BofCheck is a program that can test weak binaries for basic vulnerabilities. It can test for command line overflows, ENV overflows, and basic format string vulnerabilities. BofCheck utilizes ptrace() to analyze the stack during testing and report any overwritten stack addresses and other important data.
Tool source code:
/* BofCheck.c - Coded by sw @ .:[oc192.us]:. Security.
*
* Please email me (sw@oc192.us) with questions, comments,
* ideas for this as it is an ongoing project.
*
* Simple tool to test bins for stack overflows, still beta and
* probably buggy.
*
* Changes:
* This version utilizes the ptrace() method in order to delay
* the process and return valuable exploitation info in the
* event we do find a vulnerability.... *BSD will be supported soon..
*
* Objective:
* Checks command line arguments v.s. a simple/env/format strings overflow
* and returns the signal status, giving us information
* as to if the program is vulnerable or may be vulnerable
* to a simple command line overflow.
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <asm/user.h>
#include <string.h>
#include <fcntl.h>
#include <signal.h>
#include <unistd.h>
#define LIST 16
/* create a list of the most common signal traps */
struct sigs{
char *type;
char *num;
} types[] = {
{"SIGINT", "2"},
{"SIGQUIT", "3"},
{"SIGILL", "4"},
{"SIGTRAP", "5"},
{"SIGABRT", "6"},
{"SIGEMT", "7"},
{"SIGFPE", "8"},
{"SIGKILL", "9"},
{"SIGBUS", "10"},
{"SIGSEGV", "11"},
{"SIGSYS", "12"},
{"SIGPIPE", "13"},
{"SIGALRM", "14"},
{"SIGTERM", "15"},
{"SIGUSR1", "16"},
{"SIGUSR2", "17"},
};
/* usage function */
void usage(char *yourself){
fprintf(stderr,
"oc192-bof.c - coded by sw @ .:[oc192.us]:. Security\n"
"Usage: %s -f <file> [options]\n"
"\n"
"Options:\n"
"-s: Use this to test for generic format strings bugs\n"
"-e: Specify ENV variables to try an overflow\n"
"-b: Set cmd line buffer overflow size (Default: 10000)\n"
"-a: Specify arguments to test (Default: A-Z,a-z)\n"
"-l: Specify logfile (Default: bofcheck.log)\n"
"-h: Help/examples\n"
"-v: Verbose mode\n"
"\n", yourself);
exit(0);
}
void help(char *yourself){
fprintf(stderr,
"Examples:\n"
"______________________________________________________________________\n"
"NOTE: -e,-a,-s cannot be used in combination.\n"
"______________________________________________________________________\n"
"%s -f <file>:\n"
"Performs cmd line overflow check on all args A-Z, a-z\n"
"______________________________________________________________________\n"
"%s -sf <file>:\n"
"Performs generic format string test on all args A-Z, a-z\n"
"______________________________________________________________________\n"
"%s -a -a,-b,-c -f <file>:\n"
"Performs cmd line overflow check on args -a -b -c\n"
"______________________________________________________________________\n"
"%s -e TERM,SIZE -b 6000 -f <file>:\n"
"Attempts to overflow TERM and SIZE env variables on selected file\n"
"______________________________________________________________________\n"
"%s -s -a -a,-b,-c -f <file>:\n"
"Performs generic format string test on args -a -b -c\n"
"______________________________________________________________________\n"
"%s -b 2038 -vf <file>:\n"
"Performs generic format string test on all args A-Z, a-z with\n"
"buffer of 2038 and verbose output\n"
"______________________________________________________________________\n",
yourself, yourself, yourself, yourself, yourself, yourself);
exit(0);
}
/* ptrace routine to analyze target programs' regs and exit status */
int pnig(char *path, char *program, char *args, char *buf, char *logfile){
unsigned long aa;
struct user_regs_struct regs;
int pid_vuln, z, status, i, fd;
char sp[50], bufaddr[50];
/* fork victim program into memory */
if (!(pid_vuln = fork())){
fd = open("/dev/null", O_WRONLY|O_CREAT|O_TRUNC, S_IRWXU);
dup2(fd, STDERR_FILENO); /* Kill messy output from child */
dup2(fd, STDOUT_FILENO);
close(fd);
alarm(5);
if(envmode==0){
execl(path, program, args, buf, NULL);
/* store the SP for the log() */
sprintf(sp, "0x%08x", (int) regs.esp);
z = 0, aa = 0;
/* look at regs to check if any addresses have been overwritten by our test overflow */
