Repository navigation
Expand file tree
/
Copy pathasan.txt
More file actions
84 lines (80 loc) · 5.48 KB
/
Copy pathasan.txt
File metadata and controls
84 lines (80 loc) · 5.48 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
=================================================================
==20585==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f64bc08dee0 at pc 0x0000004a47a7 bp 0x7f64bc08cb70 sp 0x7f64bc08c320
WRITE of size 16419 at 0x7f64bc08dee0 thread T14
#0 0x4a47a6 in strcpy (/home/user/tmp/nesca/nesca+0x4a47a6)
#1 0x5ca0a6 in _saveSSH(char const*, int, int, char const*) /home/user/tmp/nesca/finder.cpp:1548:29
#2 0x5da42f in Lexems::filler(char*, char*, int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, int, Lexems*) /home/user/tmp/nesca/finder.cpp:3556:4
#3 0x5e8a6b in Connector::connectToPort(char*, int) /home/user/tmp/nesca/Connector.cpp:586:4
#4 0x619f22 in _connect() /home/user/tmp/nesca/MainStarter.cpp:943:9
#5 0x5fd703 in void* std::_Bind_simple<void* (*())()>::_M_invoke<>(std::_Index_tuple<>) /usr/bin/../lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/c++/6.3.0/functional:1390:18
#6 0x5fd6b4 in std::_Bind_simple<void* (*())()>::operator()()/usr/bin/../lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/c++/6.3.0/functional:1380:16
#7 0x5fd538 in std::thread::_State_impl<std::_Bind_simple<void* (*())()> >::_M_run() /usr/bin/../lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/c++/6.3.0/thread:197:13
#8 0x7f64e618ae6e (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb9e6e)
#9 0x7f64e645a493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#10 0x7f64e54f3ace in clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8ace)
Address 0x7f64bc08dee0 is located in stack of thread T14 at offset 4960 in frame
#0 0x5c9cbf in _saveSSH(char const*, int, int, char const*) /home/user/tmp/nesca/finder.cpp:1537
This frame has 14 object(s):
[32, 2080) 'log'
[2208, 4256) 'logEmit'
[4384, 4640) 'goodStr'
[4704, 4960) 'banner'
[5024, 5152) 'loginSSH' <== Memory access at offset 4960 partially underflows this variable
[5184, 5312) 'passSSH' <== Memory access at offset 4960 partially underflows this variable
[5344, 5376) '' <== Memory access at offset 4960 partially underflows this variable
[5408, 5416) '' <== Memory access at offset 4960 partially underflows this variable
[5440, 5448) '' <== Memory access at offset 4960 partially underflows this variable
[5472, 5480) '' <== Memory access at offset 4960 partially underflows this variable
[5504, 5512) '' <== Memory access at offset 4960 partially underflows this variable
[5536, 5544) '' <== Memory access at offset 4960 partially underflows this variable
[5568, 5576) '' <== Memory access at offset 4960 partially underflows this variable
[5600, 5608) '' <== Memory access at offset 4960 partially underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
Thread T14 created by T10 (STh) here:
#0 0x446d39 in __interceptor_pthread_create (/home/user/tmp/nesca/nesca+0x446d39)
#1 0x7f64e618b164 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State>>, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xba164)
#2 0x5f8bed in Threader::fireThread(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, void* (*)()) /home/user/tmp/nesca/Threader.cpp:16:21
#3 0x61a980 in MainStarter::startIPScan() /home/user/tmp/nesca/MainStarter.cpp:971:9
#4 0x620967 in MainStarter::start(char const*, char const*) /home/user/tmp/nesca/MainStarter.cpp:1492:18
#5 0x5b3cf4 in STh::run() /home/user/tmp/nesca/STh.cpp:88:2
#6 0x7f64e69afda7 (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xaeda7)
#7 0x7f64e645a493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
Thread T10 (STh) created by T0 here:
#0 0x446d39 in __interceptor_pthread_create (/home/user/tmp/nesca/nesca+0x446d39)
#1 0x7f64e69af295 in QThread::start(QThread::Priority) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xae295)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/user/tmp/nesca/nesca+0x4a47a6) in strcpy
Shadow bytes around the buggy address:
0x0fed17809b80: 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
0x0fed17809b90: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
0x0fed17809ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fed17809bb0: 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00
0x0fed17809bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fed17809bd0: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2
0x0fed17809be0: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
0x0fed17809bf0: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00
0x0fed17809c00: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 00
0x0fed17809c10: f2 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2
0x0fed17809c20: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f3 f3 f3
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==20585==ABORTING