Integer Overflow

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Basic Information

Katika msingi wa integer overflow kuna kikomo kinachowekwa na ukubwa wa aina za data katika programu za kompyuta na ufafanuzi wa data.

Kwa mfano, 8-bit unsigned integer inaweza kuwakilisha thamani kutoka 0 hadi 255. Ikiwa unajaribu kuhifadhi thamani 256 katika 8-bit unsigned integer, inarudi nyuma hadi 0 kutokana na kikomo cha uwezo wake wa kuhifadhi. Vivyo hivyo, kwa 16-bit unsigned integer, ambayo inaweza kushikilia thamani kutoka 0 hadi 65,535, kuongeza 1 kwa 65,535 kutarudisha thamani hiyo hadi 0.

Zaidi ya hayo, 8-bit signed integer inaweza kuwakilisha thamani kutoka -128 hadi 127. Hii ni kwa sababu bit moja inatumika kuwakilisha ishara (chanya au hasi), ikiacha bit 7 kuwakilisha ukubwa. Nambari hasi zaidi inawakilishwa kama -128 (binary 10000000), na nambari chanya zaidi ni 127 (binary 01111111).

Max values

Kwa uwezekano wa web vulnerabilities ni ya kuvutia sana kujua thamani za juu zinazoungwa mkono:

Rust

fn main() {

let mut quantity = 2147483647;

let (mul_result, _) = i32::overflowing_mul(32767, quantity);
let (add_result, _) = i32::overflowing_add(1, quantity);

println!("{}", mul_result);
println!("{}", add_result);
}

C

#include <stdio.h>
#include <limits.h>

int main() {
int a = INT_MAX;
int b = 0;
int c = 0;

b = a * 100;
c = a + 1;

printf("%d\n", INT_MAX);
printf("%d\n", b);
printf("%d\n", c);
return 0;
}

Mifano

Overflow safi

Matokeo yaliyochapishwa yatakuwa 0 kwani tumepita mipaka ya char:

#include <stdio.h>

int main() {
unsigned char max = 255; // 8-bit unsigned integer
unsigned char result = max + 1;
printf("Result: %d\n", result); // Expected to overflow
return 0;
}

Signed to Unsigned Conversion

Fikiria hali ambapo nambari iliyo na ishara inasomwa kutoka kwa ingizo la mtumiaji na kisha kutumika katika muktadha ambao unait treating kama nambari isiyo na ishara, bila uthibitisho sahihi:

#include <stdio.h>

int main() {
int userInput; // Signed integer
printf("Enter a number: ");
scanf("%d", &userInput);

// Treating the signed input as unsigned without validation
unsigned int processedInput = (unsigned int)userInput;

// A condition that might not work as intended if userInput is negative
if (processedInput > 1000) {
printf("Processed Input is large: %u\n", processedInput);
} else {
printf("Processed Input is within range: %u\n", processedInput);
}

return 0;
}

Katika mfano huu, ikiwa mtumiaji anaingiza nambari hasi, itatafsiriwa kama nambari kubwa isiyo na alama kutokana na jinsi thamani za binary zinavyotafsiriwa, ambayo inaweza kusababisha tabia isiyotarajiwa.

Mifano Mingine

• https://guyinatuxedo.github.io/35-integer_exploitation/int_overflow_post/index.html

• Ni 1B pekee inayotumika kuhifadhi ukubwa wa nenosiri hivyo inawezekana kuijaza na kuifanya ifikirie kuwa urefu wake ni 4 wakati kwa kweli ni 260 ili kupita ulinzi wa ukaguzi wa urefu

• https://guyinatuxedo.github.io/35-integer_exploitation/puzzle/index.html

• Kutolewa kwa nambari kadhaa pata kutumia z3 nambari mpya ambayo ikizidishwa na ya kwanza itatoa ya pili:

(((argv[1] * 0x1064deadbeef4601) & 0xffffffffffffffff) == 0xD1038D2E07B42569)

• https://8ksec.io/arm64-reversing-and-exploitation-part-8-exploiting-an-integer-overflow-vulnerability/

• Ni 1B pekee inayotumika kuhifadhi ukubwa wa nenosiri hivyo inawezekana kuijaza na kuifanya ifikirie kuwa urefu wake ni 4 wakati kwa kweli ni 260 ili kupita ulinzi wa ukaguzi wa urefu na kuandika kwenye stack kiambatisho kinachofuata cha ndani na kupita ulinzi wote

ARM64

Hii haiwezi kubadilika katika ARM64 kama unavyoona katika hiki chapisho la blog.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.