Heap Allow Byline with airSlate SignNow

Heap forward byline

A very common issue that we still constantly encounter is shown in heap level 2 of exploit-exercises.com. This is a classic use-after-free vulnerability. Let’s try to understand the code first. We have here a big while loop inside of main. In each round it prints the variable auth, which is a pointer to an object of this auth struct up here. And auth has the attributes name which is a string up to 32 characters and an integer. And the other variable that is printed is a char pointer service, which can point to a string in memory. So both of these are addresses - pointers. Then we read a line from standard input. Maximum 128 bytes, so this is a secure fgets read. No buffer overflow. Afterwards we have a couple of ifs that check if the input line is one of the following commands. Either “auth”, “reset”, “service” or “login”. Let’s execute the program as well and then let’s talk about each command. When we first start the program, both the auth and the service pointer are null. Now we wait for input. Let’s have a look at the “auth” command. When we type auth, it will allocate the size of the auth struct, so that should be 32byte for the name + 4 byte for the integer. Then the whole allocated memory is overwritten with zeroes. This makes sense because if on the heap, data is constantly allocated and freed, then a newly allocated area can have old data in there. A free does not zero out the memory. So here it’s zeroes out on allocation. Afterwards the length of the input line is checked, so it doesn’t exceed the 32 bytes available in the auth struct for the name. And if that is safe, the characters after the auth command are copied to the name of the auth object. Let’s try that, let’s authenticate as admin. Cool, as we can see the variable auth contains now an address. This is where the auth object is on the heap. Now the last command is “login”, which checks if the integer of the auth object is not zero, and if that’s the case we sucessfully logged in. Otherwise, if it’s zero, then it tells us to enter a password. Though in this case there is not more functionality than that. but just imagine that you are trying to login as admin, without knowing my password. So somehow our goal is to set the integer to a value, and then we are authenticated. At the moment it seems impossible, because the integer auth is never set anywhere, but we have learned from the beginning, that there are bugs that allow us to modify variables. Another command here is reset, which will free the auth object on the heap. And this is actually where the issue is. You notice when we reset the login process, it frees the auth object, but as you can see the auth variable is not...