BrokenPrint: A Netgear stack overflow

The vulnerability here is just a straight forward case of reading a size from the attacker, and using it in a memcpy into a fixed size destination buffer on the stack.

A little bit interesting in this case was the exploitation strategy used. While nothing ground breaking normally the only primitive we’ve covered being gained from the stack-based overflow is hijacking the stored return address between stack frames. This exploit used the stack-based overflow to get a couple other primitives first by corrupting the locals on the stack.

1. First the they were able to brute force a client_sock value. When the file descriptor used here was invalid the function just returned so it was simple to just try a value and keep incrementing until it worked.
2. With the client_sock leaked, there was the prefix_ptr and prefix_size values which provided an arbitrary read primitive as prefix_size bytes would be read from prefix_ptr and sent out over the socket and then freed. The free was an important constraint on where the prefix_ptr could point to, but otherwise it was arbitrary. They pointed it at the Global Offset Table (which for some reason worked despite the free call) to leak libc function pointers. With that they could calculate the address of system
3. The next step with system leaked was to get data they control in a consistent location. This turned out to be fairly easy just requiring an allocation large enough to get mmap‘d. Which could be caused just by sending a large enough HTTP request in the first place.
4. And finally they had all the pieces necessary to use a more traditional route with a ret2lib style attack.

While nothing ground breaking, especially for those new to the field I often see stack based overflow basically just meaning overwrite ret, and they really can be much more powerful than just a control flow hijack.