Skip to content

Back to the catalog

Quacc++
somersetrecon.comwriteup

Quacc++

Somerset Recon details Quacc++, a proof-of-concept automated bug hunter that queries grep.app's regex-based index of public GitHub repos to find candidate vulnerable code, downloads matching repositories, and runs Semgrep taint-analysis rules to confirm exploitable patterns. Using a search for strcpy(buf, argv[ paired with a custom Semgrep taint rule, the authors discovered an unbounded strcpy stack buffer overflow in GetArgumentFiles() in Google DeepMind's Lab repository (engine/code/bspc/bspc.c), confirmed with AddressSanitizer and pwntools/GDB to give full RIP control at offset 1080. The post also walks through Semgrep rules for SQL injection (CWE-89), hardcoded API keys (CWE-798), and disabled TLS certificate validation (CWE-295) across curl/wget/requests/Node/Go.

TL;DR A grep.app + Semgrep pipeline (Quacc++) that mass-scans public GitHub for vulnerability patterns found a real stack buffer overflow with RIP control in Google DeepMind's Lab repo.
Open original ↗

Organisations named here

  • CWE-295
  • CWE-89
  • DeepMind Lab

Technologies named here

  • Google DeepMind Lab
  • Quacc++
  • Grep.app
  • Semgrep
  • AddressSanitizer
  • GDB
  • pwntools
  • GitHub

Techniques named here

  • Stack buffer overflow via unbounded strcpy
  • SQL injection via string formatting
  • Hardcoded credential detection
  • Disabled TLS/SSL certificate validation
  • RIP control confirmation via cyclic pattern
  • Use of Hard-coded Credentials

Related in AppSec