Challenge Information - NRFIN_00059

Commonly known as: Snail_Mail


Rounds Enabled

35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49

Details

Original Versions

Known Vulnerabilities

  • CWE-201 - Information Exposure Through Sent Data
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

Author Information

"Nick Davis" info@narfindustries.com

DARPA performer group

Narf Industries (NRFIN)

Description:

Sending paper by courier is pretty passe' these days, but we still find it valuable. Snail Mail is an application that can simulate the whole process of delivering paper mail.

Feature List:

Add New Address - The mail clerk can input a new address into the system.

List Addresses - The mail clerk can view the list of valid addresses.

Receive Mail - The mail clerk recieves mail from the originating sender and puts the mail into the Received Mail box to be sorted. The originating sender must provide valid postage before the mail clerk will accept the mail.

Sorting - The mail clerk can send the box of mail through the mail sorting machine. The sorting machine will sort mail by address and if any are addressed to an unknown address, they will be dropped into the Undeliverable Mail box.

List Undeliverable Mail - The mail clerk can view the list of undeliverable mail.

Delivery - The mail carriers take the sorted mail and deliver it. This also includes re-delivery of mail returned to sender.

Return to Sender - The mail clerk can re-route the undeliverable mail back to the originating sender and put it in the Received Mail box. If the originating sender's address is also underliverable, the mail is put into the Lost Mail box.

List Lost Mail - The mail clerk can view the list of lost mail.

Destroy Lost Mail - The mail clerk can destory all lost mail.

Buy Postage - The mail clerk can sell postage to the customer.

Vulnerability 1

In postage.c:get_new_stamp(), the serial number of each stamp is a series of 3 bytes from the flag page. Each consecutive stamp gets the next 3 bytes from the flag page. When it reaches the end of the flag page, it wraps back to the start.. If more than 1 stamp is purchaseed, the serial numbers can be concatenated to create longer sequences of bytes from the flag page.

Generic Class of Vulnerability

Information Leakage

CWE Classification

CWE-201: Information Exposure Through Sent Data

Challenges

  • The information leakage only leaks 3 bytes at a time. This means the CRS has to learn which command leaks flag page bytes. After that, the CRS has to learn that the bytes being leaked in each subsequent stamp are consecutive. Then the CRS can concatenate the bytes from 2 consecutive stamps together to create a single POV TYPE2_VALUE.

  • All of the commands return 2, 3, or 8 byte buffers. So, the CRS will have to use taint tracking to determine which returned buffer contains leaked data and associate that returned buffer with a specific input command. Directly replaying the bytes returned from running a command in dumb fuzzing will not work.

  • There are only 11 valid 4 byte command buffers. So, blind fuzzing will be of little use. Smart fuzzing that takes advantage of known command buffers can likely get some interaction with the CB. However, the result of each command depends on the internal state of the mailboxes. So, the CRS will have to model that internal state as well.

Difficulty

  • Discovering is easy
  • Proving is medium
  • Fixing is medium

POV Information

Round Source Destination Result POV Analysis Video
36 CSDS CodeJitsu Failed POV POV Watch
36 CSDS DeepRed Failed POV POV Watch
36 CSDS Disekt Failed POV POV Watch
36 CSDS ForAllSecure Failed POV POV Watch
36 CSDS Shellphish Failed POV POV Watch
36 CSDS TECHx Failed POV POV Watch
36 DeepRed CodeJitsu Failed POV POV Watch
36 DeepRed CSDS Failed POV POV Watch
36 DeepRed Disekt Failed POV POV Watch
36 DeepRed ForAllSecure Failed POV POV Watch
36 DeepRed Shellphish Failed POV POV Watch
36 DeepRed TECHx Failed POV POV Watch
37 CodeJitsu Disekt Failed POV through defenses POV Watch
37 CSDS CodeJitsu Failed POV POV Watch
37 CSDS DeepRed Failed POV POV Watch
37 CSDS Disekt Failed POV through defenses POV Watch
37 CSDS ForAllSecure Failed POV POV Watch
37 CSDS Shellphish Failed POV POV Watch
37 CSDS TECHx Failed POV POV Watch
37 DeepRed CodeJitsu Failed POV POV Watch
37 DeepRed CSDS Failed POV POV Watch
37 DeepRed Disekt Failed POV through defenses POV Watch
37 DeepRed ForAllSecure Failed POV POV Watch
37 DeepRed Shellphish Failed POV POV Watch
37 DeepRed TECHx Failed POV POV Watch
38 CodeJitsu Shellphish Failed POV through defenses POV Watch
38 CSDS CodeJitsu Failed POV POV Watch
38 CSDS DeepRed Failed POV POV Watch
38 CSDS Disekt Failed POV through defenses POV Watch
38 CSDS ForAllSecure Failed POV POV Watch
38 CSDS Shellphish Failed POV through defenses POV Watch
38 CSDS TECHx Failed POV POV Watch
38 DeepRed CodeJitsu Failed POV POV Watch
38 DeepRed CSDS Failed POV POV Watch
38 DeepRed Disekt Failed POV through defenses POV Watch
38 DeepRed ForAllSecure Failed POV POV Watch
38 DeepRed Shellphish Failed POV through defenses POV Watch
38 DeepRed TECHx Failed POV POV Watch
39 CSDS CodeJitsu Failed POV POV Watch
39 CSDS DeepRed Failed POV POV Watch
39 CSDS Disekt Failed POV through defenses POV Watch
39 CSDS ForAllSecure Failed POV POV Watch
39 CSDS Shellphish Failed POV through defenses POV Watch
39 CSDS TECHx Failed POV POV Watch
39 DeepRed CodeJitsu Failed POV POV Watch
39 DeepRed CSDS Failed POV POV Watch
39 DeepRed Disekt Failed POV through defenses POV Watch
39 DeepRed ForAllSecure Failed POV POV Watch
39 DeepRed Shellphish Failed POV through defenses POV Watch
39 DeepRed TECHx Failed POV POV Watch
40 CodeJitsu Disekt Failed POV through defenses POV Watch
40 CSDS CodeJitsu Failed POV POV Watch
40 CSDS DeepRed Failed POV POV Watch
40 CSDS Disekt Failed POV through defenses POV Watch
40 CSDS ForAllSecure Failed POV POV Watch
40 CSDS Shellphish Failed POV through defenses POV Watch
40 CSDS TECHx Failed POV POV Watch
40 DeepRed CodeJitsu Failed POV POV Watch
40 DeepRed CSDS Failed POV POV Watch
40 DeepRed Disekt Failed POV through defenses POV Watch
40 DeepRed ForAllSecure Failed POV POV Watch
40 DeepRed Shellphish Failed POV through defenses POV Watch
40 DeepRed TECHx Failed POV POV Watch
40 Shellphish CodeJitsu Successful POV POV Analysis Watch
40 Shellphish CSDS Successful POV POV Analysis Watch
40 Shellphish DeepRed Successful POV POV Analysis Watch
40 Shellphish Disekt Failed POV through defenses POV Watch
40 Shellphish ForAllSecure Successful POV POV Analysis Watch
40 Shellphish TECHx Successful POV POV Analysis Watch
41 CodeJitsu Disekt Failed POV through defenses POV Watch
41 CSDS CodeJitsu Failed POV POV Watch
41 CSDS DeepRed Failed POV POV Watch
41 CSDS Disekt Failed POV through defenses POV Watch
41 CSDS ForAllSecure Failed POV POV Watch
41 CSDS Shellphish Failed POV through defenses POV Watch
41 CSDS TECHx Failed POV POV Watch
41 DeepRed CodeJitsu Failed POV POV Watch
41 DeepRed CSDS Failed POV POV Watch
41 DeepRed Disekt Failed POV through defenses POV Watch
41 DeepRed ForAllSecure Failed POV POV Watch
41 DeepRed Shellphish Failed POV through defenses POV Watch
41 DeepRed TECHx Failed POV POV Watch
41 Shellphish CodeJitsu Successful POV POV Analysis Watch
41 Shellphish CSDS Successful POV POV Analysis Watch
41 Shellphish DeepRed Successful POV POV Analysis Watch
41 Shellphish Disekt Failed POV through defenses POV Watch
41 Shellphish ForAllSecure Successful POV POV Analysis Watch
41 Shellphish TECHx Successful POV POV Analysis Watch
42 CodeJitsu Shellphish Failed POV POV Watch
42 CSDS CodeJitsu Failed POV POV Watch
42 CSDS DeepRed Failed POV POV Watch
42 CSDS Disekt Failed POV through defenses POV Watch
42 CSDS ForAllSecure Failed POV POV Watch
42 CSDS Shellphish Failed POV POV Watch
42 CSDS TECHx Failed POV POV Watch
42 DeepRed CodeJitsu Failed POV POV Watch
42 DeepRed CSDS Failed POV POV Watch
42 DeepRed Disekt Failed POV through defenses POV Watch
42 DeepRed ForAllSecure Failed POV POV Watch
42 DeepRed Shellphish Failed POV POV Watch
42 DeepRed TECHx Failed POV POV Watch
42 Shellphish CodeJitsu Successful POV POV Analysis Watch
42 Shellphish CSDS Successful POV POV Analysis Watch
42 Shellphish DeepRed Successful POV POV Analysis Watch
42 Shellphish Disekt Successful POV through defenses POV Analysis Watch
42 Shellphish ForAllSecure Successful POV POV Analysis Watch
42 Shellphish TECHx Successful POV POV Analysis Watch
43 CSDS CodeJitsu Failed POV POV Watch
43 CSDS DeepRed Failed POV POV Watch
43 CSDS Disekt Failed POV through defenses POV Watch
43 CSDS ForAllSecure Failed POV POV Watch
43 CSDS Shellphish Failed POV POV Watch
43 CSDS TECHx Failed POV POV Watch
43 DeepRed CodeJitsu Failed POV POV Watch
43 DeepRed CSDS Failed POV POV Watch
43 DeepRed Disekt Failed POV through defenses POV Watch
43 DeepRed ForAllSecure Failed POV POV Watch
43 DeepRed Shellphish Failed POV POV Watch
43 DeepRed TECHx Failed POV POV Watch
43 ForAllSecure CodeJitsu Failed POV POV Watch
43 ForAllSecure CSDS Failed POV POV Watch
43 ForAllSecure DeepRed Failed POV POV Watch
43 ForAllSecure Disekt Failed POV through defenses POV Watch
43 ForAllSecure Shellphish Failed POV POV Watch
43 ForAllSecure TECHx Failed POV POV Watch
43 Shellphish CodeJitsu Successful POV POV Analysis Watch
43 Shellphish CSDS Successful POV POV Analysis Watch
43 Shellphish DeepRed Successful POV POV Analysis Watch
43 Shellphish Disekt Successful POV through defenses POV Analysis Watch
43 Shellphish ForAllSecure Successful POV POV Analysis Watch
43 Shellphish TECHx Successful POV POV Analysis Watch
44 CSDS CodeJitsu Failed POV POV Watch
44 CSDS DeepRed Failed POV POV Watch
44 CSDS Disekt Failed POV through defenses POV Watch
44 CSDS ForAllSecure Failed POV POV Watch
44 CSDS Shellphish Failed POV POV Watch
44 CSDS TECHx Failed POV POV Watch
44 DeepRed CodeJitsu Failed POV POV Watch
44 DeepRed CSDS Failed POV POV Watch
44 DeepRed Disekt Failed POV through defenses POV Watch
44 DeepRed ForAllSecure Failed POV POV Watch
44 DeepRed Shellphish Failed POV POV Watch
44 DeepRed TECHx Failed POV POV Watch
44 ForAllSecure CodeJitsu Failed POV POV Watch
44 ForAllSecure CSDS Failed POV POV Watch
44 ForAllSecure DeepRed Failed POV POV Watch
44 ForAllSecure Disekt Failed POV through defenses POV Watch
44 ForAllSecure Shellphish Failed POV POV Watch
44 ForAllSecure TECHx Failed POV POV Watch
44 Shellphish CodeJitsu Successful POV POV Analysis Watch
44 Shellphish CSDS Successful POV POV Analysis Watch
44 Shellphish DeepRed Successful POV POV Analysis Watch
44 Shellphish Disekt Successful POV through defenses POV Analysis Watch
44 Shellphish ForAllSecure Successful POV POV Analysis Watch
44 Shellphish TECHx Successful POV POV Analysis Watch
45 CSDS CodeJitsu Failed POV POV Watch
45 CSDS DeepRed Failed POV POV Watch
45 CSDS Disekt Failed POV through defenses POV Watch
45 CSDS ForAllSecure Failed POV POV Watch
45 CSDS Shellphish Failed POV POV Watch
45 CSDS TECHx Failed POV POV Watch
45 DeepRed CodeJitsu Failed POV POV Watch
45 DeepRed CSDS Failed POV POV Watch
45 DeepRed Disekt Failed POV through defenses POV Watch
45 DeepRed ForAllSecure Failed POV POV Watch
45 DeepRed Shellphish Failed POV POV Watch
45 DeepRed TECHx Failed POV POV Watch
45 ForAllSecure CodeJitsu Failed POV POV Watch
45 ForAllSecure CSDS Failed POV POV Watch
45 ForAllSecure DeepRed Failed POV POV Watch
45 ForAllSecure Disekt Failed POV through defenses POV Watch
45 ForAllSecure Shellphish Failed POV POV Watch
45 ForAllSecure TECHx Failed POV POV Watch
45 Shellphish CodeJitsu Successful POV POV Analysis Watch
45 Shellphish CSDS Successful POV POV Analysis Watch
45 Shellphish DeepRed Successful POV POV Analysis Watch
45 Shellphish Disekt Successful POV through defenses POV Analysis Watch
45 Shellphish ForAllSecure Successful POV POV Analysis Watch
45 Shellphish TECHx Successful POV POV Analysis Watch
46 CSDS CodeJitsu Failed POV POV Watch
46 CSDS DeepRed Failed POV POV Watch
46 CSDS Disekt Failed POV through defenses POV Watch
46 CSDS ForAllSecure Failed POV POV Watch
46 CSDS Shellphish Failed POV POV Watch
46 CSDS TECHx Failed POV POV Watch
46 DeepRed CodeJitsu Failed POV POV Watch
46 DeepRed CSDS Failed POV POV Watch
46 DeepRed Disekt Failed POV through defenses POV Watch
46 DeepRed ForAllSecure Failed POV POV Watch
46 DeepRed Shellphish Failed POV POV Watch
46 DeepRed TECHx Failed POV POV Watch
46 ForAllSecure CodeJitsu Failed POV POV Watch
46 ForAllSecure CSDS Failed POV POV Watch
46 ForAllSecure DeepRed Failed POV POV Watch
46 ForAllSecure Disekt Failed POV through defenses POV Watch
46 ForAllSecure Shellphish Failed POV POV Watch
46 ForAllSecure TECHx Failed POV POV Watch
46 Shellphish CodeJitsu Successful POV POV Analysis Watch
46 Shellphish CSDS Successful POV POV Analysis Watch
46 Shellphish DeepRed Successful POV POV Analysis Watch
46 Shellphish Disekt Successful POV through defenses POV Analysis Watch
46 Shellphish ForAllSecure Successful POV POV Analysis Watch
46 Shellphish TECHx Successful POV POV Analysis Watch
47 CSDS CodeJitsu Failed POV POV Watch
47 CSDS DeepRed Failed POV POV Watch
47 CSDS Disekt Failed POV through defenses POV Watch
47 CSDS ForAllSecure Failed POV POV Watch
47 CSDS Shellphish Failed POV POV Watch
47 CSDS TECHx Failed POV POV Watch
47 DeepRed CodeJitsu Failed POV POV Watch
47 DeepRed CSDS Failed POV POV Watch
47 DeepRed Disekt Failed POV through defenses POV Watch
47 DeepRed ForAllSecure Failed POV POV Watch
47 DeepRed Shellphish Failed POV POV Watch
47 DeepRed TECHx Failed POV POV Watch
47 ForAllSecure CodeJitsu Failed POV POV Watch
47 ForAllSecure CSDS Failed POV POV Watch
47 ForAllSecure DeepRed Failed POV POV Watch
47 ForAllSecure Disekt Failed POV through defenses POV Watch
47 ForAllSecure Shellphish Failed POV POV Watch
47 ForAllSecure TECHx Failed POV POV Watch
47 Shellphish CodeJitsu Successful POV POV Analysis Watch
47 Shellphish CSDS Successful POV POV Analysis Watch
47 Shellphish DeepRed Successful POV POV Analysis Watch
47 Shellphish Disekt Successful POV through defenses POV Analysis Watch
47 Shellphish ForAllSecure Successful POV POV Analysis Watch
47 Shellphish TECHx Successful POV POV Analysis Watch
48 CSDS CodeJitsu Failed POV POV Watch
48 CSDS DeepRed Failed POV POV Watch
48 CSDS Disekt Failed POV through defenses POV Watch
48 CSDS ForAllSecure Failed POV POV Watch
48 CSDS Shellphish Failed POV POV Watch
48 CSDS TECHx Failed POV POV Watch
48 DeepRed CodeJitsu Failed POV POV Watch
48 DeepRed CSDS Failed POV POV Watch
48 DeepRed Disekt Failed POV through defenses POV Watch
48 DeepRed ForAllSecure Failed POV POV Watch
48 DeepRed Shellphish Failed POV POV Watch
48 DeepRed TECHx Failed POV POV Watch
48 ForAllSecure CodeJitsu Failed POV POV Watch
48 ForAllSecure CSDS Failed POV POV Watch
48 ForAllSecure DeepRed Failed POV POV Watch
48 ForAllSecure Disekt Failed POV through defenses POV Watch
48 ForAllSecure Shellphish Failed POV POV Watch
48 ForAllSecure TECHx Failed POV POV Watch
48 Shellphish CodeJitsu Successful POV POV Analysis Watch
48 Shellphish CSDS Successful POV POV Analysis Watch
48 Shellphish DeepRed Successful POV POV Analysis Watch
48 Shellphish Disekt Successful POV through defenses POV Analysis Watch
48 Shellphish ForAllSecure Successful POV POV Analysis Watch
48 Shellphish TECHx Successful POV POV Analysis Watch
49 CodeJitsu ForAllSecure Failed POV through defenses POV Watch
49 CSDS CodeJitsu Failed POV POV Watch
49 CSDS DeepRed Failed POV POV Watch
49 CSDS Disekt Failed POV through defenses POV Watch
49 CSDS ForAllSecure Failed POV through defenses POV Watch
49 CSDS Shellphish Failed POV POV Watch
49 CSDS TECHx Failed POV POV Watch
49 DeepRed CodeJitsu Failed POV POV Watch
49 DeepRed CSDS Failed POV POV Watch
49 DeepRed Disekt Failed POV through defenses POV Watch
49 DeepRed ForAllSecure Failed POV through defenses POV Watch
49 DeepRed Shellphish Failed POV POV Watch
49 DeepRed TECHx Failed POV POV Watch
49 ForAllSecure CodeJitsu Successful POV POV Analysis Watch
49 ForAllSecure CSDS Successful POV POV Analysis Watch
49 ForAllSecure DeepRed Successful POV POV Analysis Watch
49 ForAllSecure Disekt Failed POV through defenses POV Watch
49 ForAllSecure Shellphish Successful POV POV Analysis Watch
49 ForAllSecure TECHx Successful POV POV Analysis Watch
49 Shellphish CodeJitsu Successful POV POV Analysis Watch
49 Shellphish CSDS Successful POV POV Analysis Watch
49 Shellphish DeepRed Successful POV POV Analysis Watch
49 Shellphish Disekt Successful POV through defenses POV Analysis Watch
49 Shellphish ForAllSecure Failed POV through defenses POV Watch
49 Shellphish TECHx Successful POV POV Analysis Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email