points by Someone 1 day ago | 0 comments
> What return path could possibly lead to a RCE?
API protocol says “return value is either “OK” or “ERR””, attacker sends “Floccinaucinihilipilification”, overflowing the 3-byte response buffer allocated on the stack.
[–] embedding-shape 1 day ago
[–] Someone 1 day ago
It’s harder nowadays, with address space layout randomization and no-execute stacks, but the basics are
- https://en.wikipedia.org/wiki/Stack_buffer_overflow#stack_sm...
- https://en.wikipedia.org/wiki/Return-oriented_programming
I think that’s how lots of RCE bugs start, so it may not be rocket science, but lots of software falls for it.
[–] embedding-shape 1 day ago
I'm sorry, but I still find it hard to believe you work with other professionals that when they implement telemetry in client applications, that usually ends up exposing a RCE on the client because of the telemetry implementation.
I'm claiming if "everything else" does indeed lead to a RCE, you're again doing something very wrong here. It's not rocket science exactly.