Security.my

[securitymy]

CVE-2018-10717 - MiniUPnP ngiflib 0.4 Buffer Overflow

Our finding here is collaboration with @rempah. Long short story, we run a fuzzer (AFL) targeting the ngiflib version 0.4. 

Description

The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file, a different vulnerability than CVE-2018-10677.

Technical Analysis

There's an buffer overflow found in ngiflib.c line 206. Size of **tocopy** exceeded the **pixels** size, and when copying into **context->frbuff_p.p8** it overflow here. 

Affected code:

static void WritePixels(struct ngiflib_img * i, struct ngiflib_decode_context * context, const u8 * pixels, u16 n) { u16 tocopy; struct ngiflib_gif * p = i->parent; while(n > 0) { tocopy = (context->Xtogo < n) ? context->Xtogo : n; if(!i->gce.transparent_flag) { #ifndef NGIFLIB_INDEXED_ONLY if(p->mode & NGIFLIB_MODE_INDEXED) { #endif /* NGIFLIB_INDEXED_ONLY */ ngiflib_memcpy(context->frbuff_p.p8, pixels, tocopy); **// crash happened here** pixels += tocopy;

ASAN output:

==3568==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63000000fe00 at pc 0x7fc5dfe17904 bp 0x7ffd40601780 sp 0x7ffd40600f28 WRITE of size 1 at 0x63000000fe00 thread T0 #0 0x7fc5dfe17903 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c903) #1 0x40bb4b in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53 #2 0x40bb4b in WritePixels /home/john/ngiflib/ngif/ngiflib.c:206 #3 0x40bb4b in DecodeGifImg /home/john/ngiflib/ngif/ngiflib.c:548 #4 0x411cc3 in LoadGif /home/john/ngiflib/ngif/ngiflib.c:784 #5 0x404d5f in SDL_LoadAnimatedGif /home/john/ngiflib/ngif/ngiflibSDL.c:136 #6 0x401fa7 in main /home/john/ngiflib/ngif/SDLaffgif.c:107 #7 0x7fc5df74882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #8 0x403118 in _start (/home/john/ngiflib/ngif/SDLaffgif+0x403118) 0x63000000fe00 is located 0 bytes to the right of 64000-byte region [0x630000000400,0x63000000fe00) allocated by thread T0 here: #0 0x7fc5dfe23602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602) #1 0x41390b in LoadGif /home/john/ngiflib/ngif/ngiflib.c:607 SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy Shadow bytes around the buggy address: 0x0c607fff9f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c607fff9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c607fff9f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c607fff9fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c607fff9fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c607fff9fc0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c607fff9fd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c607fff9fe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c607fff9ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c607fffa000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c607fffa010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==3568==ABORTING

Fixed:

https://github.com/miniupnp/ngiflib/commit/cf429e0a2fe26b5f01ce0c8e9b79432e94509b6e

References:

https://github.com/miniupnp/ngiflib/issues/3

https://nvd.nist.gov/vuln/detail/CVE-2018-10717

https://exchange.xforce.ibmcloud.com/vulnerabilities/142847

[securitymy]

Disassemble SX OS payload.bin and extract the first AES Key

Here is how I dissassembled the payload.bin for SX OS

Using IDA Pro, load up payload.bin, select ARM Little-endian as processor and .settings below for memory organization

Convert the address below to code

The First AES Key and CTR used by nwert’s tx_unpack script (https://gist.github.com/nwert/9430a454c64248dd1186868c00b682c6) for stage2 is found in sub_40030188.

-klks

[securitymy]

SlimPDF Reader - NULL Pointer Dereference

Vulnerability: NULL Pointer Dereference Product: SlimPDF Reader - (SlimPDF Reader.exe) Tested on: Windows 10 Reference: https://cwe.mitre.org/data/definitions/476.html Impact: Denial of Service (can be achieved via Remote) Reported: https://support.investintech.com/hc/en-us/requests/14369

Summary A vulnerability in SlimPDF Reader could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

The vulnerability is due to improper processing of certain PDF documents by the affected system. An attacker could exploit this vulnerability by persuading a trusted user to open a malicious PDF document using the affected application. When the application processes the malicious document, it may dereference a NULL pointer. The error could cause the application to crash, resulting in a DoS condition.

Vulnerability Description NULL Pointer in SlimPDF Reader.exe in Investintech SlimPDF Reader 1.0.12 allows attacker to locally and remotely trigger Denial-of-Service. SlimPDF does not contained any other components except its own EXE file. The affected components on the executable itself (SlimPDF Reader.exe) failed to parse stream objects in PDF file.

Initial analysis To trigger the NULL pointer, open PDF with SlimPDF Reader. Upon opening the PDF, an exception occured.

(f84.cdc): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** WARNING: Unable to verify checksum for C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader 1.0\SlimPDF Reader.exe *** ERROR: Module load completed but symbols could not be loaded for C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader 1.0\SlimPDF Reader.exe SlimPDF_Reader+0x3457c: 0043457c 394608 cmp dword ptr [esi+8],eax ds:002b:00000008=????????

Looking at the exception code c0000005, it is a code for an access violation. That means that the program is accessing a memory address to which hasn't right to do.

0:000:x86> .exr -1 ExceptionAddress: 0043457c (SlimPDF_Reader+0x0003457c) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 00000008 Attempt to read from address 00000008 0:000:x86> r eax=00000002 ebx=023274a8 ecx=04357020 edx=00000005 esi=00000000 edi=0231e928 eip=0043457c esp=0019f6e0 ebp=0019f860 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210246 SlimPDF_Reader+0x3457c: 0043457c 394608 cmp dword ptr [esi+8],eax ds:002b:00000008=???????? If we see the registers above, we can see ESI contained NULL value. We can see this via memory: 0:000:x86> dc esi 00000000 ???????? ???????? ???????? ???????? ???????????????? 00000010 ???????? ???????? ???????? ???????? ???????????????? 00000020 ???????? ???????? ???????? ???????? ???????????????? 00000030 ???????? ???????? ???????? ???????? ???????????????? 00000040 ???????? ???????? ???????? ???????? ???????????????? 00000050 ???????? ???????? ???????? ???????? ???????????????? 00000060 ???????? ???????? ???????? ???????? ???????????????? 00000070 ???????? ???????? ???????? ???????? ????????????????

Root Cause Inspecting the issue leads to the failure parsing the stream object thus causing NULL pointer dereference.

.text:0043456D mov eax, [ebx+8] ; [ebx+8] is already containing invalid value .text:00434570 cmp eax, 2 ; .text:00434573 mov esi, [ebx+28h] ; [ebx+28h] containing our PDF stream (invalid value), pointer to .text:00434576 jnz loc_434826 ; zero flag set here, so no jump .text:0043457C cmp [esi+8], eax ; continue executing and crash

We can see the object stream in EBX as in following:

0:000:x86> dps 023274a8 023274a8 ffffffff 023274ac ffffffff 023274b0 00000002 023274b4 41414141 023274b8 41410033 023274bc 41414141 023274c0 41414141 023274c4 41414141 023274c8 00000001 023274cc 0000000f 023274d0 00000000 023274d4 00000000 023274d8 00000000 023274dc 41414141 023274e0 bdd3747d 023274e4 80002241 023274e8 ffffffff 023274ec ffffffff 023274f0 00000000 023274f4 41414141 023274f8 41414100 023274fc 41414141 02327500 41414141 02327504 41414141 02327508 00000000 0232750c 0000000f 02327510 00000000 02327514 00000000 02327518 00000000 0232751c 41414141 02327520 bddb7445 02327524 80002341

EAX containing pointer to an invalid memory:

0:000:x86> db poi (ebx+8) 00000002 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 00000012 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 00000022 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 00000032 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 00000042 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 00000052 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 00000062 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 00000072 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????

Result from !analyze:

0:000:x86> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* GetUrlPageData2 (WinHttp) failed: 12002. KEY_VALUES_STRING: 1 TIMELINE_ANALYSIS: 1 Timeline: !analyze.Start Name: <blank> Time: 2018-05-28T05:55:00.250Z Diff: 250 mSec Timeline: Dump.Current Name: <blank> Time: 2018-05-28T05:55:00.0Z Diff: 0 mSec Timeline: Process.Start Name: <blank> Time: 2018-05-28T04:16:48.0Z Diff: 5892000 mSec Timeline: OS.Boot Name: <blank> Time: 2018-05-26T16:13:30.0Z Diff: 135690000 mSec DUMP_CLASS: 2 DUMP_QUALIFIER: 0 FAULTING_IP: SlimPDF_Reader+3457c 0043457c 394608 cmp dword ptr [esi+8],eax EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 0043457c (SlimPDF_Reader+0x0003457c) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 00000008 Attempt to read from address 00000008 FAULTING_THREAD: 00000cdc DEFAULT_BUCKET_ID: NULL_CLASS_PTR_READ PROCESS_NAME: SlimPDF Reader.exe FOLLOWUP_IP: SlimPDF_Reader+3457c 0043457c 394608 cmp dword ptr [esi+8],eax READ_ADDRESS: 00000008 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE_STR: c0000005 EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 00000008 WATSON_BKT_PROCSTAMP: 4ecd831a WATSON_BKT_PROCVER: 1.0.1.12 PROCESS_VER_PRODUCT: SlimPDF Reader WATSON_BKT_MODULE: SlimPDF Reader.exe WATSON_BKT_MODSTAMP: 4ecd831a WATSON_BKT_MODOFFSET: 3457c WATSON_BKT_MODVER: 1.0.1.12 MODULE_VER_PRODUCT: SlimPDF Reader BUILD_VERSION_STRING: 10240.17443.amd64fre.th1.170602-2340 MODLIST_WITH_TSCHKSUM_HASH: 2b36701f96731def5752c269357e7e5a2679befb MODLIST_SHA1_HASH: d231aecbd4b1f32bc2f593851f16d87c2da75c72 NTGLOBALFLAG: 400 PROCESS_BAM_CURRENT_THROTTLED: 0 PROCESS_BAM_PREVIOUS_THROTTLED: 0 APPLICATION_VERIFIER_FLAGS: 0 PRODUCT_TYPE: 1 SUITE_MASK: 272 DUMP_TYPE: fe ANALYSIS_SESSION_HOST: DESKTOP-1IBEKMI ANALYSIS_SESSION_TIME: 05-28-2018 13:55:00.0250 ANALYSIS_VERSION: 10.0.17134.1 amd64fre THREAD_ATTRIBUTES: OS_LOCALE: ENU PROBLEM_CLASSES: ID: [0n309] Type: [@ACCESS_VIOLATION] Class: Addendum Scope: BUCKET_ID Name: Omit Data: Omit PID: [Unspecified] TID: [0xcdc] Frame: [0] : SlimPDF_Reader ID: [0n281] Type: [INVALID_POINTER_READ] Class: Primary Scope: BUCKET_ID Name: Add Data: Omit PID: [Unspecified] TID: [0xcdc] Frame: [0] : SlimPDF_Reader ID: [0n306] Type: [NULL_CLASS_PTR_READ] Class: Primary Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix) BUCKET_ID Name: Add Data: Omit PID: [0xf84] TID: [0xcdc] Frame: [0] : SlimPDF_Reader ID: [0n156] Type: [ZEROED_STACK] Class: Addendum Scope: BUCKET_ID Name: Add Data: Omit PID: [0xf84] TID: [0xcdc] Frame: [0] : SlimPDF_Reader BUGCHECK_STR: APPLICATION_FAULT_NULL_CLASS_PTR_READ_INVALID_POINTER_READ_ZEROED_STACK PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT LAST_CONTROL_TRANSFER: from 0044211b to 0043457c STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 0019f860 0044211b 0231d3b0 0231deb8 00000000 SlimPDF_Reader+0x3457c 0019f8e4 00443702 0231d270 022f7ef8 022f7f28 SlimPDF_Reader+0x4211b 0019f914 0041be0d 00000001 00000000 0231d3b0 SlimPDF_Reader+0x43702 0019f984 0041d20b 00000001 022df730 3f0119b6 SlimPDF_Reader+0x1be0d 0019f9d4 0045fbf0 00000001 00000001 3f0119b6 SlimPDF_Reader+0x1d20b 0019fa78 004cee26 0000007c 004cdea8 022b5340 SlimPDF_Reader+0x5fbf0 0019fb60 004afa7e 52fbf7b5 0000000f 022e1c38 SlimPDF_Reader+0xcee26 0019fbf4 004ab964 0000000f 00000000 0052df50 SlimPDF_Reader+0xafa7e 0019fc14 004ae035 0000000f 00000000 00000000 SlimPDF_Reader+0xab964 0019fc7c 004ae0c2 00000000 0003084a 0000000f SlimPDF_Reader+0xae035 0019fc9c 74904923 0003084a 0000000f 00000000 SlimPDF_Reader+0xae0c2 0019fcc8 748e4790 004ae08e 0003084a 0000000f USER32!_InternalCallWinProc+0x2b 0019fd70 748e4370 004ae08e 00000000 0000000f USER32!UserCallWinProcCheckWow+0x1f0 0019fdd0 748eb179 00eed8f0 00000000 0000000f USER32!DispatchClientMessage+0xf0 0019fe10 777fad66 0019fe2c 00000020 0019fe90 USER32!__fnDWORD+0x49 0019fe48 7490509c 748e419b 008aafd0 787b6351 ntdll_77790000!KiUserCallbackDispatcher+0x36 0019fe4c 748e419b 008aafd0 787b6351 008aafa0 USER32!NtUserDispatchMessage+0xc 0019fea0 748e3e50 78629df1 00000000 004b1d6c USER32!DispatchMessageWorker+0x33b 0019feac 004b1d6c 008aafd0 008aafd0 00599b10 USER32!DispatchMessageW+0x10 00000000 00000000 00000000 00000000 00000000 SlimPDF_Reader+0xb1d6c STACK_COMMAND: ~0s ; .cxr ; kb THREAD_SHA1_HASH_MOD_FUNC: 23c6551acd70e2ee68c3fe17230a519c8d2edbd8 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: c0fb1c21cd18236bfb477e6f4ab150f37a3c72a8 THREAD_SHA1_HASH_MOD: fca436a783f277e0e687fc89df0c8a6506b6fcd9 FAULT_INSTR_CODE: 75084639 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: SlimPDF_Reader+3457c FOLLOWUP_NAME: MachineOwner MODULE_NAME: SlimPDF_Reader IMAGE_NAME: SlimPDF_Reader.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4ecd831a FAILURE_BUCKET_ID: NULL_CLASS_PTR_READ_c0000005_SlimPDF_Reader.exe!Unknown BUCKET_ID: APPLICATION_FAULT_NULL_CLASS_PTR_READ_INVALID_POINTER_READ_ZEROED_STACK_SlimPDF_Reader+3457c FAILURE_EXCEPTION_CODE: c0000005 FAILURE_IMAGE_NAME: SlimPDF_Reader.exe BUCKET_ID_IMAGE_STR: SlimPDF_Reader.exe FAILURE_MODULE_NAME: SlimPDF_Reader BUCKET_ID_MODULE_STR: SlimPDF_Reader FAILURE_FUNCTION_NAME: Unknown BUCKET_ID_FUNCTION_STR: Unknown BUCKET_ID_OFFSET: 3457c BUCKET_ID_MODTIMEDATESTAMP: 4ecd831a BUCKET_ID_MODCHECKSUM: 0 BUCKET_ID_MODVER_STR: 1.0.1.12 BUCKET_ID_PREFIX_STR: APPLICATION_FAULT_NULL_CLASS_PTR_READ_INVALID_POINTER_READ_ZEROED_STACK_ FAILURE_PROBLEM_CLASS: APPLICATION_FAULT FAILURE_SYMBOL_NAME: SlimPDF_Reader.exe!Unknown WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/SlimPDF Reader.exe/1.0.1.12/4ecd831a/SlimPDF Reader.exe/1.0.1.12/4ecd831a/c0000005/0003457c.htm?Retriage=1 TARGET_TIME: 2018-05-28T05:55:11.000Z OSBUILD: 10240 OSSERVICEPACK: 17113 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 OSPLATFORM_TYPE: x64 OSNAME: Windows 10 OSEDITION: Windows 10 WinNt SingleUserTS USER_LCID: 0 OSBUILD_TIMESTAMP: 2016-09-07 11:54:11 BUILDDATESTAMP_STR: 170602-2340 BUILDLAB_STR: th1 BUILDOSVER_STR: 10.0.10240.17443.amd64fre.th1.170602-2340 ANALYSIS_SESSION_ELAPSED_TIME: 81ce ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:null_class_ptr_read_c0000005_slimpdf_reader.exe!unknown FAILURE_ID_HASH: {46980e42-0101-b5c8-decb-c547562bd18a} Followup: MachineOwner ---------

[securitymy]

CVE-2018-1000097 - Sharutils Buffer Overflow

Vulnerability Title: Sharutils (unshar) Buffer Overflow

CVE: CVE-2018-1000097

Date (reported): Feb 21, 2018

Vendor: https://www.gnu.org/software/sharutils/

Software Link: https://ftp.gnu.org/gnu/sharutils/sharutils-4.15.2.tar.gz

Affected Version: 4.15.2 (stable released May 30, 2015)

Tested on: Ubuntu 16.04 LTS

Severity: Medium

Summary

Sharutils is a package for creating and manipulating shell archives that can be readily emailed. A shell archive is a file that can be processed by a Bourne-type shell to unpack the original collection of files. Shar makes so-called shell archives out of many files, preparing them for transmission by electronic mail services (converting binary data to ASCII representations, breaking the text into multiple shar scripts, etc.). Unshar is the safe way to extract and reassemble the original files. It will automatically strip off the mail headers and other introductory text.

Vulnerability Description

Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file.

Sharutils Fuzzing

We fuzzed the sharutils package (unshar) with AFL and came up with quite number of results. Our setup:

Compile the program with the following command "CC=afl-gcc CXX=afl-g++ AFL_USE_ASAN=1 ./configure"

Once it passed, then run "AFL_USE_ASAN=1 make"

This will compile the binary with ASAN and AFL.

Once configure properly, we run the AFL fuzzer with the following command "afl-fuzz -m none -i input/ -o output/ -- ./unshar @@". Within 4 hours, we managed to get 5 unique crashed. See the result of AFL:

We then verified if the crashed are indeed valid. 

john@fuzzing:~/sharutils-4.15.2/src$ ./unshar output/crashes/id:000000,sig:06,src:000052,op:havoc,rep:64 ================================================================= ==20801==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb6101100 at pc 0x0804c6e3 bp 0xbfcb9138 sp 0xbfcb9128 READ of size 1 at 0xb6101100 thread T0 #0 0x804c6e2 in looks_like_c_code /home/john/sharutils-4.15.2/src/unshar.c:81 #1 0x804c6e2 in find_archive /home/john/sharutils-4.15.2/src/unshar.c:253 #2 0x804c6e2 in unshar_file /home/john/sharutils-4.15.2/src/unshar.c:379 #3 0x804a2f4 in validate_fname /home/john/sharutils-4.15.2/src/unshar-opts.c:604 #4 0x804a2f4 in main /home/john/sharutils-4.15.2/src/unshar-opts.c:639 #5 0xb787d636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636) #6 0x804ab95 (/home/john/sharutils-4.15.2/src/unshar+0x804ab95) 0xb6101100 is located 0 bytes to the right of 4096-byte region [0xb6100100,0xb6101100) allocated by thread T0 here: #0 0xb7ab1dee in malloc (/usr/lib/i386-linux-gnu/libasan.so.2+0x96dee) #1 0x804c9e4 in init_unshar /home/john/sharutils-4.15.2/src/unshar.c:450 #2 0xb787d636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/john/sharutils-4.15.2/src/unshar.c:81 looks_like_c_code Shadow bytes around the buggy address: 0x36c201d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36c201e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36c201f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36c20200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36c20210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x36c20220:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36c20230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36c20240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36c20250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36c20260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36c20270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==20801==ABORTING

Vulnerability

Our observation found that it was from unshar.c and the root cause started on "find_archive()". In the line 449, we can see rw_buffer has allocated rw_base_size which is 8192 bytes. 

Line 449 - 450:

rw_base_size = GET_PAGE_SIZE; rw_buffer = malloc (rw_base_size);

At line 45, you can see the GET_PAGE_SIZE buffer size has been set to 8192 bytes. 

Line 45:

# define GET_PAGE_SIZE 8192

We observed the size of BUFSIZ was allocated to 8192 bytes, however in this case the rw_base_size size is not similar with the memory page allocation. Thus, the issue allow to write out of the allocated memory for rw_buffer. Failure to do so, can lead to application crash. 

Line 243 - 249:

if (!fgets (rw_buffer, BUFSIZ, file)) // BUFSIZ is not equal to rw_buffer (allocated buffer) that leads to overflow { if (!start) error (0, 0, _("Found no shell commands in %s"), name); return false; }

Patch

We reported the security issue via proper channel by sending an email to [email protected] and to Bugtraq mailing-list. Initially, we find out Red Hat / Fedora Security team taking care of the issue, https://bugzilla.redhat.com/show_bug.cgi?id=1548018 and ship the fixed to stable repository on 2018-03-06. It then follow by Ubuntu security and published advisory https://usn.ubuntu.com/3605-1/ on 2018-03-22. 

Patch Diff:

diff -Nru sharutils-4.15.2/debian/changelog sharutils-4.15.2/debian/changelog --- sharutils-4.15.2/debian/changelog 2015-08-03 15:31:35.000000000 +0000 +++ sharutils-4.15.2/debian/changelog 2018-03-21 23:30:23.000000000 +0000 @@ -1,3 +1,12 @@ +sharutils (1:4.15.2-1ubuntu0.1) xenial-security; urgency=medium + + * SECURITY UPDATE: Buffer overflow + - debian/patches/CVE-2018-1000097.patch: fix in + src/unshar.c. + - CVE-2018-1000097 + + -- Leonidas S. Barbosa <[email protected]> Wed, 21 Mar 2018 20:30:03 -0300 + sharutils (1:4.15.2-1) unstable; urgency=medium * New upstream release. diff -Nru sharutils-4.15.2/debian/control sharutils-4.15.2/debian/control --- sharutils-4.15.2/debian/control 2015-05-31 23:39:08.000000000 +0000 +++ sharutils-4.15.2/debian/control 2018-03-21 23:30:26.000000000 +0000 @@ -1,7 +1,8 @@ Source: sharutils Section: utils Priority: optional -Maintainer: Santiago Vila <[email protected]> +Maintainer: Ubuntu Developers <[email protected]> +XSBC-Original-Maintainer: Santiago Vila <[email protected]> Standards-Version: 3.9.6 Build-Depends: debhelper (>= 9.20120311), texinfo Homepage: http://www.gnu.org/software/sharutils/ diff -Nru sharutils-4.15.2/debian/patches/CVE-2018-1000097.patch sharutils-4.15.2/debian/patches/CVE-2018-1000097.patch --- sharutils-4.15.2/debian/patches/CVE-2018-1000097.patch 1970-01-01 00:00:00.000000000 +0000 +++ sharutils-4.15.2/debian/patches/CVE-2018-1000097.patch 2018-03-21 23:29:56.000000000 +0000 @@ -0,0 +1,59 @@ +Backported of: + +The bellow patch should fix it. I don't know if sharutils author prefers +reading up to a memory page size or an I/O buffer size. + + +>From 1067cdba6d08f2a765cb0ea371189a5b703eb4db Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <address@hidden> +Date: Thu, 22 Feb 2018 16:39:43 +0100 +Subject: [PATCH] Fix a heap-buffer-overflow in find_archive() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +rw_buffer has allocated rw_base_size bytes. But subsequend fgets() in +find_archive() reads up-to BUFSIZ bytes. + +On my system, BUFSIZ is 8192. rw_base_size is usually equaled to +a memory page size, 4096 on my system. Thus find_archive() can write +beyonded allocated memmory for rw_buffer array: + +$ valgrind -- ./unshar +/tmp/id\:000000\,sig\:06\,src\:000005+000030\,op\:splice\,rep\:4 +==30582== Memcheck, a memory error detector +==30582== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. +==30582== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info +==30582== Command: ./unshar +/tmp/id:000000,sig:06,src:000005+000030,op:splice,rep:4 +==30582== +==30582== Invalid write of size 1 +==30582== at 0x4EAB480: _IO_getline_info (in /usr/lib64/libc-2.27.so) +==30582== by 0x4EB47C2: fgets_unlocked (in /usr/lib64/libc-2.27.so) +==30582== by 0x10BF60: fgets_unlocked (stdio2.h:320) +==30582== by 0x10BF60: find_archive (unshar.c:243) +==30582== by 0x10BF60: unshar_file (unshar.c:379) +==30582== by 0x10BCCC: validate_fname (unshar-opts.c:604) +==30582== by 0x10BCCC: main (unshar-opts.c:639) +==30582== Address 0x523a790 is 0 bytes after a block of size 4,096 alloc'd +==30582== at 0x4C2DBBB: malloc (vg_replace_malloc.c:299) +==30582== by 0x10C670: init_unshar (unshar.c:450) +==30582== by 0x10BC55: main (unshar-opts.c:630) + +This was reported in +<http://lists.gnu.org/archive/html/bug-gnu-utils/2018-02/msg00004.html>. + +Signed-off-by: Petr PísaÅ™ <address@hidden> +diff --git a/src/unshar.c b/src/unshar.c +index 80bc3a9..0fc3773 100644 +--- a/src/unshar.c ++++ b/src/unshar.c +@@ -240,7 +240,7 @@ find_archive (char const * name, FILE * file, off_t start) + off_t position = ftello (file); + + /* Read next line, fail if no more and no previous process. */ +- if (!fgets (rw_buffer, BUFSIZ, file)) ++ if (!fgets (rw_buffer, rw_base_size, file)) + { + if (!start) + error (0, 0, _("Found no shell commands in %s"), name); diff -Nru sharutils-4.15.2/debian/patches/series sharutils-4.15.2/debian/patches/series --- sharutils-4.15.2/debian/patches/series 2015-05-11 16:41:13.000000000 +0000 +++ sharutils-4.15.2/debian/patches/series 2018-03-21 23:29:56.000000000 +0000 @@ -1 +1,2 @@ 99-config-guess-config-sub +CVE-2018-1000097.patch

[securitymy]

CVE-2017-1000414 - Division by Zero Vulnerability Analysis

Vulnerability Title: JPEGSnoop "JfifDecode.cpp" Integer Division by Zero Date: 6/5/2017 Vendor: http://www.impulseadventure.com/photo/ Software Link: http://www.impulseadventure.com/dl.php?file=JPEGsnoop_v1_7_5.zip Affected Version: 1.7.5 Tested on: Windows 7 (32-bit), Windows 10

Summary JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG, MotionJPEG AVI and Photoshop files. It can also be used to analyze the source of an image to test its authenticity.

Vulnerability Description JPEGsnoop suffers from a division by zero attack when handling JFIF decoding, resulting in denial of service vulnerability and possibly loss of data. The vulnerable part found to perform a calculations that require all tables to be present. Details of the divide by zero issue:

⦁ Exception happened on the EIP:0x011d2a1d, this can be disassemble (instruction pointer leads to where it crash). ⦁ Disassemble of EIP 0:000> u 011d2a1d JPEGsnoop+0x32a1d: 011d2a1d f7b48f78110000  div     eax,dword ptr [edi+ecx*4+1178h] 011d2a24 33d2            xor     edx,edx 011d2a26 894508          mov     dword ptr [ebp+8],eax 011d2a29 8b877c190000    mov     eax,dword ptr [edi+197Ch] 011d2a2f f7b48f78150000  div     eax,dword ptr [edi+ecx*4+1578h] 011d2a36 83bf8c19000002  cmp     dword ptr [edi+198Ch],2 011d2a3d 7414            je      JPEGsnoop+0x32a53 (011d2a53) 011d2a3f 50              push    eax ⦁ We need to take note on the registers where exception happened. This will help us to determine the exception are indeed correct. 0:000> r eax=00000000 ebx=00eb2378 ecx=00000000 edx=00000000 esi=05f5ab28 edi=00eb09e8 eip=011d2a1d esp=007ce5c8 ebp=007ce5f4 iopl=0         nv up ei pl zr na pe nc cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246 JPEGsnoop+0x32a1d: 011d2a1d f7b48f78110000  div     eax,dword ptr [edi+ecx*4+1178h] ds:002b:00eb1b60=00000000

⦁ We can see the instruction "div eax, dword ptr [edi+ecx*4+1178h], so we break down as: edi = 00eb09e8 ecx = 00000000 * 4 0x1178

The math: dword ptr --- 00eb09e8 + 00000000 * 4 + 1178 = 0xeb1b60 <--- data segment eax --- 0x00000000

Divide eax with the data segment value: 0xeb1b60 / 0x00000000 = value cannot be divide with zero

Thus, resulting to denial of service to the vulnerable application.

Below are the results of crash dump and disassembly of the root cause:

---Crash Dump--- (5d4.39c): Integer divide-by-zero - code c0000094 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** WARNING: Unable to verify checksum for JPEGsnoop.exe *** ERROR: Module load completed but symbols could not be loaded for JPEGsnoop.exe eax=00000000 ebx=00eb2378 ecx=00000000 edx=00000000 esi=05f5ab28 edi=00eb09e8 eip=011d2a1d esp=007ce5c8 ebp=007ce5f4 iopl=0         nv up ei pl zr na pe nc cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246 JPEGsnoop+0x32a1d: 011d2a1d f7b48f78110000  div     eax,dword ptr [edi+ecx*4+1178h] ds:002b:00eb1b60=00000000

---Disassembly--- .text:004329C2 loc_4329C2:                             ; CODE XREF: sub_432800+1B1j .text:004329C2                                         ; sub_432800+1BBj .text:004329C2                 push    3               ; int .text:004329C4                 lea     ebx, [edi+1990h] .text:004329CA                 push    offset a?x?     ; "?x?" .text:004329CF                 mov     ecx, ebx .text:004329D1                 call    sub_401AC0 .text:004329D6                 push    4               ; int .text:004329D8                 lea     ecx, [edi+1DE8h] .text:004329DE                 push    offset aNone    ; "NONE" .text:004329E3                 call    sub_401AC0 .text:004329E8                 push    4               ; int .text:004329EA                 lea     ecx, [edi+1DECh] .text:004329F0                 push    offset aNone    ; "NONE" .text:004329F5                 call    sub_401AC0 .text:004329FA                 cmp     byte ptr [edi+20h], 0 .text:004329FE                 jz      loc_432B3F .text:00432A04                 mov     eax, [edi+974h] .text:00432A0A                 cmp     eax, 3 .text:00432A0D                 jnz     short loc_432A67 .text:00432A0F                 mov     ecx, [edi+980h] .text:00432A15                 mov     eax, [edi+1978h] .text:00432A1B                 xor     edx, edx .text:00432A1D                 div     dword ptr [edi+ecx*4+1178h] <--- vulnerability here .text:00432A24                 xor     edx, edx .text:00432A26                 mov     dword ptr [ebp+ArgList], eax .text:00432A29                 mov     eax, [edi+197Ch] .text:00432A2F                 div     dword ptr [edi+ecx*4+1578h] .text:00432A36                 cmp     dword ptr [edi+198Ch], 2 .text:00432A3D                 jz      short loc_432A53 .text:00432A3F                 push    eax .text:00432A40                 push    dword ptr [ebp+ArgList] ; ArgList .text:00432A43                 push    offset aUxU     ; "%ux%u" .text:00432A48                 push    ebx             ; int .text:00432A49                 call    sub_401650 .text:00432A4E                 add     esp, 10h .text:00432A51                 jmp     short loc_432A78 .text:00432A53 ; --------------------------------------------------------------------------- .text:00432A53 .text:00432A53 loc_432A53:                             ; CODE XREF: sub_432800+23Dj .text:00432A53                 push    dword ptr [ebp+ArgList] .text:00432A56                 push    eax             ; ArgList .text:00432A57                 push    offset aUxU     ; "%ux%u" .text:00432A5C                 push    ebx             ; int .text:00432A5D                 call    sub_401650 .text:00432A62                 add     esp, 10h .text:00432A65                 jmp     short loc_432A78

Patch Released in version 1.8.0: - http://www.impulseadventure.com/photo/jpeg-snoop.html - http://www.impulseadventure.com/photo/jpeg-snoop-history.html (Fixed vulnerability (div0) with invalid DQT)

[securitymy]

Wargames.my 2017 - Notepad

This is a tough challenge. The bug is SQL injection in subdomain param. And it is blind based. So we need sqlmap for that. :)

Payload: select1.notepad.wargames.my:8080'

Then, dump the admin email as we can reset password later. Run sqlmap again and grab the admin token. Now, we can reset admin password and login to admin portal.

There are admin page to edit template. Here come the RCE to grab the flag. We need to use phpinfo() to get the path first. Then after checking for disabled_function, lucky file_get_contents is allowed. Use that function to get the flag.

[securitymy]

Wargames.my 2017 - Ezfilesharing

This web challenge hints are:

do you able to retrieve the source code? - need to download the source code!!!

4 character, browse it and im yours - We dont understand this hint. lol.

silly developer leaving his code changes tracker folder.. - tracker??.. hurmm..

Fuzzing for directory/files and we got .git folder. Nice, public git folder meaning we can get the source code.

We use this tools to dump and extract the source code: https://github.com/internetwache/GitTools

Which folder do we need? Lets check the main header.

So we use the 2-6f3.....................771d. And the flag is in index.php file.

[securitymy]

Wargames.my 2017 - MailMarketer

We are landed to default page of Ubuntu. The hints are:

what are other default page for apache2 with mod_php installed - ok, must be index.php

Just do it! - still dont understant until now. lol.

As the challenge is MailMarketer, the bug might be in “mail“ function related. There are a page to sent email and the function works. We try to sent email and look at the headers (took some time to notice this). They use phpmailer version 5.2.21 which has public exploit. You can refer to this: https://www.exploit-db.com/exploits/43056/.

The exploit payload is using <img src="<file to read>">. So, what do we need to read? After some fuzzing, there are flag.php file. We include the file:

<img src="</var/www/html/flag.php>">

...sent email and we got the flag.php as attachment which contain flag.

Flag: WGMY:{3Ma1L_H3ad3r_1z_Ju1cy}that is for mail

[securitymy]

Wargames.my 2017 - Unreachable

This is the pcap challenge. The hints are:

he is tracing backwardly. - read it from bottom to up?

nothing to do with Traceroute - ok then..

"hello IT, I can't access to this server" .. what IT support always start with? - ping?

RFC 792 - icmp?

Lets fireup wireshark and apply this filter: (icmp) && (ip.src == 192.168.1.8).

Now, export the displayed result by Export Packet Dissections -> As Plain Text.

As hint #1 said “tracing backwardly“, we look the data from bottom of the file. And notice there are differences between each packet frames. That is the flag for this challenge.

At first we thought the flag is: flag_is_p!ngp0ng~ but it is not but p!ngp0ng~

[securitymy]

Wargames.my 2017 - BeatMe

We didn't manage to solve this in time but wanted to share my notes on it.

After beautifying the source, we used an AST solver (http://m1el.github.io/esdeobfuscate/) to clean the code up (thanks to @najashark for pointing this out).

Next we tried to narrow down the keyspace using the code below.

<html> <body> <script> function nyahsulit(flag, key, input) { keluar = ''; for(i = 0; i < flag.length; i++) { var fi = flag[i].charCodeAt(0); kt = '' var alch = '0123456789abcdef'; for(j=0;j<16;j++){ if(i-1 < 0) var v_xor = fi^(alch[j].charCodeAt(0)); else var v_xor = fi^(alch[j].charCodeAt(0)^(i-1)); if(v_xor >= 0x2e && v_xor <= 0x7E){ kt += "(" + alch[j] + ")" + String.fromCharCode(v_xor) + ", "; //kt += String.fromCharCode(v_xor) + ", "; } } //var kk = key.charCodeAt(0); //temp = String.fromCharCode(fi^kk); //key = String.fromCharCode(i^input[i].charCodeAt(0)); keluar += "[" + i + "] = " + kt + "\n"; } return(keluar); } var flag = window.decodeURIComponent('f%7F*%3A%5CM%0DN%0B%02L%1A%02X%084O%15Z)JC%04~WHl%18eH%1DP'); var key = String.fromCharCode(0x11); var ret = nyahsulit(flag, key, 'd23456'); console.log(ret); </script> </body> </html>

And we also tried bruteforcing using the code below (this would have taken too long)

import md5 import itertools import string def bruteforce(charset, maxlength): return (''.join(candidate) for candidate in itertools.chain.from_iterable(itertools.product(charset, repeat=i) for i in range(maxlength, maxlength + 1))) for comb in bruteforce(string.ascii_lowercase, 12): #s = "0" * (3-len(s)) + s m = md5.new() m.update("".join(comb)) h = m.hexdigest() if h[0] == '8' and h[1] == 'f' and h[2] == 'a' and h[3] == 'e' and h[4] == '2' and h[-2] == '3': print("".join(comb), h)

Another alternative we tried was trying to filter out the first few chars of the hash at https://md5db.net/explore/18FA

Decryption key: bountyhunter

Flag: WGMY:{ny4hsul17_x0r_not_s3LaMa7}

[securitymy]

Wargames.my 2017 - YSoSerial

This challenge a pcap with USB traffic is provided, after analysis, we found that it involved keyboard input and transfer of files to a flashdrive.

We first extracted contents of the flashdrive to find a python script below.

Next we isolated and extracted the keyboard inputs and used the python processing script below (taken and adapted from https://habrahabr.ru/post/335012/) to extract the keystrokes.

#!/usr/bin/python import binascii import dpkt import struct import sys # Start the pcap file parsing f = open(sys.argv[1], 'rb') pcap = dpkt.pcap.Reader(f) # Create a partial mapping from keycodes to ASCII chars keys = {} keys.update({ i + 0x4: chr(i + ord('a')) for i in range(26) }) keys.update({ i + 0x1e: chr(i + ord('1')) for i in range(9) }) keys[0x27] = '0' keys.update({ 0x28: '\n', 0x2a: '[BACKSPACE]', 0x2b: '\t', 0x2c: ' ', 0x2d: '-', 0x2e: '=', 0x2f: '[', 0x30: ']', 0x31: '\\', 0x33: ';', 0x34: '\'', 0x35: '`', 0x36: ',', 0x37: '.', 0x38: '/', 0x4f: '[RIGHT_ARROW]', 0x50: '[LEFT_ARROW]', 0x52: '[KEY_UP]', 0x58: '[ENTER]' }) keys_shift = {} keys_shift.update({ i + 0x4: chr(i + ord('A')) for i in range(26) }) keys_shift.update({ 0x1e: '!', 0x1f: '@', 0x20: '#', 0x21: '$', 0x22: '%', 0x23: '^', 0x24: '&', 0x25: '*', 0x26: '(', 0x27: ')', 0x2e: '+', 0x2f: '{', 0x30: '}', 0x31: '|', 0x33: ':', 0x34: '"', 0x35: '~', 0x36: '<', 0x37: '>', 0x38: '?', }) txt = '' # Then iterate over each USB frame i = 0 for ts, buf in pcap: i += 1 print(repr(txt)) buf = buf[-8:] if buf == "\x00" * 8: continue #print(repr(buf)) key_code = ord(buf[2]) shift_state = ord(buf[0]) if not key_code: continue if shift_state: # print('[%d] key_code: %s char: %s' % (i, hex(key_code), keys_shift[key_code])) txt += keys_shift[key_code] else: #print('[%d] key_code: %s char: %s' % (i, hex(key_code), keys[key_code])) try: txt += keys[key_code] except: print(hex(key_code)) txt += "*" # sys.stdout.write(keys[key_code]) print(txt)

This gave us the result below.

Reordering the keystrokes gave us the below and running it provided us with the flag.

Flag: UniVers4l_53r1al_bu5

[securitymy]

Wargames.my 2017 - Rans0me-N00b-W4r3

Reverse engineer protection to recover data. Below is the algorithm used,

After doing abit of digging, we find a very very very similar implementation from Microsoft @ https://msdn.microsoft.com/en-us/library/windows/desktop/aa382044(v=vs.85).aspx

The password is derived from the file name with the first char replaced, we implemented this and decrypted the flag.

Below is the code which generated the first char of the password.

Below is the decrypted flag file

Flag: L4m3R4n$0mwAr31zL4m3

[securitymy]

Wargames.my 2017 - Selimut Tetangga Challenge

This challenge required you to connect via SCTP protocol, do that and it will give you the flag, we used the template code from http://matrixsust.blogspot.my/2011/11/basic-sctp-client-server-code-in-c.html

Below is the decompiled code we identified flag sending from

Using the template C code, we managed to connect and get the flag.

Flag: wgmy{y0u_c4n_und3rst4nd_pr0t0c0l_y0u_m0f0}

[securitymy]

Wargames.my 2017 - Brazzer Challenge

This challenge is a fairly simple one, you connect to it, then it connect back to you on a random port with the flag. We solved this thanks to a many-to-one nat with Mikrotik.

Below is the code that does the connect back.

And the flag is xor’d with the port number its connecting back with.

I then used my Mikrotik to forward all connections from this server to a netcat listening on my pc. The connection finally came back on port 51038 and using the data received, we are able to recover the flag.

import struct #wgmy{r34l_m4n_w4tch_br4zz3r5} key = 0xC4D0 data = open("flag_51038", 'rb').read() x = map(''.join, zip(*[iter(data)]*4)) for y in x: y = struct.unpack("<L", y)[0] y = y ^ key print(struct.pack("<L", y))

Flag: wgmy{r34l_m4n_w4tch_br4zz3r5}

[securitymy]

Wargames.my 2017 - I Open At The Close

This challenge requires you to download a 1GB file from [http://1511.wargames.my/](http://1511.wargames.my/), the only catch is, each IP is rate limited to 5600bps.

We solved it by using the HTTP Range Header

import http.client conn = http.client.HTTPConnection('1511.wargames.my') conn.request("GET", '/images.img', headers={'Range': 'bytes=1073741820-1073741857'}) resp = conn.getresponse() resp.status if resp.status == http.client.PARTIAL_CONTENT: print("OK") resp.getheader('content-range') content = resp.read() print(len(content)) print(content[::-1])

Flag: wrgm:{doyoulikebigfiles}

[securitymy]

Wargames.my 2017 - Scoreboard

Congratulations to the winners and kudos to the organizers for a great game. See you guys again next year!!!!!!

[securitymy]

CVE-2017-8176

This vulnerability was found on a huawei STB that is used by a popular ISP here in Malaysia. The flaw lies in the fact that the software relies on the client to enforce subscription validation.

The web-server that the STB connects to retrieve the UI runs over HTTP and this parameter is modifiable through a configuration menu. By relaying HTTP traffic to a custom proxy running on the STB, we can substitute the requested HTML files that contain subscription validation with local files that have them removed and enable the viewing of all the channels for free.

This vulnerability affects all the STBs (Mips/Arm/Android Firmware)

Source code of the custom proxy used is available at @ http://github.com/klks/swproxy

To note, huawei was very responsive and professional in communications. They also asked that public disclosure be delayed to Sept 15th to ensure their customers had a chance to fully roll out the fix for this vulnerability.