I’ve been playing around in the CLR for some time just playing with quirks and oddities. I noted some time ago that non-printable characters were easily stored in strings. This really wasn’t a suprise except that a null character (“ ”) could be stored and appropriately retrieved from a string. If I embedded a null character in a string, it didn’t cause the string to truncate when I read it back. This made me wonder just how the string class knew how large its buffer was. How did it know which null character was it’s terminator?
Since my upcoming book deals, in part, with Reflection, I decided to try some playing around with the string object using MemberInfo. I found something rather interesting. The string class keeps track of how large its buffer is in a member variable called m_stringLength. So I started to wonder, what would happen if I created a string and then used reflection to change the length?
I decided to make this interesting. I first created an example class that would represent a class handling sensitive data. My code was simple and was as follows:
using System;
namespace CodeWithSecrets {
// Lets assume this is a class that handles connection strings
// or other sensative data.
class ConnectionStringGuardian {
public ConnectionStringGuardian() {
connect = "uid=sa;pwd=LoveSexSecretGod";
}
}
}
I put this class in its own class library assembly named “CodeWithSecrets”. Then came the code that I would use to exploit the “ConnectionStringGuardian” class.
using System;
using System.Reflection;
using CodeWithSecrets;
namespace MalCode{
class Malware {
[STAThread]
static void Main(string[] args) {
ReadPastBuffer();
}
private static void ReadPastBuffer() {
// Storing some variable
String stringObj = "12345";
// Store an object with private data in it
ConnectionStringGuardian obj = new ConnectionStringGuardian();
// Getting the String Type
Type stringType = Type.GetType("System.String");
// Getting a reference to the private field in System.String
FieldInfo fi = stringType.GetField( "m_stringLength",
BindingFlags.Instance|BindingFlags.NonPublic);
// Read the string object
Console.WriteLine( "Reflected String: '{0}'", stringObj );
// Set the private variable that keeps track of string length;
Object parameter = 255;
fi.SetValue( stringObj, parameter );
// Read the reflected string
Console.WriteLine( "Expanded Buffer: '{0}'", stringObj );
Console.ReadLine();
}
}
}
To explain what I’ve done here, I created a typical string holding an arbitrary value. I then create an instance of my class that holds secret data. Using reflection, I then access the private m_stringLength member to increase the size of the string’s buffer to 255. Finally, I output my string to the console to see if I can read past my buffer in a managed string. As you’ll notice, I write the string’s value to the console before increasing the buffer size, and then I write the strings value to the console again after modifying the buffer size. The following screen shot depicts the results:
Notice that I was able to read past the buffer and into the memory where the sensitive data was stored. (First person to name the movie the sample password comes from gets a free Apress t-shirt if you send me your address.)
Now this is not really an exploit other than the fact that I can read memory to possibly sensitive data. I tried to do other things to the memory such as stomp on it by calling the private “NullTerminate()” method that I found using reflection as well. NullTerminate writes a null terminator at the end of a buffer using the m_stringLength value to determine just where to put that value. This, unfortunately, did not overwrite the data in memory as I was expecting. Ultimately, I was thinking that I might be able to break the type safety of an assembly by stomping on memory belonging to an instance.
The problem with this code (or perhaps the good thing to note if you are an MS security expert) is that I have to use reflection to pull this off. I wouldn’t be able to execute this in a partial trust environment. If I downloaded this code in the internet zone, the reflection permission is not permitted by default. This severely cripples my attempts to make this tidbit worthwhile. As Michael Howard responded to me: “fully trusted code is fully trusted code.” True enough.
In any case, I hope this serves as some sort of education in some more internals of the string class. Let me know what you think.
(P.S. No need to make the obvious statement that sensitive data shouldn’t be stored in classes.)
