|
1 | 1 | # tiny webserver rce exploit
|
2 | 2 |
|
3 |
| -This repository includes a simplified fork of the tiny http webserver |
4 |
| -https://github.com/shenfeng/tiny-web-server |
5 |
| -known to have a buffer overflow. |
| 3 | +This is a collection of exploits for a simplified fork of the tiny http webserver https://github.com/shenfeng/tiny-web-server , known to have a buffer overflow. |
| 4 | + |
| 5 | +The goal is to showcase the evolution of memory safety mitigations and exploitation techniques over the years, |
| 6 | +in a semi-realistic environment. |
6 | 7 |
|
7 | 8 | The webserver has been compiled four times, with increasing levels of memory protections.
|
8 |
| -For every version, an exploit that defeats the mitigations and launches a remote shell has been written. |
| 9 | +For every version, I've written an exploit that defeats the mitigations and launches a remote shell: |
9 | 10 |
|
10 | 11 | - [tiny.1996](https://github.com/robalb/tiny-webserver-rce-exploit/blob/master/expl_1996.py) : no protections. Compiled statically, with an executable stack and no canaries like it's 1996
|
11 | 12 | - tiny.canary: executable stack, but with stack canaries enabled
|
12 | 13 | - tiny.nx: both canary and nx protection active
|
13 | 14 | - tiny.all: all protections active: canary, nx, ASLR, relro
|
14 | 15 |
|
15 | 16 | All these binaries have Indirect Branch Tracking enabled, but are expected to run on
|
16 |
| -an intel cpu preceding the ~2020 Tiger Lake line, wich is the first one supporting this security feature |
| 17 | +an intel cpu preceding the ~2020 Tiger Lake line, where this security feature is not yet supported |
17 | 18 |
|
18 | 19 | ## rationale
|
19 | 20 |
|
20 |
| -This projects aims at showcasing the evolution of memory safety mitigations and exploitation techniques over the years, |
21 |
| -in a semi-realistic environment |
22 |
| - |
23 | 21 | There is a treasure trove of small webservers written in c that can be found
|
24 | 22 | on github.
|
25 | 23 | They are usually just learning exercises, not intended to run in production,
|
|
0 commit comments