A security vulnerability report arrived that went roughly like this:<\/p>\n
\nI have found a security vulnerability in the
CONTOSO.DLL<\/code> dynamic-link library. [Long description of methodology omitted, including discussion of dead ends and failed attempts. The short version is “I looked for code that callsprintf<\/code> with a format string that is generated at runtime rather than a hard-coded string. That code is subject to a format string attack.”]<\/p>\nAttached is a proof of concept.<\/p>\n
int main()\r\n{\r\n \/\/ vulnerable function is at offset 0x12345\r\n auto p = (LPBYTE)LoadLibrary(\"contoso.dll\") + 0x12345;\r\n auto fn = (void(*)(char const*, int))p;\r\n\r\n \/\/ Call the function with a %n format string\r\n fn(\"%n\", 42);\r\n}\r\n<\/pre>\nI am requesting a bounty for this report.<\/p>\n
Note that this is the first security vulnerability I have found and submitted. I acknowledge that my understanding is incomplete. Please provide additional advice and assistance to help me become a better security researcher. I look forward to your reply.<\/p>\n<\/blockquote>\n
This is like calling the natural gas utility company’s emergency number to report a major gas leak in your house. The gas company sends a technician over, and they can’t find any leak. They ask how you came to suspect that there’s a gas leak, and you tell them, “Oh, I didn’t smell anything.\u00b9 I called you because I’m hoping to learn more about how to recognize the smell of gas. Do you have any tips?”<\/p>\n
Yes, the tip is that if you don’t know how to recognize the smell of gas, you can use existing educational materials to learn how to recognize the smell of gas. Don’t call the emergency line to learn what gas smells like.\u00b2 The emergency line is not intended to be used as a source of training data. There are other places to learn more about the smell of gas.<\/p>\n
In this case, no security boundary has been crossed. The “vulnerable” code is loaded into the attacker’s process, and the attacker is calling it directly. Attackers who want to attack their own processes don’t need the help of
contoso.dll<\/code>.<\/p>\nFor example, they could have gone directly to the C runtime library.<\/p>\n
int main()\r\n{\r\n \/\/ vulnerable function is called \"printf\"\r\n auto p = GetProcAddress(LoadLibrary(\"ucrtbase.dll\"), \"printf\");\r\n auto fn = (void(*)(char const*, ...))p;\r\n\r\n \/\/ Call the function with a %n format string\r\n fn(\"%n\", 42);\r\n}\r\n<\/pre>\nwhich simplifies to<\/p>\n
int main()\r\n{\r\n \/\/ Call printf with a %n format string\r\n printf(\"%n\", 42);\r\n}\r\n<\/pre>\nThe internal function they found in
contoso.dll<\/code> is a passthrough toprintf<\/code>. It is called only with known format strings which match the rest of theprintf<\/code> parameters. The string is not hard-coded because the format string is looked up at runtime to match the user’s preferred language. There is no way to get this DLL to pass an untrusted format string toprintf<\/code>, at least not through the function under attack.<\/p>\nBesides, if you are interested in doing dangerous things by calling functions in a way that cannot be externally triggered, then
printf<\/code> is a particularly complicated to do it. Much easier is to find a function that ends with something like<\/p>\nmov qword ptr [rdx], rcx\r\n ... other instructions that you can stage mitigations for\u00b3 ...\r\n ret\r\n<\/pre>\nPut the desired value in
ecx<\/code> and the desired target address inedx<\/code>, and call that function! No need to dragprintf<\/code> into it.<\/p>\nAnd if you’re still learning about searching for security vulnerabilities, please don’t send in reports until you’ve learned the part about exploitability. Thanks.<\/p>\n
\u00b9 Yes, natural gas is odorless. The smell is added by gas companies.<\/p>\n
\u00b2 It is common for parents at my children’s Chinese-language school to socialize in the cafeteria while the students are attending their lessons. There was a time a few years ago where one of the parents thought they smelled gas. They asked others to check it out, and opinions were mixed. Some people agreed that they smelled gas, but others thought it was something else. Eventually, the source of the odor was identified: Somebody had brought durian fruit as a snack and was eating it in the cafeteria.<\/p>\n
\u00b3 For example, I found this sequence:<\/p>\n
mov dword ptr [rdx],ecx\r\n mov rbx,qword ptr [rsp+88h]\r\n mov eax,ebp\r\n add rsp,40h\r\n pop r15\r\n pop r14\r\n pop r13\r\n pop r12\r\n pop rdi\r\n pop rsi\r\n pop rbp\r\n ret\r\n<\/pre>\nYou can stage a call to this by pre-pushing the registers and return address onto the stack and pre-subtracting
40h<\/code> fromrsp<\/code>, then calling the function.<\/p>\nHey look, in the same DLL, I found this instruction sequence:<\/p>\n
mov dword ptr [rax],ecx\r\n ret\r\n<\/pre>\nThat will work great.<\/p>\n","protected":false},"excerpt":{"rendered":"
You can already attack yourself in far more interesting ways.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-107528","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
You can already attack yourself in far more interesting ways.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/107528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=107528"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/107528\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=107528"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=107528"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=107528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}