Debug.setlocal() security concerns - security

Question

Is there any security concerns todo with debug.setlocal? If so can you please tell me how exactly it works.

Answer 1

Lua threads run on top of a "stack", a list of items that make up most of the memory in the language. Everything, from "global" variables to tables, sits happily on this list.
When you create a local variable and execute your code, the stack would look something like this:
local a = "the letter a"
STACK
+---+----------------+
| 1 | "the letter a" |
+---+----------------+
Now, let's say we are malicious code. We know that the following code is used to run our program:
local isAdministrator = false
local Code = "malicious code here!"
loadstring(Code)()
Well, that means the stack of the loader looks something like this:
+---+-------+
| 1 | false | isAdministrator
+---+-------+----------------+
| 2 | "malicious code here!" | Code
+---+---------------------+--+
| 3 | function loadstring |
+---+---------------------+--+
| 4 | function MaliciousCode |
+---+------------------------+
Now, let's say changing isAdministrator is of some value to us. Let's look at how we would do that.
1 We need to get lua to modify the "stack" above our function. Imagine lua is a tree, like so:
otherScript
+ loader
+ maliciousCode
Each step in this tree has it's own stack, and each variable from the stack above it is "accessible" to the stack below it, thanks to the debug library.
If the "stack" we are currently on is stack #1 (which is always true)
Then the function that called the current function is on stack #2 (which is almost always true)
Now, looking at the stack of the function we want to change, isAdministrator is in slot 1, the first one. So, to change this, we juuuust:
debug.setlocal(2,1,true)
And bam. isAdministrator is now true. We are free to ruin your computer!
Do not fret- there is a way to stop this. It is really easy to take away the debug library:
local func = loadstring("malicious code!")
setfenv(func, {
-- Here we insert what functions our baby function can use. Let's give it the string, table, and math libraries- which are pretty safe
math = math, table = table, string = string,
-- Oh, and let's give it the `os.time` function as well.
os = { time = os.time }
})
func()
Now, func cannot access the debug library, and you are free to use your silly isAdministrator locals in peace.