# Pentest Memory Corruption

> Use when performing penetration testing targeting memory corruption vulnerabilities in native applications. Keywords: buffer overflow, heap overflow, use-after-free, integer overflow, format string, stack overflow, type confusion, out-of-bounds read/write

- Skill: `yhy0/pentest-memory-corruption` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add yhy0/pentest-memory-corruption`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yhy0/pentest-memory-corruption/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: yhy0 (https://skillmd.com/u/yhy0)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/yhy0/pentest-memory-corruption

---


# Memory Corruption Penetration Testing Patterns

当对原生应用（C/C++/Rust unsafe）进行内存安全渗透测试时加载此 Skill。覆盖栈溢出、堆溢出、UAF、整数溢出等。

## Attack Surface Discovery

**高风险目标：**
- 网络协议解析器：HTTP/2、DNS、TLS、自定义二进制协议
- 文件格式解析：图片（PNG/JPEG）、文档（PDF/Office）、多媒体（MP4/FLV）
- 游戏客户端：自定义数据包解析、排行榜/回放文件处理、RPC 消息
- IoT/嵌入式设备：固件中的 Web 服务器、协议实现
- 浏览器扩展：与原生代码交互的 JS 桥接
- 字符串处理函数：escape/unescape、编码转换

**识别信号：**
- 应用使用 C/C++ 编写
- 处理不可信的二进制数据输入
- 自定义协议或文件格式解析
- 历史上有过内存安全漏洞的组件

## Exploitation Techniques

**栈缓冲区溢出：**
- 定位溢出点：发送超长输入到输入缓冲区
- 确定偏移量：使用 pattern_create / pattern_offset（Metasploit）
- 覆盖返回地址：跳转到 shellcode 或 ROP gadget
- 绕过保护：ASLR（信息泄露）、DEP/NX（ROP chain）、Stack Canary（信息泄露/fork 暴力破解）

**堆溢出 / Use-After-Free：**
- 堆喷射（Heap Spray）：填充堆空间以控制内存布局
- UAF 触发：释放对象后重新分配同大小块，控制虚表指针
- 类型混淆：利用错误的类型转换访问越界内存

**整数溢出：**
```c
// 典型模式：size 参数溢出导致小缓冲区分配
size_t total = count * sizeof(element);  // 溢出为小值
buffer = malloc(total);                   // 分配小缓冲区
memcpy(buffer, input, count * sizeof(element));  // 实际写入大量数据
```

**格式字符串漏洞：**
```
# 信息泄露
%x.%x.%x.%x
%p.%p.%p.%p

# 任意写入
%n  (写入已输出字节数)
```

**模糊测试方法：**
- AFL/AFL++：覆盖引导模糊测试
- libFuzzer：LLVM 集成的进程内模糊测试
- 自定义 harness：针对特定解析函数编写
- ASAN/MSAN/TSAN：编译时插桩检测内存错误

## Detection Checklist

- [ ] 识别目标中的 C/C++ 组件及其输入接口
- [ ] 发送超长输入（A*10000）测试基础缓冲区溢出
- [ ] 发送边界值整数（0、-1、MAX_INT、MAX_INT+1）测试整数溢出
- [ ] 测试格式字符串输入（%x、%p、%n）
- [ ] 使用 AFL++/libFuzzer 对文件解析功能进行模糊测试
- [ ] 检查已知 CVE（如 Apache httpd、Node.js libuv 中的内存安全漏洞）
- [ ] 分析崩溃转储（core dump）确定漏洞类型和可利用性
- [ ] 检查编译选项（ASLR、DEP、Stack Canary、RELRO）评估利用难度
- [ ] 测试文件上传功能是否安全处理畸形文件

## Impact Assessment

**漏洞利用可达到的效果：**
- 远程代码执行：栈溢出/堆溢出 + ROP chain → 完全控制目标系统
- 拒绝服务：NULL 指针解引用、assert 失败 → 应用崩溃
- 信息泄露：越界读取 → 泄露内存中的敏感数据（密钥、session）
- 沙箱逃逸：浏览器/游戏客户端中的 UAF → 逃逸渲染进程沙箱

**严重度判断：**
- **Critical**：可远程触发的 RCE（如网络协议解析器中的溢出）
- **High**：需要用户交互的 RCE（打开恶意文件）、可靠的信息泄露
- **Medium**：仅 DoS（崩溃）、利用条件苛刻、需要本地访问


## Real-World Cases

以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。

### Case 1: Brave Software — UAF on JSEthereumProvider

- **严重度**: Critical | **CWE**: Use After Free
- **摘要**: A UAF (Use After Free) vulnerability was discovered in the renderer implementation of the Ethereum wallet. This vulnerability allowed an attacker to trigger a crash in the renderer process and potenti...
- **报告**: https://hackerone.com/reports/1977252

### Case 2: Internet Bug Bounty — CVE-2022-40604: Apache Airflow: Format String Vulnerability

- **严重度**: Critical | **CWE**: Use of Externally-Controlled Format String
- **摘要**: There is a format string vulnerability in Apache Airflow versions 2.3.0 through 2.3.4 in the src/airflow/utils/log/file_task_handler.py file. The vulnerability was caused by unnecessary formatting of ...
- **报告**: https://hackerone.com/reports/1707287

### Case 3: Nintendo — [MK8DX] Improper ranking/replay file parsing

- **严重度**: Critical | **CWE**: Memory Corruption - Generic
- **摘要**: The vulnerability in the Mario Kart 8 Deluxe game involved improper ranking and replay file parsing. This allowed for potential exploitation, leading to potentially unintended consequences.
- **报告**: https://hackerone.com/reports/1813453

### Case 4: HackerOne — HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization

- **严重度**: High | **CWE**: Improper Null Termination
- **摘要**: A vulnerability was discovered where SAML signup domain enforcement for new signups belonging to SAML-enabled organizations could be bypassed by appending control characters, allowing unauthorized acc...
- **报告**: https://hackerone.com/reports/2101076

### Case 5: Internet Bug Bounty — important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)

- **严重度**: High | **CWE**: NULL Pointer Dereference
- **摘要**: important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)

A null pointer dereference vulnerability was discovered in mod_proxy in Apach...
- **报告**: https://hackerone.com/reports/2585375

### Case 6: Nintendo — [Xenoblade Chronicles X: Definitive Edition] Buffer overflow in string escape function, multiplayer DoS

- **严重度**: High | **CWE**: Classic Buffer Overflow
- **摘要**: A buffer overflow vulnerability was discovered in the string escape function of Xenoblade Chronicles X: Definitive Edition, which could have led to a denial-of-service (DoS) issue in the game's multip...
- **报告**: https://hackerone.com/reports/3048061

### Case 7: Node.js — Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled

- **严重度**: High | **CWE**: Improper Initialization
- **摘要**: A flaw in Node.js's buffer allocation logic was discovered, where buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous opera...
- **报告**: https://hackerone.com/reports/3405778

### Case 8: PlayStation — sys_fsc2h_ctrl kernel stack free

- **严重度**: High | **CWE**: Use After Free
- **摘要**: The sys_fsc2h_ctrl kernel function can lead to a kernel stack free vulnerability. The vulnerability is caused by a race condition involving multiple threads accessing a local stack buffer. This could ...
- **报告**: https://hackerone.com/reports/2900606

### Case 9: PlayStation — Remote vulnerabilities in spp

- **严重度**: High | **CWE**: Classic Buffer Overflow
- **摘要**: A vulnerability was discovered in the spp (PPPoE) implementation on the PS4/PS5. The vulnerability could allow a malicious PPPoE server to cause a heap buffer overwrite and overread, potentially leadi...
- **报告**: https://hackerone.com/reports/2177925