HavocFramework / Havoc

The Havoc Framework.
GNU General Public License v3.0
6.37k stars 903 forks source link

[File a bug report for the Demon Implant]: exception occurred in BeaconPrintf because vsnprintf #392

Closed sh1xo closed 10 months ago

sh1xo commented 10 months ago

Contact Details

No response

What happened?

When the first parameter buffer is NULL, vsnprintf return -1, which causes an exception in BeaconPrintf. This happens when I execute the locale bof. (https://github.com/HavocFramework/Havoc/blob/c393115fa1714748f368aff97e55da4aa81f5c56/payloads/Demon/Source/Loader/ObjectApi.c#L217C5-L217C5)

and this works for me

    va_start(VaListArg, fmt);

    //CallbackSize = Instance.Win32.vsnprintf(NULL, 0, fmt, VaListArg);
    CallbackSize = 0x1000; //big enough
    CallbackOutput  = Instance.Win32.LocalAlloc( LPTR, CallbackSize );

    Instance.Win32.vsnprintf(CallbackOutput, CallbackSize, fmt, VaListArg);

    va_end(VaListArg);

Did You Do a Pull First?

Anything else (You didn't pull...)

Did You Try With the Dev Branch?

No (You only tried the main branch...)

Relevant log output

No response

Did You Read Over Your Issue First?

S4ntiagoP commented 10 months ago

hey there, I added some sanity checks to BeaconPrintf, which should make it more robust, reopen this if needed!