added sample service templates, basic service outline and moved service info to documentation dir

1 files changed, 68 insertions, 0 deletions

diff --git a/documentation/README.md b/documentation/README.md
new file mode 100644
index 0000000..6e154fb
--- /dev/null
+++ b/documentation/README.md
@@ -0,0 +1,68 @@
+PrintDoc
+========
+
+Setup
+-----
+
+The service is hosted with ynetd or similar, one process per client.
+
+You submit an stl file and the service gives you details about the file:
+
+- how many triangles
+- file type (bin/ascii)
+- name
+- attributes (binary header parsing)
+
+The file upload size has to be below a certain limit (4kB?).
+
+The files are simply stored in a directory and cleaned up 
+via a crontab which checks their *last modified* date.
+
+The model name is used to create hash / id which also
+acts as directory name for the actual stl and parsed info.
+
+Error msg if too many verticies for one loop.. see vulnerability.
+
+Error msg if invalid format.
+
+
+Countermeasures
+---------------
+
+Countermeasures against malicious players, who via an
+unintended vulnerability gain remote code execution:
+
+
+Checker
+-------
+
+The flag is saved as a 3d model of the flag text. One needs
+to orient it, take a screenshot and decode the text from the
+image for automated exploitation.
+
+
+Vulnerability
+-------------
+
+If there are > 3 verticies in a `loop` in the stl, a warning
+message is returned by preparing and `printf`ing a buffer,
+however, WITHOUT a terminating null byte. As such, when
+processing the string, we read into the stack-adjacent integer
+that holds the file's attribute byte count. This value
+is zero by default so the buffer overflow will go unnoticed.
+
+We can set this value to 0x6e25 (= 28197), which corresponds
+to the string '%n' on a little endian system.
+
+When the warning prints, it will write the size of the
+format string (which can be controlled via the model name)
+to the address of the next value on the stack: the hash str.
+By varying this value to write 256 aka 0x100 we terminate
+the string with a null byte, making it an empty.
+
+Next, the program will return the info of all scans that match
+the hash prefix (files are saved in a directory <hash>-<timestamp>).
+Since the hash is not empty the information for each scan will be
+returned, including the id, which can be used to request the flag file.
+
+