Transparency Myanmar

transparency.myanmar@gmail.com

Exploiting Golang Unsafe Pointers

Posted by Transparency Myanmar 2010
Tuesday, June 6, 2023


There are situations when c interacts with golang for example in a library, and its possible to exploit a golang function writing raw memory using an unsafe.Pointer() parameter.

When golang receive a null terminated string on a *C.Char parameter, can be converted to golang s tring with  s2 := C.GoString(s1) we can do string operations with s2 safelly if the null byte is there.

When golang receives a pointer to a buffer on an unsafe.Pointer() and the length of the buffer on a C.int, if the length is not cheated can be converted to a []byte safelly with b := C.GoBytes(buf,sz)

Buuut what happens if golang receives a pointer to a buffer on an unsafe.Pointer() and is an OUT variable? the golang routine has to write on this pointer unsafelly for example we can create a golangs memcpy in the following way:



We convert to uintptr for indexing the pointer and then convert again to pointer casted to a byte pointer dereferenced and every byte is writed in this way.

If b is controlled, the memory can be written and the return pointer of main.main or whatever function can be modified.

https://play.golang.org/p/HppcVpLfuMf


The return addres can be pinpointed, for example 0x41 buffer 0x42 address:



We can reproduce it simulating the buffer from golang in this way:


we can dump the address of a function and redirect the execution to it:


https://play.golang.org/p/7htJHJp8gUJ

In this way it's possible to build a rop chain using golang runtime to unprotect a shellcode.

Related news
  1. Hak5 Tools
  2. Hack Website Online Tool
  3. Hacking Tools Software
  4. Termux Hacking Tools 2019
  5. What Are Hacking Tools
  6. Computer Hacker
  7. How To Install Pentest Tools In Ubuntu
  8. Computer Hacker
  9. Pentest Automation Tools
  10. Pentest Tools For Android
  11. Hacking Tools Mac
  12. Hacker Security Tools
  13. Black Hat Hacker Tools
  14. Hacker Tools 2019
  15. Computer Hacker
  16. Hacker Tools Mac
  17. Hacker Tools Mac
  18. Hacker Tools Hardware
  19. Hack Website Online Tool
  20. Hacking Tools Windows 10
  21. Hacking Tools Kit
  22. Hack Tools Download
  23. Pentest Automation Tools
  24. Hacker Tool Kit
  25. Pentest Tools Kali Linux
  26. Hacking Tools 2019
  27. Hack Tools For Ubuntu
  28. Wifi Hacker Tools For Windows
  29. Hacking Tools 2020
  30. Hack Tools For Games
  31. Hack Tools For Windows
  32. Hack And Tools
  33. Nsa Hack Tools
  34. New Hacker Tools
  35. Pentest Tools For Android
  36. Hacker Tools Linux
  37. Ethical Hacker Tools
  38. Bluetooth Hacking Tools Kali
  39. Pentest Recon Tools
  40. Pentest Tools List
  41. Hacker Tools For Mac
  42. Pentest Tools Find Subdomains
  43. Termux Hacking Tools 2019
  44. Pentest Tools Alternative
  45. Pentest Tools Alternative
  46. Hacks And Tools
  47. Pentest Reporting Tools
  48. Hack Tools Online
  49. Game Hacking
  50. Hacker Hardware Tools
  51. Hack Tool Apk No Root
  52. Hack Tools
  53. Github Hacking Tools
  54. Hacker Tools For Mac
  55. Hack Tools For Ubuntu
  56. Hacking Apps
  57. Easy Hack Tools
  58. Nsa Hack Tools Download
  59. Hack Website Online Tool
  60. Best Hacking Tools 2019
  61. Hacker Tools Free Download
  62. Pentest Tools For Mac
  63. Pentest Tools Website Vulnerability
  64. Hacking Tools Software
  65. Hack Apps
  66. Nsa Hack Tools Download
  67. Hacker Tools For Mac
  68. Pentest Tools Tcp Port Scanner
  69. Hacker Tools For Pc
  70. Hacking Tools 2020
  71. Pentest Tools Apk
  72. Pentest Tools Website Vulnerability
  73. Hacking Tools Free Download
  74. Pentest Recon Tools
  75. Pentest Tools Windows
  76. Pentest Tools Online
  77. Hack Website Online Tool
  78. Pentest Box Tools Download
  79. Hack Tools For Games
  80. Hack Rom Tools
  81. Hacking Tools Free Download
  82. Pentest Tools Windows
  83. Hack Tools Download
  84. Hacking Tools For Windows Free Download
  85. Pentest Tools Linux
  86. Hacker Search Tools
  87. Pentest Recon Tools
  88. Hacking Tools Kit
  89. Hacker Tools List
  90. Best Pentesting Tools 2018
  91. Hack Tools For Windows
  92. Hacker Tools For Pc
  93. Hacking Apps
  94. Growth Hacker Tools
  95. Pentest Tools Free
  96. Hacking Tools Download
  97. Pentest Tools Framework
  98. Pentest Tools For Windows
  99. Hacker Tools Linux
  100. Pentest Tools Github
  101. Hack Tools Pc
  102. Hack Tool Apk
  103. Hacker Security Tools
  104. Pentest Tools For Windows
  105. Bluetooth Hacking Tools Kali
  106. Hack Tools Pc
  107. Github Hacking Tools
  108. Nsa Hack Tools
  109. Wifi Hacker Tools For Windows
  110. Hack Tool Apk
  111. Termux Hacking Tools 2019
  112. Hacker
  113. Hacking Tools For Beginners
  114. Pentest Tools Bluekeep
  115. Hack Tools
  116. Hacking Tools Windows 10
  117. Free Pentest Tools For Windows
  118. Hacker Tools Apk Download

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)