Code Monkey home page Code Monkey logo

mit6.858's Introduction

MIT6.858

Lab solution of http://css.csail.mit.edu/6.858/2014/, no lab4, lab5 (Browser security) is from 2019 version

Bugs

  • zookd.c: process_client
static void process_client(int fd)
...
    static char env[8192];  /* static variables are not on the stack */
    static size_t env_len;
    char reqpath[2048]; // $ebp-2064
    const char *errmsg; // $ebp-16
    int i; // $ebp-12
           // $ebp-8 and $ebp -4 is callee-saved reg (%EDI, %ESI)
  • http.c: http_request_headers
const char *http_request_headers(int fd)
...
    // i: $ebp-12
    // sp: $ebp-16
    // colon: $ebp-20
    // value: $ebp-532
    static char buf[8192];      /* static variables are not on the stack */
    int i;
    char value[512];
    char envvar[512];

part-1

part-2 (cause crash)

this buffer overflow can cause process crash, but this process is a child process parent process will still alive, so make check-crash will not pass

part-3 (cause file deletion with exstack)

part-4 (caue file deletion with nxstack)

part-extra (chaining function calls with return-to-libc)

sys_unlink("/home/httpd/grades.txt") -> pop/ret -> touch("grades.txt") (http.c:18) -> sys_exit()

mit6.858's People

Contributors

lxs137 avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.