Exploiting Golang Unsafe Pointers

There are situations when c interacts with golang for example in a library, and its possible to exploit a golang function writing raw memory using an unsafe.Pointer() parameter.

When golang receive a null terminated string on a *C.Char parameter, can be converted to golang s tring with  s2 := C.GoString(s1) we can do string operations with s2 safelly if the null byte is there.

When golang receives a pointer to a buffer on an unsafe.Pointer() and the length of the buffer on a C.int, if the length is not cheated can be converted to a []byte safelly with b := C.GoBytes(buf,sz)

Buuut what happens if golang receives a pointer to a buffer on an unsafe.Pointer() and is an OUT variable? the golang routine has to write on this pointer unsafelly for example we can create a golangs memcpy in the following way:

We convert to uintptr for indexing the pointer and then convert again to pointer casted to a byte pointer dereferenced and every byte is writed in this way.

If b is controlled, the memory can be written and the return pointer of main.main or whatever function can be modified.

https://play.golang.org/p/HppcVpLfuMf

The return addres can be pinpointed, for example 0x41 buffer 0x42 address:

We can reproduce it simulating the buffer from golang in this way:

we can dump the address of a function and redirect the execution to it:

https://play.golang.org/p/7htJHJp8gUJ

In this way it's possible to build a rop chain using golang runtime to unprotect a shellcode.

Related news

1. Pentest Tools Framework
2. Growth Hacker Tools
3. Hack Tools Download
4. What Are Hacking Tools
5. Hacker Hardware Tools
6. Hacker Security Tools
7. Hacking Tools For Mac
8. Hack Tools For Pc
9. Pentest Tools Framework
10. Pentest Tools Port Scanner
11. Hack Tools For Windows
12. Termux Hacking Tools 2019
13. Hack Tools
14. Pentest Tools Website Vulnerability
15. Pentest Tools Online
16. Pentest Automation Tools
17. Free Pentest Tools For Windows
18. Hacker Tools Hardware
19. Black Hat Hacker Tools
20. Pentest Tools Apk
21. Pentest Tools Nmap
22. Pentest Tools For Android
23. Hacking Tools Name
24. Physical Pentest Tools
25. Hacking Tools Hardware
26. Hacking Tools For Pc
27. Pentest Automation Tools
28. Hacking Tools Download
29. Hack Tool Apk No Root
30. What Are Hacking Tools
31. Pentest Recon Tools
32. Hacking Tools Github
33. Hack Tools For Mac
34. Hack Apps
35. Hak5 Tools
36. Hacker
37. Hacker Techniques Tools And Incident Handling
38. Hacking Tools For Windows 7
39. Underground Hacker Sites
40. Hacking Tools For Kali Linux
41. Pentest Tools Find Subdomains
42. Hack Tools For Mac
43. Hack Tools 2019
44. Pentest Tools Download
45. Physical Pentest Tools
46. Hack Website Online Tool
47. What Is Hacking Tools
48. Hack Tools Pc
49. Install Pentest Tools Ubuntu
50. Hacker Tools List
51. Bluetooth Hacking Tools Kali
52. Hack Rom Tools
53. How To Install Pentest Tools In Ubuntu
54. Hacking Tools Software
55. Beginner Hacker Tools
56. Pentest Automation Tools
57. Hacking Tools Pc
58. Install Pentest Tools Ubuntu
59. Pentest Tools Github
60. Hacker Tools Windows
61. Hacking Tools Software
62. Hacker Tools Software
63. Hacker Tools Free Download
64. Hacker Tools Free
65. Hacking Tools Download
66. Pentest Tools Tcp Port Scanner
67. Blackhat Hacker Tools
68. Hacks And Tools
69. Pentest Tools Alternative
70. Beginner Hacker Tools
71. Game Hacking
72. Hacking Tools 2020
73. Hacking Tools For Windows
74. Hack Website Online Tool
75. Hack Apps
76. Hack App
77. Hacker Tools For Mac
78. Nsa Hack Tools Download
79. Hacker Tools Online
80. Pentest Tools Online
81. Hacks And Tools
82. Hacker Tools For Pc