MundoCan: Exploiting Golang Unsafe Pointers

There are situations when c interacts with golang for example in a library, and its possible to exploit a golang function writing raw memory using an unsafe.Pointer() parameter.

When golang receive a null terminated string on a *C.Char parameter, can be converted to golang s tring with s2 := C.GoString(s1) we can do string operations with s2 safelly if the null byte is there.

When golang receives a pointer to a buffer on an unsafe.Pointer() and the length of the buffer on a C.int, if the length is not cheated can be converted to a []byte safelly with b := C.GoBytes(buf,sz)

Buuut what happens if golang receives a pointer to a buffer on an unsafe.Pointer() and is an OUT variable? the golang routine has to write on this pointer unsafelly for example we can create a golangs memcpy in the following way:

We convert to uintptr for indexing the pointer and then convert again to pointer casted to a byte pointer dereferenced and every byte is writed in this way.

If b is controlled, the memory can be written and the return pointer of main.main or whatever function can be modified.

https://play.golang.org/p/HppcVpLfuMf

The return addres can be pinpointed, for example 0x41 buffer 0x42 address:

We can reproduce it simulating the buffer from golang in this way:

we can dump the address of a function and redirect the execution to it:

https://play.golang.org/p/7htJHJp8gUJ

In this way it's possible to build a rop chain using golang runtime to unprotect a shellcode.

MundoCan

Busqueda en Google

sábado, 22 de agosto de 2020

Exploiting Golang Unsafe Pointers

Continue reading

No hay comentarios:

Publicar un comentario

Google Map de Vigo

Busqueda en Todovigo

Minipodcast pirata

Busca Vigo

Mundocan

Enlaces Vigo

Fotos de todo vigo

Todo Vigo

Informatica para Dummies

Mi Camelias

Candela

galería fotos de todo Vigo

Todo_Vigo_todo_vigo_fotos

MundoCan Radio

Mi lista de blogs

Cuant@s afiliad@s