Federico Bento

[Federico Bento @uid1000]

I was bored so I wrote an exploit for CVE-2015-6565 affecting OpenSSH 6.8-6.9, considered mostly to be a DoS
https://t.co/Xic94muDaK

[Federico Bento @uid1000]

Today I learned that a memory corruption vulnerability may not be considered a memory corruption vulnerability

[Federico Bento @uid1000]

@osxreverser @Balgan @lgrangeia you can give your two cents on this :P

[Federico Bento @uid1000]

@Balgan @osxreverser sure, in that case i guess you shouldn't be doing it :)

[Federico Bento @uid1000]

@buherator @pwntester Exceptions usually log info for e.g., debugging purposes, which can potentially be vulnerable to log4shell. You should attempt triggering exceptions to hopefully hit the vulnerable code path.

[Federico Bento @uid1000]

@osxreverser @qrs what's the anti-debugging trick?

[Federico Bento @uid1000]

@osxreverser Considering the qualys post detailed exploitation steps, it still took several days

[Federico Bento @uid1000]

Looking at a private version of PaX/grsec from the 2nd half of this year, there's no probabilistic xor cookie retaddr protection for the 'iret' insn case. I'm not saying it can't be done & I'm also not saying it isn't implemented in some later or exotic commercial version.

[Federico Bento @uid1000]

https://t.co/rgwwZzetZ9
It is an issue. I was specifically told that CAP_SYS_ADMIN -> kernel code exec via code ptr overwrites was within RAP's threat model. "It's less useful" doesn't really stand since otherwise RAP is just as useless in the presence of data-only attacks.

[Federico Bento @uid1000]

Because I'm blocked and can't answer brad's tweets directly in the thread, here it goes:

[Federico Bento @uid1000]

https://t.co/sNaefWkSi9
RAP_XOR was added, apparently, on March 11 2020. My work was published on September 2019, so my case still stands. The attack worked at the time, it's that simple.

[Federico Bento @uid1000]

Refs: https://t.co/5cPsmfngTO
https://t.co/ozj5oNjGHm

[PaX Team @paxteam]

@uid1000 section 3.3 is even worse. it shows an 'exploit' by changing memory directly from gdb. it only shows you couldn't even find a real bug or create one yourself to do it for real. second, you missed the fact that the xor cookie defense applies to all return addresses, iret included.

[Federico Bento @uid1000]

Not trying to add fuel to the fire here, but I just got a hold of the private versions of PaX/grsec (one version is a few months before & the other a few months after my work). In the later version the executable .rodata issue is fixed. I was told it was a 'known' 'non-issue'.

[Federico Bento @uid1000]

Alternatively, there's also no probabilistic xor cookie retaddr protection in any of the versions for either 'ret' or 'iret' insns as claimed.

[Federico Bento @uid1000]

@osxreverser Nah, there might be someone else out there who needs it more than I do :P

[Federico Bento @uid1000]

Talking about bruised egos, apparently a certain someone decided to throw a tantrum and block me because he just got nominated for the Lamest Vendor Response award... Isn't it ironic? Good riddance!

[Federico Bento @uid1000]

@osxreverser But did you drink the martini and wodka?

[Federico Bento @uid1000]

@jvanegue @gannimo @robertgraham Security by obscurity means the security of a system relies on its implementation details being secret, no more no less. ASLR is not security by obscurity, nor is modern crypto.

[Federico Bento @uid1000]

@gannimo @jvanegue @robertgraham How is ASLR security by obscurity then? The attacker knows everything about its implementation details too

[Federico Bento @uid1000]

@osxreverser Never used icedump? :P