You can represent the output of printf on line 13 with a variable ADDRESS. This is an 8-byte, little-endian byte string.
• You can represent shellcode with a variable SHELLCODE, which has a maximum length of 120 bytes.
• Note: SFP = saved frame pointer = saved base pointer (rbp)

1. (6 points) Assume the program is paused at line 3 (before fgets is called).
   Complete the following stack diagram:

   

   
   

2. (8 points) Provide the byte string inputs to fgets on line 12 and fgets on line 3 that will lead to shellcode execution.

   You can craft these inputs using Python syntax. For example:

   >>> b'\x31' * 8 + b'\x0b\xad\xc0\xde'
   b'11111111\x0b\xad\xc0\xde'
   >>> ADDR = b'\x00\x00\x7f\xff\xff\xff\x80\x80'
   >>> ADDR + b'\xc0\xde'
   b'\x00\x00\x7f\xff\xff\xff\x80\x80\x00\xc0\xde'

   
   

3. (11 points) Explain why this exploit is only guaranteed to work if the saved base pointer of foo has a LSB in the range 0x20 - 0xf8.
   

(25 points) No Overflow?

Consider the following CTF challenge:

void challenge(void) {
  int8_t size;
  char flag[16];
  char buf[128];

  // implementation not shown
  load_flag(flag);

  memset(buf, 0, 128);

  fread(&size, 1, 1, stdin);

  if (size >= 128) {
    return;
  }

  fread(buf, size, 1, stdin);
  printf("%s", buf);
}

The load_flag function loads the flag data from an access-controlled file on the system.

1. (5 points) Assume the program is paused at line 8.
   Complete the following stack diagram:

   

   
   

2. (5 points) Provide the byte string inputs to fread on line 11 and fread on line 17 that will give you the flag.
   

3. (5 points) Explain how your solution to the previous part works.
   

4. (5 points) Provide the byte string inputs to fread on line 11 and fread on line 17 that would allow you to execute the largest possible shellcode payload.

   Assume all memory safety features are disabled and the compiler allocates 8 bytes of space for size.

   • Use a variable named SHELLCODE that contains the shellcode payload as a byte string.
   • Use a variable named BUF_ADDRESS that contains the address of buf as a byte string (presumably reverse-engineered with gdb).
   • You must specify the length of SHELLCODE.

   
   

5. (5 points) Explain how your solution to the previous part works.
   

(25 points) Python has Problems Too

Just because we’ve been mostly looking at problems in C doesn’t mean other languages don’t have their own problems.

A well-known dangerous implement in Python (aside from the use of the eval function) is the pickle library.

The pickle library is Python’s native module for serializing and deserializing its objects, which can be quite useful for caching purposes.

Per the documentation, however, unpickling an object may also involve executing arbitrary code. You’ll be crafting a pickle-based attack in this problem and creating a short vulnerability report and description of your exploit.

1. (15 points) Complete the Pickle Rick challenge in the hw2 module (originally part of the Hanto Dojo).

   • Hint 1: Find out how pickle exploits work (Google it), then read the pickle-rick.py source code to find out how the pickled data is given to the program.
   • Hint 2: Your goal is still to read /flag.

   
   

2. (10 points) Describe the vulnerability in the pickle-rick.py script and the steps you took to exploit it.

   Refer to the “Vulnerability Description” section here and the “Real World Demonstration” section here for good examples of what we are looking for:

   • point out the affected code
   • what input the attacker controls
   • describe the steps taken to reproduce the exploit