themalwareguardian/cve-2020-13768
Stack-based buffer overflow in MiniShare 1.4.1 reachable through a single HTTP PUT request.
Stack-based buffer overflow in MiniShare 1.4.1 reachable through a single HTTP PUT request.
This repository is part of the material I use when teaching memory corruption exploitation (in addition to my regular work, I also teach in different cybersecurity courses where I help train the next generation of reverse engineers).
CVE-2020-13768 is a case I use when I want to show how simple network-facing servers can expose classic stack-based buffer overflows through standard protocol methods. The vulnerable endpoint requires no authentication, the overflow is a direct EIP overwrite, and the exploitation path is clean and well-defined. It is an ideal case for learning the full exploitation methodology in a realistic unauthenticated remote scenario.
What also makes this case interesting as a teaching exercise is that the same root cause, unsanitized input copied into a fixed-size stack buffer, appears across multiple CVE entries for the same binary. CVE-2018-19861, CVE-2018-19862, and CVE-2019-17601 all describe the same class of vulnerability, just reported by different researchers through different HTTP methods or endpoints. This teaches students to look at root causes rather than just CVE numbers.
This vulnerability affects MiniShare 1.4.1, a discontinued lightweight Windows HTTP server designed for simple local file sharing. The software was written without modern security practices in mind. What makes this case particularly interesting from a teaching perspective is the combination of factors involved:
This combination makes CVE-2020-13768 an excellent case for teaching the fundamentals of network-based buffer overflow exploitation in a realistic unauthenticated scenario.
MiniShare is a minimal Windows HTTP server originally designed for quick local file sharing over a LAN. It listens on TCP port 80 and handles a small subset of HTTP methods including GET and PUT. The PUT handler processes incoming requests and copies the URI path into a fixed-size stack buffer without validating its length.
Key technical details:
MiniShare processes incoming HTTP requests and dispatches them to the appropriate handler based on the method. The PUT handler extracts the URI path from the request and copies it into a fixed-size stack buffer without checking its length.
A simplified version of the vulnerable logic looks like this:
char path_buffer[256];
strcpy(path_buffer, uri_path);
Since the destination buffer has a fixed size and the input length is not validated, sending a sufficiently long URI in the PUT request causes the copy to write past the end of the buffer, eventually reaching and overwriting the saved return address (EIP) on the stack.
When the vulnerable function returns, the CPU loads the attacker-controlled value from the stack into EIP and jumps to it. If that address points to attacker-controlled data containing shellcode, arbitrary code execution is achieved.
The crash can be reproduced by sending an oversized URI in an HTTP PUT request. No authentication is required. Example using Python:
import socket
HOST = '127.0.0.1'
PORT = 80
payload = b"A" * 3000
request = (
b"PUT /" + payload + b" HTTP/1.1\r\n"
b"Host: 127.0.0.1\r\n"
b"Connection: close\r\n"
b"\r\n"
)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
s.send(request)
s.close()
When executed under a debugger, the crash shows EIP overwritten with user-controlled data:
EIP = 41414141
confirming that the saved return address has been corrupted by the overflow.
The goal of this repository is not only to demonstrate the crash, but also to walk through the complete exploitation process step by step, following the methodology used when developing real stack-based exploits.
To keep the main README clean, the detailed exploitation notes, scripts, and debugger steps are placed inside the Vulnerability 📂 folder of this repository.
There you will find the complete workflow used to exploit this CVE, including: