Novel Arbitrary Write in SQLite

This describes a novel exploitation technique that turns SQLite’s built-in sqlite_dbpage virtual table into a near-arbitrary write primitive capable of producing working shared objects on disk. The sqlite_dbpage table exposes raw page reads and updates through SQL, and by ATTACHing a database, creating space with zeroblob, and updating pages (written in reverse order to avoid immediate header corruption), an attacker can overwrite most file bytes. Limitations include ATTACH only allowing new or valid SQLite files and immutable portions of the first 100-byte database header - commit counters and a few version fields - that cannot be trivially overwritten. The author measured which offsets resist modification and designed the write strategy around them.

To reach code execution against a Python webapp, the approach builds a Python extension .so (via Cython) matching the target interpreter, then uses LIEF to relocate the ELF Program Header Table away from the damaged header area to the file end so the dynamic loader can still load the binary. A generator assembles SQL that reserves pages, pads and chunks the .so, and issues UPDATE sqlite_dbpage for each page (or a single-page write by setting PRAGMA page_size=65536 for small binaries). Finally, forcing a process restart (e.g., crashing Gunicorn) causes the runtime to load the shadowed module and yields remote code execution despite default extension-loading protections.