Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375136

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=802

The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

--- cut ---
==27389==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff6e9e9a68 at pc 0x7fa9c4c2d7a3 bp 0x7fff6e9e96b0 sp 0x7fff6e9e96a8
WRITE of size 8 at 0x7fff6e9e9a68 thread T0
    #0 0x7fa9c4c2d7a2 in dissect_2008_16_security_4 wireshark/epan/dissectors/packet-dof.c:2662:32
    #1 0x7fa9c4c2e3f6 in dof_dissect_pdu wireshark/epan/dissectors/packet-dof.c:12619:16
    #2 0x7fa9c4c2ce35 in dof_dissect_pdu_as_field wireshark/epan/dissectors/packet-dof.c:12613:20
    #3 0x7fa9c4c2a7ed in dissect_sgmp wireshark/epan/dissectors/packet-dof.c:8929:26
    #4 0x7fa9c407e911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #5 0x7fa9c407057a in call_dissector_work wireshark/epan/packet.c:731:9
    #6 0x7fa9c406fd4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #7 0x7fa9c4c68aca in dissect_app_common wireshark/epan/dissectors/packet-dof.c:5405:13
    #8 0x7fa9c4c658b6 in dissect_dpp_2 wireshark/epan/dissectors/packet-dof.c:7370:27
    #9 0x7fa9c407e911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #10 0x7fa9c407057a in call_dissector_work wireshark/epan/packet.c:731:9
    #11 0x7fa9c406fd4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #12 0x7fa9c4c3a7a2 in dof_dissect_dpp_common wireshark/epan/dissectors/packet-dof.c:5490:13
    #13 0x7fa9c4c5d5c0 in dissect_dnp_1 wireshark/epan/dissectors/packet-dof.c:6676:23
    #14 0x7fa9c407e911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #15 0x7fa9c407057a in call_dissector_work wireshark/epan/packet.c:731:9
    #16 0x7fa9c406fd4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #17 0x7fa9c4c39598 in dof_dissect_dnp_common wireshark/epan/dissectors/packet-dof.c:5528:9
    #18 0x7fa9c4c390a0 in dissect_dof_common wireshark/epan/dissectors/packet-dof.c:5627:5
    #19 0x7fa9c4c59e5c in dissect_dof_udp wireshark/epan/dissectors/packet-dof.c:5864:12
    #20 0x7fa9c407e911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #21 0x7fa9c407057a in call_dissector_work wireshark/epan/packet.c:731:9
    #22 0x7fa9c406fd4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #23 0x7fa9c40708f4 in dissector_try_uint wireshark/epan/packet.c:1216:9
    #24 0x7fa9c62dddf0 in decode_udp_ports wireshark/epan/dissectors/packet-udp.c:585:7
    #25 0x7fa9c62ecd90 in dissect wireshark/epan/dissectors/packet-udp.c:1080:5
    #26 0x7fa9c62e0ae0 in dissect_udp wireshark/epan/dissectors/packet-udp.c:1086:3
    #27 0x7fa9c407e911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #28 0x7fa9c407057a in call_dissector_work wireshark/epan/packet.c:731:9
    #29 0x7fa9c406fd4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #30 0x7fa9c52a333b in ip_try_dissect wireshark/epan/dissectors/packet-ip.c:1977:7
    #31 0x7fa9c5312dba in dissect_ipv6 wireshark/epan/dissectors/packet-ipv6.c:2399:14
    #32 0x7fa9c407e911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #33 0x7fa9c407057a in call_dissector_work wireshark/epan/packet.c:731:9
    #34 0x7fa9c406fd4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #35 0x7fa9c40708f4 in dissector_try_uint wireshark/epan/packet.c:1216:9
    #36 0x7fa9c5938ee2 in dissect_null wireshark/epan/dissectors/packet-null.c:457:12
    #37 0x7fa9c407e911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #38 0x7fa9c407057a in call_dissector_work wireshark/epan/packet.c:731:9
    #39 0x7fa9c406fd4d in dissector_try_uint_new wireshark/epan/packet.c:1190:9
    #40 0x7fa9c4e81105 in dissect_frame wireshark/epan/dissectors/packet-frame.c:492:11
    #41 0x7fa9c407e911 in call_dissector_through_handle wireshark/epan/packet.c:656:8
    #42 0x7fa9c407057a in call_dissector_work wireshark/epan/packet.c:731:9
    #43 0x7fa9c407aa1e in call_dissector_only wireshark/epan/packet.c:2764:8
    #44 0x7fa9c406b8ff in call_dissector_with_data wireshark/epan/packet.c:2777:8
    #45 0x7fa9c406acd4 in dissect_record wireshark/epan/packet.c:539:3
    #46 0x7fa9c401ddb9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2
    #47 0x52ef3f in process_packet wireshark/tshark.c:3727:5
    #48 0x52830c in load_cap_file wireshark/tshark.c:3483:11
    #49 0x51e67c in main wireshark/tshark.c:2192:13

Address 0x7fff6e9e9a68 is located in stack of thread T0 at offset 168 in frame
    #0 0x7fa9c4c2945f in dissect_sgmp wireshark/epan/dissectors/packet-dof.c:8718

  This frame has 8 object(s):
    [32, 34) 'app'
    [48, 52) 'app_len'
    [64, 66) 'version'
    [80, 84) 'length'
    [96, 128) 'key'
    [160, 168) 'response' <== Memory access at offset 168 overflows this variable
    [192, 194) 'version129'
    [208, 212) 'length130'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow wireshark/epan/dissectors/packet-dof.c:2662:32 in dissect_2008_16_security_4
Shadow bytes around the buggy address:
  0x10006dd352f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006dd35300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006dd35310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006dd35320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006dd35330: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 02 f2 04 f2
=>0x10006dd35340: 02 f2 04 f2 00 00 00 00 f2 f2 f2 f2 00[f2]f2 f2
  0x10006dd35350: 02 f2 04 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006dd35360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006dd35370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006dd35380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006dd35390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==27389==ABORTING
--- cut ---

The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12351. Attached are three files which trigger the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39748.zip