Hacker News Reader

Comment by Sohcahtoa82 | Hacker News Reader

I'd be extremely impressed if someone actually managed to get RCE out of this, considering you'd only be able to use '0' through '9', or 0x30 through 0x39, in your payload.

View on HN

Hey! Original discoverer here. I would like to clarify some things. It would certainly be possible given that we can have numeric shell-code (check the reference). The real problem in here is the security mechanisms like stack cookies, brute-forcing those would have been a PITA with only numbers. But I'd have to take a closer look at the stack god knows what GCC could have done there :)

On a system without these protection mechanisms it would be a easy win.

Reference: https://haxx.in/posts/numeric-shellcode/

Wow that's very impressive.

If the float is part of an error message or logging message, the attacker may control portions of the string that appear after the float. This would let them inject a much larger range of bytes, perhaps even UTF-8.

It's not that powerful, if I'm reading it correctly: https://github.com/python/cpython/commit/34df10a9a16b38d5442...

The sprintf is to a temporary buffer that's converted to a PyUnicode object before returning, so subsequent portions of the string are written elsewhere.

It sounds like an extreme minimal instruction set computer (MISC), and it's surprising how much is possible with even just one or two opcodes - that can easily be Turing-complete

Semi-related: I discovered that you can divert control flow to an arbitrary point on the TI MSP430 using only the bytes in ascii alphanumeric range.

https://docs.google.com/presentation/d/19K7SK1L49reoFgjEPKCF...

Perhaps . too?

Reply on news.ycombinator.com