Challenge Information - KPRCA_00100

Commonly known as: Finicky_File_Folder

Rounds Enabled

55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69

Details

Original Versions

Known Vulnerabilities

  • CWE-416 - Use After Free
  • CWE-825 - Expired Pointer Dereference
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

DARPA performer group

Kaprica Security (KPRCA)

Description

A interface for storing files in a tree-like structure.

Feature List

This service exposes an API for storing files. The API features the following fantastic functions.

  • create - Add a file to the tree. Path components are separated by the '/' character
  • unlink - Remove a file from the tree.
  • read - Read from a file handle.
  • lseek - Set the offset for a file handle.
  • close - Remove a file handle.
  • open - Create a file handle for the file at a specific path.
  • write - Write to a file handle.

Vulnerability

Vuln 1

When an user asks to open a file via the API, the API hands them back a number that corresponds to a FileHandle. Ideally, a File can only be deleted if there are no more FileHandles referencing it. However, in this service it is possible to delete a file while 1 FileHandle still references it. This results in that singular FileHandle containing a dangling pointer to an area of memory that has been freed. Through the correct allocation patterns, it is possible for a user to then gain full write access to this region of memory. This, combined with the fact that the File object is a C++ class with virtual functions, allows for the user gain EIP control resulting in a type 1 vulnerability.

Generic class of vulnerability

Heap Corruption

CWE classification

  • CWE-416: Use After Free
  • CWE-825: Expired Pointer Dereference

Challenges

  • The interaction with the service that results in a dangling pointer via the FileHandle, while short, is somewhat nuanced. So whatever reasoning strategies a CRS is utilizing will need to be moderately intelligent.

  • Furthermore, the allocation pattern that allows for easy writing to the region of memory referenced by dangling pointer is also non-trivial to derive. That is, many other interactions with the API will result in the dangling pointer pointing to region of memory that the CRS cannot easily control.

Difficulty

  • Discovery: medium
  • Proving: hard
  • Patching: easy

POV Information

Round Source Destination Result POV Analysis Video
56 CSDS CodeJitsu Failed POV POV Watch
56 CSDS DeepRed Failed POV POV Watch
56 CSDS Disekt Failed POV POV Watch
56 CSDS ForAllSecure Failed POV POV Watch
56 CSDS Shellphish Failed POV POV Watch
56 CSDS TECHx Failed POV POV Watch
56 DeepRed CodeJitsu Failed POV POV Watch
56 DeepRed CSDS Failed POV POV Watch
56 DeepRed Disekt Failed POV POV Watch
56 DeepRed ForAllSecure Failed POV POV Watch
56 DeepRed Shellphish Failed POV POV Watch
56 DeepRed TECHx Failed POV POV Watch
57 CodeJitsu Disekt Failed POV through defenses POV Watch
57 CSDS CodeJitsu Failed POV through defenses POV Watch
57 CSDS DeepRed Failed POV POV Watch
57 CSDS Disekt Failed POV through defenses POV Watch
57 CSDS ForAllSecure Failed POV POV Watch
57 CSDS Shellphish Failed POV POV Watch
57 DeepRed CodeJitsu Failed POV through defenses POV Watch
57 DeepRed CSDS Failed POV POV Watch
57 DeepRed Disekt Failed POV through defenses POV Watch
57 DeepRed ForAllSecure Failed POV POV Watch
57 DeepRed Shellphish Failed POV POV Watch
58 CodeJitsu Shellphish Failed POV through defenses POV Watch
58 CSDS CodeJitsu Failed POV through defenses POV Watch
58 CSDS DeepRed Failed POV POV Watch
58 CSDS Disekt Failed POV through defenses POV Watch
58 CSDS ForAllSecure Failed POV POV Watch
58 CSDS Shellphish Failed POV through defenses POV Watch
58 CSDS TECHx Failed POV through defenses POV Watch
58 DeepRed CodeJitsu Failed POV through defenses POV Watch
58 DeepRed CSDS Failed POV POV Watch
58 DeepRed Disekt Failed POV through defenses POV Watch
58 DeepRed ForAllSecure Failed POV POV Watch
58 DeepRed Shellphish Failed POV through defenses POV Watch
58 DeepRed TECHx Failed POV through defenses POV Watch
59 CSDS CodeJitsu Failed POV through defenses POV Watch
59 CSDS DeepRed Failed POV POV Watch
59 CSDS Disekt Failed POV through defenses POV Watch
59 CSDS ForAllSecure Failed POV POV Watch
59 CSDS Shellphish Failed POV through defenses POV Watch
59 CSDS TECHx Failed POV through defenses POV Watch
59 DeepRed CodeJitsu Failed POV through defenses POV Watch
59 DeepRed CSDS Failed POV POV Watch
59 DeepRed Disekt Failed POV through defenses POV Watch
59 DeepRed ForAllSecure Failed POV POV Watch
59 DeepRed Shellphish Failed POV through defenses POV Watch
59 DeepRed TECHx Failed POV through defenses POV Watch
60 CodeJitsu TECHx Failed POV through defenses POV Watch
60 CSDS CodeJitsu Failed POV through defenses POV Watch
60 CSDS DeepRed Failed POV POV Watch
60 CSDS Disekt Failed POV through defenses POV Watch
60 CSDS ForAllSecure Failed POV POV Watch
60 CSDS Shellphish Failed POV through defenses POV Watch
60 CSDS TECHx Failed POV through defenses POV Watch
60 DeepRed CodeJitsu Failed POV through defenses POV Watch
60 DeepRed CSDS Failed POV POV Watch
60 DeepRed Disekt Failed POV through defenses POV Watch
60 DeepRed ForAllSecure Failed POV POV Watch
60 DeepRed Shellphish Failed POV through defenses POV Watch
60 DeepRed TECHx Failed POV through defenses POV Watch
61 CodeJitsu Shellphish Failed POV POV Watch
61 CSDS CodeJitsu Failed POV through defenses POV Watch
61 CSDS DeepRed Failed POV POV Watch
61 CSDS Disekt Failed POV through defenses POV Watch
61 CSDS ForAllSecure Failed POV POV Watch
61 CSDS Shellphish Failed POV POV Watch
61 CSDS TECHx Failed POV through defenses POV Watch
61 DeepRed CodeJitsu Failed POV through defenses POV Watch
61 DeepRed CSDS Failed POV POV Watch
61 DeepRed Disekt Failed POV through defenses POV Watch
61 DeepRed ForAllSecure Failed POV POV Watch
61 DeepRed Shellphish Failed POV POV Watch
61 DeepRed TECHx Failed POV through defenses POV Watch
62 CSDS CodeJitsu Failed POV through defenses POV Watch
62 CSDS DeepRed Failed POV POV Watch
62 CSDS Disekt Failed POV through defenses POV Watch
62 CSDS ForAllSecure Failed POV POV Watch
62 CSDS Shellphish Failed POV POV Watch
62 CSDS TECHx Failed POV through defenses POV Watch
62 DeepRed CodeJitsu Failed POV through defenses POV Watch
62 DeepRed CSDS Failed POV POV Watch
62 DeepRed Disekt Failed POV through defenses POV Watch
62 DeepRed ForAllSecure Failed POV POV Watch
62 DeepRed Shellphish Failed POV POV Watch
62 DeepRed TECHx Failed POV through defenses POV Watch
63 CSDS CodeJitsu Failed POV through defenses POV Watch
63 CSDS DeepRed Failed POV POV Watch
63 CSDS Disekt Failed POV through defenses POV Watch
63 CSDS ForAllSecure Failed POV POV Watch
63 CSDS Shellphish Failed POV POV Watch
63 CSDS TECHx Failed POV through defenses POV Watch
63 DeepRed CodeJitsu Failed POV through defenses POV Watch
63 DeepRed CSDS Failed POV POV Watch
63 DeepRed Disekt Failed POV through defenses POV Watch
63 DeepRed ForAllSecure Failed POV POV Watch
63 DeepRed Shellphish Failed POV POV Watch
63 DeepRed TECHx Failed POV through defenses POV Watch
64 CSDS CodeJitsu Failed POV through defenses POV Watch
64 CSDS DeepRed Failed POV POV Watch
64 CSDS Disekt Failed POV through defenses POV Watch
64 CSDS ForAllSecure Failed POV POV Watch
64 CSDS Shellphish Failed POV POV Watch
64 CSDS TECHx Failed POV through defenses POV Watch
64 DeepRed CodeJitsu Failed POV through defenses POV Watch
64 DeepRed CSDS Failed POV POV Watch
64 DeepRed Disekt Failed POV through defenses POV Watch
64 DeepRed ForAllSecure Failed POV POV Watch
64 DeepRed Shellphish Failed POV POV Watch
64 DeepRed TECHx Failed POV through defenses POV Watch
65 CSDS CodeJitsu Failed POV through defenses POV Watch
65 CSDS DeepRed Failed POV POV Watch
65 CSDS Disekt Failed POV through defenses POV Watch
65 CSDS ForAllSecure Failed POV POV Watch
65 CSDS Shellphish Failed POV POV Watch
65 CSDS TECHx Failed POV through defenses POV Watch
65 DeepRed CodeJitsu Failed POV through defenses POV Watch
65 DeepRed CSDS Failed POV POV Watch
65 DeepRed Disekt Failed POV through defenses POV Watch
65 DeepRed ForAllSecure Failed POV POV Watch
65 DeepRed Shellphish Failed POV POV Watch
65 DeepRed TECHx Failed POV through defenses POV Watch
66 CSDS CodeJitsu Failed POV through defenses POV Watch
66 CSDS DeepRed Failed POV POV Watch
66 CSDS Disekt Failed POV through defenses POV Watch
66 CSDS ForAllSecure Failed POV POV Watch
66 CSDS Shellphish Failed POV POV Watch
66 CSDS TECHx Failed POV through defenses POV Watch
66 DeepRed CodeJitsu Failed POV through defenses POV Watch
66 DeepRed CSDS Failed POV POV Watch
66 DeepRed Disekt Failed POV through defenses POV Watch
66 DeepRed ForAllSecure Failed POV POV Watch
66 DeepRed Shellphish Failed POV POV Watch
66 DeepRed TECHx Failed POV through defenses POV Watch
67 CSDS CodeJitsu Failed POV through defenses POV Watch
67 CSDS DeepRed Failed POV POV Watch
67 CSDS Disekt Failed POV through defenses POV Watch
67 CSDS ForAllSecure Failed POV POV Watch
67 CSDS Shellphish Failed POV POV Watch
67 CSDS TECHx Failed POV through defenses POV Watch
67 DeepRed CodeJitsu Failed POV through defenses POV Watch
67 DeepRed CSDS Failed POV POV Watch
67 DeepRed Disekt Failed POV through defenses POV Watch
67 DeepRed ForAllSecure Failed POV POV Watch
67 DeepRed Shellphish Failed POV POV Watch
67 DeepRed TECHx Failed POV through defenses POV Watch
68 CSDS CodeJitsu Failed POV through defenses POV Watch
68 CSDS DeepRed Failed POV POV Watch
68 CSDS Disekt Failed POV through defenses POV Watch
68 CSDS ForAllSecure Failed POV POV Watch
68 CSDS Shellphish Failed POV POV Watch
68 CSDS TECHx Failed POV through defenses POV Watch
68 DeepRed CodeJitsu Failed POV through defenses POV Watch
68 DeepRed CSDS Failed POV POV Watch
68 DeepRed Disekt Failed POV through defenses POV Watch
68 DeepRed ForAllSecure Failed POV POV Watch
68 DeepRed Shellphish Failed POV POV Watch
68 DeepRed TECHx Failed POV through defenses POV Watch
69 CSDS CodeJitsu Failed POV through defenses POV Watch
69 CSDS DeepRed Failed POV POV Watch
69 CSDS Disekt Failed POV through defenses POV Watch
69 CSDS ForAllSecure Failed POV POV Watch
69 CSDS Shellphish Failed POV POV Watch
69 CSDS TECHx Failed POV through defenses POV Watch
69 DeepRed CodeJitsu Failed POV through defenses POV Watch
69 DeepRed CSDS Failed POV POV Watch
69 DeepRed Disekt Failed POV through defenses POV Watch
69 DeepRed ForAllSecure Failed POV POV Watch
69 DeepRed Shellphish Failed POV POV Watch
69 DeepRed TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email