Conversation

Notices

1. Embed this notice
   Harry Sintonen (harrysintonen@infosec.exchange)'s status on Monday, 24-Feb-2025 03:53:20 JST Harry Sintonen

   #curl predecessor httpget 0.2 from around 1996/1997 is 165 lines. Needless to say, it has multiple critical security vulnerabilities. How many can you spot?

   If you build it on a modern system and want to try exploiting it in true 90s fashion, be sure to turn off address space layout randomisation (ASLR).

   https://github.com/curl/httpget/blob/master/httpget-0.2.c

   #infosec #cybersecurity

   • Embed this notice
     Harry Sintonen (harrysintonen@infosec.exchange)'s status on Monday, 24-Feb-2025 03:53:20 JST Harry Sintonen

     in reply to

     The httpget 0.2 doesn't quite work in the form it was uploaded.

     First it uses hardcoded argv, argc insteda of getting from the app invocation (as args in main, the code uses void main).

     Second obtaining any data from the socket will result in the app stopping and leaving behind en empty file (if (nread) break;).

     This program could never download anything. It is likely some work in progress or modified test version of httpget.

     So while the code has a local stack buffer overflow it can't be triggered for this early version.

     Haelwenn /элвэн/ :triskell: likes this.