Solve fhttpd Buffer Overflow Caused by Input
Budget: $30 – $250 USD
Produce a one page memo with an attached working demo that targets a specific buffer overflow (should one exist) causing the server to crash. This should be an intentionally exploitable hole in the code and not simply a robustness issue. If you find a vulnerability, create a patch to fix it. I want to know how to clean up this mess -- how severe is this specific compromise? How can we restore the system to a safe state?
Buffer Overflow Tasks
-Copy webserver.c to webserver.orig.c so that you can make a patch against the original.
-Find the buffer overflow in the webserver code.
-Exploit the overflow, causing the software to crash.
*Please note: you may be able to crash the software in other ways (e.g., a null pointer dereference) -- I am only specifically interested in a buffer overflow caused by input that is not properly bound-checked.*
Create an exploit program, using the skeleton exploit provided in exploit.sh and payload. Edit payload to include your attack data.
Fix the buffer overflow bug in the sourcecode and create a patch against the original
Once you have fixed the flaw (and assuming you have webserver.orig.c), create a patch like so:
cd into the source code directory
execute: diff -Naur webserver.orig.c webserver.c > webserver.patch
Write a ~1 page memo:
Describe the security flaw you found, how you fixed it, and how your demo exploit works. (The memo itself should quote as little sourcecode as possible; for longer sections, refer to filenames and line numbers in the original or your attached patch.)
Considering fhttpd alone, include in your memo:
An evaluation of the seriousness of the breach
A recovery plan for the server. (Is it enough to fix the flaw? Why or why not?)
Any other observations or thoughts you might have.
The assigned task for this exercise is to simply crash fhttpd with an attack payload. However, it is possible to inject code via the payload and take over the application. Since fhttpd runs with root privileges, you can execute anything on the system if you manage to take over the program.
-Create and successfully execute a remote execution exploit using the vulnerability in fhttpd. This could be as simple as writing a file to the system.
-Draft a short writeup describing the steps you took to create the exploit and what you learned in the process.
Buffer Overflow Tasks
-Copy webserver.c to webserver.orig.c so that you can make a patch against the original.
-Find the buffer overflow in the webserver code.
-Exploit the overflow, causing the software to crash.
*Please note: you may be able to crash the software in other ways (e.g., a null pointer dereference) -- I am only specifically interested in a buffer overflow caused by input that is not properly bound-checked.*
Create an exploit program, using the skeleton exploit provided in exploit.sh and payload. Edit payload to include your attack data.
Fix the buffer overflow bug in the sourcecode and create a patch against the original
Once you have fixed the flaw (and assuming you have webserver.orig.c), create a patch like so:
cd into the source code directory
execute: diff -Naur webserver.orig.c webserver.c > webserver.patch
Write a ~1 page memo:
Describe the security flaw you found, how you fixed it, and how your demo exploit works. (The memo itself should quote as little sourcecode as possible; for longer sections, refer to filenames and line numbers in the original or your attached patch.)
Considering fhttpd alone, include in your memo:
An evaluation of the seriousness of the breach
A recovery plan for the server. (Is it enough to fix the flaw? Why or why not?)
Any other observations or thoughts you might have.
The assigned task for this exercise is to simply crash fhttpd with an attack payload. However, it is possible to inject code via the payload and take over the application. Since fhttpd runs with root privileges, you can execute anything on the system if you manage to take over the program.
-Create and successfully execute a remote execution exploit using the vulnerability in fhttpd. This could be as simple as writing a file to the system.
-Draft a short writeup describing the steps you took to create the exploit and what you learned in the process.