Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Best of show – abuse of libc

ioccc.org

Post reply on HN
Print view View original

71–80 of 84 posts

Re: Best of show – abuse of libc

#71

Post by xyproto »

npongratz wrote: post #56
FartyMcFarter wrote: post #33

Earlier quoted context omitted.

Presumably it needs a loop around it, so it's not Turing-complete by itself?

No need to use a loop around it, printf can take care of that pesky detail for you! To quote [0] (my emphasis): > To achieve full Turing-complete computation, we need a way to loop a format string. This is possible by overwriting the pointer inside printf() that tracks which character in the format string is currently being executed. The attacker is unlucky in that at the time the “%n” format specifier is used, this…

Herein lies madness

Re: Best of show – abuse of libc

#72

Post by Someone »

londons_explore wrote: post #63
Groxx wrote: post #5

> Format specifiers can take extra “arguments”. - "%hhn": store the number of bytes written mod 256 to the char pointer ... Oh boy. I'll put that down for my "thing I don't think I wanted to know" of the day.

Are there any scanners out there that will detect user input ending up as the format string of a printf? Perhaps a scanner than I can run against all of github, and then rank results by the number of times that code is exposed on a high value server connected to the internet...?

Any modern C compiler will already warn you if the format string isn’t a string literal (https://stackoverflow.com/questions/32362918/error-format-st...)

I don’t think it’s worth the effort to extend that to look for tainted strings, not because it wouldn’t be useful, but because it would be hard to do (as an extreme example: is data read from a file user input? It could be a file containing internationalization info)

The (relatively) few programs that construct format strings on the fly will have to add pragmas to disable these warnings.

Re: Best of show – abuse of libc

#73

Post by [deleted] »

blue-dragonfly wrote: post #64

A winner from 1993 is very interesting too: https://www.ioccc.org/years.html#1993_dgibson It implements Conway's Game of Life by creating a DSL using the C preprocessor and printf. The output is a program (several initial boards are supplied to bootstrap) which is the input program to be compiled and run to create the next generation. This is the program for a second generation: LIFE L _ _ _ _ _ L _ _ O _ _ L _ _ _ O…

[deleted]

Re: Best of show – abuse of libc

#74

Post by StavrosK »

npongratz wrote: post #17
flatiron wrote: post #15

Earlier quoted context omitted.

So I can port doom to gnu printf?

GNU's printf is Turing complete[0]... so "yes." [0] Mentioned (but not directly linked) by TFA: https://www.usenix.org/conference/usenixsecurity15/technical...

I've always wanted a Turing-complete printing function.

Re: Best of show – abuse of libc

#75

Post by Bootvis »

saagarjha wrote: post #68
dang wrote: post #61

Earlier quoted context omitted.

Is it possible that it's a joke based on the material of the OP? Maybe we're trapped in some sort of International Obfuscated Internet Thread Contest... Edit: ok, I'm guessing it's a joke about Turing completeness. Loops, you know.

It’s a joke about the recursion introduced here: https://news.ycombinator.com/item?id=25691615 .

Well executed jokes on HN. 2021 already is a crazy year.

Re: Best of show – abuse of libc

#76

Post by saagarjha »

astrange wrote: post #34
saagarjha wrote: post #30

Earlier quoted context omitted.

Someone should inform The Open Group about this violation of POSIX ;) Another fun fact: glibc does this too, if you compile with -D_FORTIFY_SOURCE=2. However, since Linux lacks the nice vm_region APIs the code opens up /proc/self/maps :/

dyld on Darwin has an API to ask if any pointer is to a read-only section of a binary. It’s useful because you can e.g. skip strcpys and other allocations.

Hmm, can you tell me more? I can't think of any situation where skipping on a strcpy is legal, since you provide the second buffer and so the copy must occur. And I know that there is heavy uniquing going on for things like selectors and CFStrings at compile time, but where is the dyld API being used at runtime?

Re: Best of show – abuse of libc

#77

Post by Narishma »

wahern wrote: post #18
lxe wrote: post #10

How did printf end up here in the first place? Decades of feature additions, or were these features a part of an early spec?

%n was defined in C89, the first C standard: http://port70.net/~nsz/c/c89/c89-draft.html#4.9.6.1 Looking at old source code, the earliest implementation I found is 4.3BSD Tahoe (1988). See https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Tahoe/usr/... Second oldest I found was Tenth Edition [Research] Unix (1989). See ocvt_n at https://www.tuhs.org/cgi-bin/utree.pl?file=V10/libc/stdio/vf... I couldn't find support i…

I'm pretty sure the compilers from Microsoft and Borland supported %n earlier than that. The earliest one I have easy access to that supports it is Microsoft C 4.0 from 1986.

Re: Best of show – abuse of libc

#78

Post by gambiting »

Narishma wrote: post #77
wahern wrote: post #18

Earlier quoted context omitted.

%n was defined in C89, the first C standard: http://port70.net/~nsz/c/c89/c89-draft.html#4.9.6.1 Looking at old source code, the earliest implementation I found is 4.3BSD Tahoe (1988). See https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Tahoe/usr/... Second oldest I found was Tenth Edition [Research] Unix (1989). See ocvt_n at https://www.tuhs.org/cgi-bin/utree.pl?file=V10/libc/stdio/vf... I couldn't find support i…

I'm pretty sure the compilers from Microsoft and Borland supported %n earlier than that. The earliest one I have easy access to that supports it is Microsoft C 4.0 from 1986.

Does anyone know why it was introduced in the first place? I mean.....the return value of printf gives you the exact same information, no? Why give printf the ability to write anything in the first place?

Re: Best of show – abuse of libc

#79

Post by josefx »

StavrosK wrote: post #74
npongratz wrote: post #17

Earlier quoted context omitted.

GNU's printf is Turing complete[0]... so "yes." [0] Mentioned (but not directly linked) by TFA: https://www.usenix.org/conference/usenixsecurity15/technical...

I've always wanted a Turing-complete printing function.

We already have post script for that.

Re: Best of show – abuse of libc

#80

Post by fulafel »

FartyMcFarter wrote: post #33
tomjakubowski wrote: post #12

Earlier quoted context omitted.

GNU's printf specifier language is Turing complete, I believe.

Presumably it needs a loop around it, so it's not Turing-complete by itself?

The implementation is accidentalyl turing-complete because you can exploit it to get arbitrary memory writes. But the language as specified is not Turing-complete.
Post reply on HN