DARPA performer group
Kaprica Security (KPRCA)
Simple shell-like file management system.
``` list [file ..] - Lists files and directories.
create - Creates a file.
open - Opens a file.
close - Closes an open file.
close_all - Closes all open files.
read [pos] [len] - Reads a file.
modify [pos] - Modifies a file.
delete - Deletes a file.
mkdir - Creates a directory.
rmdir - Deletes a directory.
chdir - Changes the working directory.
quit - Quits the program.
help [command] - Displays the help message. ```
- When deleting a file, the file object pointer is not removed from the list that keeps track of currently opened files.
- This yields a dangling pointer when a file is deleted while it's opened.
- By allocating similar-sized buffer by writing into another file, it is possible to take over the memory for the dangling pointer -- allowing Use-After-Free condition.
- Arbitrary code execution can be achieved by triggering a virtual function in the file object after carefully setting up the payload.
Generic class of vulnerability
Use After Free
CWE-416: Use After Free