Skip to content

Latest commit

 

History

History

CVE-2019-1000006

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 
 
 
 
 
 
 

RCE case

Originally come from github project

This is a Remote Code Execution exploit for CVE-2019-1000006 in RIOT

Description

We did this with BOARD=pba-d-01-kw2x. We wrote some ARM assembler code which toggles the LED and stored the machine code for it in the RDATA field of the answer section in the DNS response, thereby overflowing the addr buffer in the main stack frame. Our payload exactly fits into the stack frame of the main function and overwrites the return address of that function, jumping to the addr buffer and executing our payload.

References