Return-orientated Programming
|
|
|
- Paula Stanley
- 5 years ago
- Views:
Transcription
1 Return-orientated Programming or The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) Hovav Shacham, CCS '07 Return-Oriented oriented Programming programming 11/23 / 42
2 Arms Race : Buffer overflows Vulnerabilities Classic: buffer overflow (stack/heap) Integer overflows, format strings, double free,... Countermeasures Canaries on the stack Copy or encrypt jump targets (ret addr, function ptr) Strict Harvard architecture: separate code and data (Non-executable stacks, heaps W X) Hardware: bit in page table entries preventing code execution from a page (AMD: NX, Intel: XD) Return-Oriented oriented Programming programming 22/23 / 42
3 Arms Race II - ret2libc Indirect code injection (mis)use existing code (libc.so.6, msvcrt.dll) Return-into-libc: Overwrite stack frame (ret addr) Attacker can call any function with arbitrary arguments (even chaining is possible) But: cannot execute arbitrary code Defense Remove all unnecessary functions, e.g. system() ASLR to add noise to jump target addresses Return-Oriented oriented Programming programming 33/23 / 42
4 Arms Race III ROP Use short instruction sequences ending in a ret Combine them to achieve complexer tasks Turing complete No function calls, control flow via returns 'In any sufficiently large code base are enough short sequences allowing an attacker to perform arbitrary computations.' Return-Oriented oriented Programming programming 44/23 / 42
5 Short Sequences Gadgets Where to get these instruction sequences dense x86 instruction encoding f7 c f c3 test $0x , %edi setnzb 61(%ebp) c f movl $0x0f000000, (%edi) 95 xchg %ebp, %eax 45 inc %ebp c3 ret Return-Oriented oriented Programming programming 55/23 / 42
6 Discovery of usable Gadgets Search executable segments of libc for ret opcode (c3) Scan backwards, disassemble, gather valid entry points into a tree test $0x7,%edi setnzb 61(%ebp) f7 c f c3 f7 c f c3 f7 c f c3 f7 c f c3 f7 c f c3 Return-Oriented oriented Programming programming 66/23 / c3 ret inc %ebp xchg %ebp, %eax
7 Recap: Ordinary Execution inst inst inst inst inst %eip Current instruction is decoded and executes eip points after the current instruction to the next one to be executed control flow changes value of eip Return-Oriented oriented Programming programming 77/23 / 42
8 Recap: Ordinary Execution inst inst inst inst inst %eip Current instruction is decoded and executes eip points after the current instruction to the next one to be executed control flow changes value of eip Return-Oriented oriented Programming programming 88/23 / 42
9 Recap: Ordinary Execution inst inst inst inst inst %eip Current instruction is decoded and executes eip points after the current instruction to the next one to be executed control flow changes value of eip Return-Oriented oriented Programming programming 99/23 / 42
10 Recap: Ordinary Execution inst inst inst inst inst Current instruction is decoded and executes eip points after the current instruction to the next one to be executed control flow changes value of eip %eip Return-Oriented oriented Programming programming 10/23 / 42
11 Recap: Ordinary Execution inst inst inst inst inst Current instruction is decoded and executes eip points after the current instruction to the next one to be executed control flow changes value of eip %eip Return-Oriented oriented Programming programming 11/23 / 42
12 Return-Oriented Programming pop %edx; ret mov %eax, (%edx); ret more code; ret data %esp Assume the next instruction is a ret The return addresses on the stack are our new instruction pointer Stack: pointers to code snippets to call + data Control transfer via return operations Return-Oriented oriented Programming programming 12/23 / 42
13 Return-Oriented Programming pop %edx; ret mov %eax, (%edx); ret more code; ret data %esp Assume the next instruction is a ret The return addresses on the stack are our new instruction pointer Stack: pointers to code snippets to call + data Control transfer via return operations Return-Oriented oriented Programming programming 13/23 / 42
14 Return-Oriented Programming pop %edx; ret mov %eax, (%edx); ret more code; ret data %esp Assume the next instruction is a ret The return addresses on the stack are our new instruction pointer Stack: pointers to code snippets to call + data Control transfer via return operations Return-Oriented oriented Programming programming 14/23 / 42
15 Return-Oriented Programming pop %edx; ret mov %eax, (%edx); ret more code; ret data %esp Assume the next instruction is a ret The return addresses on the stack are our new instruction pointer Stack: pointers to code snippets to call + data Control transfer via return operations Return-Oriented oriented Programming programming 15/23 / 42
16 Return-Oriented Programming pop %edx; ret mov %eax, (%edx); ret more code; ret data %esp Assume the next instruction is a ret The return addresses on the stack are our new instruction pointer Stack: pointers to code snippets to call + data Control transfer via return operations Return-Oriented oriented Programming programming 16/23 / 42
17 Return-Oriented Programming pop %edx; ret mov %eax, (%edx); ret more code; ret data Assume the next instruction is a ret %esp The return addresses on the stack are our new instruction pointer Stack: pointers to code snippets to call + data Control transfer via return operations Return-Oriented oriented Programming programming 17/23 / 42
18 Gadgets Building Blocks Load/Store operations (reg/mem) ALU (arithm./logic) Conditional jumps System calls Shellcode q.e.d. Return-Oriented oriented Programming programming 18/23 / 42
19 Load a Constant Return-Oriented oriented Programming programming 19/23 / 42
20 Load from Memory Return-Oriented oriented Programming programming 20/23 / 42
21 Store to Memory Return-Oriented oriented Programming programming 21/23 / 42
22 Add Value from Memory to eax Return-Oriented oriented Programming programming 22/23 / 42
23 XOR Ideally: xorl (%edx), %eax (but not available) Code snippet found: xorb %al, 0x48908c0(%ebx) and $0xff, %al push %ebp or $0xc9, %al ret xorl: rotate 4 times and xor bytewise push %ebp; ret let %ebp point to a ret Return-Oriented oriented Programming programming 23/23 / 42
24 Control Flow Jumps Unconditional jumps pop %esp, ret Conditional jumps Test condition %eflags hold result Jumps change instruction pointer, we need to conditionally change the stack pointer Three steps Test condition Copy flags to general purpose register (add-with-carry) Mask desired bit, change esp accordingly Return-Oriented oriented Programming programming 24/23 / 42
25 Control Flow Jumps Test condition flags change Copy flags to general purpose register clear ecx; adc %cl, %cl 0 or 1 Modify esp depending on ecx negl ecx 0 or 0xFFFFFFFF andl with relative jump distance add to esp Return-Oriented oriented Programming programming 25/23 / 42
26 Conditional Jumps: Step 2 Return-Oriented oriented Programming programming 26/23 / 42
27 System Calls Typical syscall wrapper: Load arguments to registers Invoke kernel (sysenter/int 80) Check for error, cleanup 89 da mov %ebx, %edx 8b 5c movl 4(%esp), %ebx b8 3c mov $0x c, %eax 65 ff lcall %gs:0x10(,0) 89 d3 mov %edx, %ebx c3 ret wrapper fo sysenter or int 0x80 Return-Oriented oriented Programming programming 27/23 / 42
28 No-argument Syscall Return-Oriented oriented Programming programming 28/23 / 42
29 Shellcode Set %eax (syscall number) to 0xb Let %ebx point to the string ( /bin/sh ) Load %ecx to point to argv vector Clear %edx (pointer to environment) Trap into kernel Game over Return-Oriented oriented Programming programming 29/23 / 42
30 c3 / ret Statistics 5,483 out of 975,626 bytes are 0xc3 3,429 are actually ret instructions 1,692 are add imm32,%ebx (81 c3 imm32) 290 are displacements (relative calls and jumps or data offsets like movb %al, 61(%ebp) encoded as c3) Constants, SIB byte, floating point operation,... Return-Oriented oriented Programming programming 30/23 / 42
31 Avoid Spurious ret? Get rid of unintended c3 bytes (compiler) No moves from %eax to %ebx, no add %reg, %ebx Avoid offsets by c3 (rearrange instructions & data But: c3 is only one type of return (near return) There are four: Far ret, near ret with stack unwinding, far ret with stack unwinding Much harder to use (far returns also pop the code segment selector, but possible) Register spring: jmp %reg if reg points to a ret Even better: jmp *%reg, indirect jump Return-Oriented oriented Programming programming 31/23 / 42
32 Address Space Layout Randomization Add random to placement of movable sections Stack Heap Libraries Attacker has to guess addresses of return opcodes (c3) Most probably program crashes if guess was wrong Amount of randomness influences search space Return-Oriented oriented Programming programming 32/23 / 42
33 Address Space Layout Randomization First run stack libc ld heap text Offsets still need to be page aligned Text segment cannot be moved Addresses must not leak in any way Second run libc ld stack heap text Return-Oriented oriented Programming programming 33/23 / 42
34 ASLR Efficiency On The Effectiveness of Address-Space Randomization (CSS'04) 32bit architectures number of bits to randomize is limited PaX Executable: Code, Data, BSS 16 bit random Mapped: heap, libs, thread stack, 16 bit Stack: normal user stack 24 bit random offset Return-Oriented oriented Programming programming 34/23 / 42
35 ASLR Efficiency Fork vs. Exec() Fork: the address space layout does not change Exec: new layout every time the program runs Example: Web server spawns (forks) new processes for every client request A return-to-libc attack needs to guess 16 bit, the offset of the libc text segment Mount a return-2-libc attack to call usleep() Guessed offset wrong child crashed, connection resets Right offset connection hangs for some seconds Run second stage attack with de-randomized addresses Return-Oriented oriented Programming programming 35/23 / 42
36 ASLR Efficiency Apache web server with added buffer overflow Infer delta_mmap through brute force (usleep) After 216 seconds on average sucessful start second stage attack, circumventing ALSR Conclusion: on 32bit architectures and only 16 bit random for mapped area serious problems But: 64bit is there, at least 40 bit usable for address space randomization, practically brute forcing no more thread Return-Oriented oriented Programming programming 36/23 / 42
37 Return-less Kernels Defeating Return-Oriented Rootkits With Return-Less Kernels (EuroSys 2010) Get rid of all return instructions in the kernel no returns, no return-oriented exploits Idea: return indirection Caller puts return address into a global table and pushes the index onto the stack Callee on return does a table lookup and jumps to the intended instruction after the call No more normal call/ret instructions Return-Oriented oriented Programming programming 37/23 / 42
38 Return-less Kernels Remove all remaining c3 bytes from the code Relative offsets in jumps add nops jmp ffc3 nop; jmp ffc2; Relative offsets to data adapt register mov %eax, 0xc3(%ebx) dec %ebx; mov %eax, 0xc4(%ebx) Peephole optimization to replace instructions by equivalent ones without c3 (ret) Return-Oriented oriented Programming programming 38/23 / 42
39 Normal Call-Return Pairing Return-Oriented oriented Programming programming 39/23 / 42
40 Return Indirection Return-Oriented oriented Programming programming 40/23 / 42
41 Summary Buffer overflows, format string attacks, double frees, many ways to penetrate a system Counter code injection with W X: never execute writable code segments Return-oriented programming: use existing code snippets (gadgets) Sufficiently large code bases to take gadgets from turing completeness ALSR with 64bit seems to solve this (for now) Return-Oriented oriented Programming programming 41/23 / 42
42 In A Nutshell Code fractions from sufficiently large code base yield Turing completeness Avoiding return opcodes won't help No code injection at all, thus circumventing DEP Questions: Ret2libc with ASLR: guess one address ROP with ASLR: guess many return targets ASLR with 48/64 bit problem postponed? Return-Oriented oriented Programming programming 42/23 /
The Geometry of Innocent Flesh on the Bone
The Geometry of Innocent Flesh on the Bone Return-into-libc without Function Calls (on the x86) Hovav Shacham hovav@cs.ucsd.edu CCS 07 Technical Background Gadget: a short instructions sequence (e.x. pop
CSE 127: Computer Security Control Flow Hijacking. Kirill Levchenko
CSE 127: Computer Security Control Flow Hijacking Kirill Levchenko October 17, 2017 Control Flow Hijacking Defenses Avoid unsafe functions Stack canary Separate control stack Address Space Layout Randomization
Architecture-level Security Vulnerabilities
Architecture-level Security Vulnerabilities Björn Döbel Outline How stacks work Smashing the stack for fun and profit Preventing stack smashing attacks Circumventing stack smashing prevention The Battlefield:
Robust Shell Code Return Oriented Programming and HeapSpray. Zhiqiang Lin
CS 6V81-05: System Security and Malicious Code Analysis Robust Shell Code Return Oriented Programming and HeapSpray Zhiqiang Lin Department of Computer Science University of Texas at Dallas April 16 th,
This time. Defenses and other memory safety vulnerabilities. Everything you ve always wanted to know about gdb but were too afraid to ask
This time We will continue Buffer overflows By looking at Overflow Defenses and other memory safety vulnerabilities Everything you ve always wanted to know about gdb but were too afraid to ask Overflow
Outline. Memory Exploit
Outline CS 6V81-05: System Security and Malicious Code Analysis Robust Shell Code Return Oriented Programming and HeapSpray Zhiqiang Lin Department of Computer Science University of Texas at Dallas April
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES CMSC 414 FEB 01 2018 RECALL OUR CHALLENGES How can we make these even more difficult? Putting code into the memory (no zeroes) Finding the return address (guess
Architecture-level Security Vulnerabilities. Julian Stecklina
Architecture-level Security Vulnerabilities Julian Stecklina Outline How stacks work Smashing the stack for fun and profit Preventing stack smashing attacks Circumventing stack smashing prevention The
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler return-oriented programming Hovav Shacham presented by: Fabian
Lecture 10 Return-oriented programming. Stephen Checkoway University of Illinois at Chicago Based on slides by Bailey, Brumley, and Miller
Lecture 10 Return-oriented programming Stephen Checkoway University of Illinois at Chicago Based on slides by Bailey, Brumley, and Miller ROP Overview Idea: We forge shellcode out of existing application
Advanced Security for Systems Engineering VO 05: Advanced Attacks on Applications 2
Advanced Security for Systems Engineering VO 05: Advanced Attacks on Applications 2 Clemens Hlauschek, Christian Schanes INSO Industrial Software Institute of Information Systems Engineering Faculty of
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP Alexandros Kapravelos akaprav@ncsu.edu NOEXEC (W^X) 0xFFFFFF Stack Heap BSS Data 0x000000 Code RW RX Deployment Linux (via PaX patches) OpenBSD
Module: Return-oriented Programming. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Return-oriented Programming Professor Trent Jaeger 1 1 Anatomy of Control-Flow Exploits Two steps in control-flow exploitation First -- attacker
The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)
The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) Hovav Shacham hovav@cs.ucsd.edu September 5, 2007 Abstract We present new techniques that allow a urn-into-libc
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
Lecture 08 Control-flow Hijacking Defenses
Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation
Module: Return-oriented Programming. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Return-oriented Programming Professor Trent Jaeger 1 Anatomy of Control-Flow Exploits 2 Anatomy of Control-Flow Exploits Two steps in control-flow
CNIT 127: Exploit Development. Ch 3: Shellcode. Updated
CNIT 127: Exploit Development Ch 3: Shellcode Updated 1-30-17 Topics Protection rings Syscalls Shellcode nasm Assembler ld GNU Linker objdump to see contents of object files strace System Call Tracer Removing
Return oriented programming
Return oriented programming TOOR - Computer Security Hallgrímur H. Gunnarsson Reykjavík University 2012-05-04 Introduction Many countermeasures have been introduced to foil EIP hijacking: W X: Prevent
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
String Oriented Programming Exploring Format String Attacks. Mathias Payer
String Oriented Programming Exploring Format String Attacks Mathias Payer Motivation Additional protection mechanisms prevent many existing attack vectors Format string exploits are often overlooked Drawback:
Function Calls COS 217. Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site)
Function Calls COS 217 Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site) 1 Goals of Today s Lecture Finishing introduction to assembly language o EFLAGS register
Defeating Return-Oriented Rootkits with Return-less Kernels
5 th ACM SIGOPS EuroSys Conference, Paris, France April 15 th, 2010 Defeating Return-Oriented Rootkits with Return-less Kernels Jinku Li, Zhi Wang, Xuxian Jiang, Mike Grace, Sina Bahram Department of Computer
Program Exploitation Intro
Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be
Function Call Convention
Function Call Convention Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch Content Intel Architecture Memory Layout
Università Ca Foscari Venezia
Stack Overflow Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Introduction Buffer overflow is due to careless programming in unsafe languages like C
Selected background on ARM registers, stack layout, and calling convention
Selected background on ARM registers, stack layout, and calling convention ARM Overview ARM stands for Advanced RISC Machine Main application area: Mobile phones, smartphones (Apple iphone, Google Android),
Advanced Buffer Overflow
Pattern Recognition and Applications Lab Advanced Buffer Overflow Ing. Davide Maiorca, Ph.D. davide.maiorca@diee.unica.it Computer Security A.Y. 2016/2017 Department of Electrical and Electronic Engineering
Secure Systems Engineering
Secure Systems Engineering Chester Rebeiro Indian Institute of Technology Madras Flaws that would allow an attacker access the OS flaw Bugs in the OS The Human factor Chester Rebeiro, IITM 2 Program Bugs
Countermeasures in Modern Operating Systems. Yves Younan, Vulnerability Research Team (VRT)
Countermeasures in Modern Operating Systems Yves Younan, Vulnerability Research Team (VRT) Introduction Programs in C/C++: memory error vulnerabilities Countermeasures (mitigations): make exploitation
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it 29.11.2012 Secure Software Engineering Andreas Follner 1 Andreas Follner Graduated earlier
CS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 2 Question 1 Software Vulnerabilities (15 min) For the following code, assume an attacker can control the value of basket passed into eval basket.
Beyond Stack Smashing: Recent Advances in Exploiting. Jonathan Pincus(MSR) and Brandon Baker (MS)
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns Jonathan Pincus(MSR) and Brandon Baker (MS) Buffer Overflows and How they Occur Buffer is a contiguous segment of memory of a fixed
CS642: Computer Security
Low- level soeware vulnerability protecgon mechanisms CS642: Computer Security Professor Ristenpart h9p://www.cs.wisc.edu/~rist/ rist at cs dot wisc dot edu University of Wisconsin CS 642 How can we help
Hacking Blind BROP. Presented by: Brooke Stinnett. Article written by: Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazie`res, Dan Boneh
Hacking Blind BROP Presented by: Brooke Stinnett Article written by: Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazie`res, Dan Boneh Overview Objectives Introduction to BROP ROP recap BROP key phases
2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks
Runtime attacks are major threats to today's applications Control-flow of an application is compromised at runtime Typically, runtime attacks include injection of malicious code Reasons for runtime attacks
20: Exploits and Containment
20: Exploits and Containment Mark Handley Andrea Bittau What is an exploit? Programs contain bugs. These bugs could have security implications (vulnerabilities) An exploit is a tool which exploits a vulnerability
Advanced Buffer Overflow
Pattern Recognition and Applications Lab Advanced Buffer Overflow Ing. Davide Maiorca, Ph.D. davide.maiorca@diee.unica.it Computer Security A.Y. 2017/2018 Department of Electrical and Electronic Engineering
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 1 January 26, 2011 Question 1 Buffer Overflow Mitigations Buffer overflow mitigations generally fall into two categories: (i) eliminating the cause
Assembly Language: Function Calls
Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems: Calling and returning Passing parameters Storing local variables Handling registers without interference
CSE 127 Computer Security
CSE 127 Computer Security Alex Gantman, Spring 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Fall 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on the
Assembly Language: Function Calls" Goals of this Lecture"
Assembly Language: Function Calls" 1 Goals of this Lecture" Help you learn:" Function call problems:" Calling and returning" Passing parameters" Storing local variables" Handling registers without interference"
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Spring 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on
CS 161 Computer Security. Week of January 22, 2018: GDB and x86 assembly
Raluca Popa Spring 2018 CS 161 Computer Security Discussion 1 Week of January 22, 2018: GDB and x86 assembly Objective: Studying memory vulnerabilities requires being able to read assembly and step through
idkwim in SecurityFirst 0x16 years old Linux system security researcher idkwim.tistory.com idkwim.linknow.
idkwim@gmail.com idkwim in SecurityFirst 0x16 years old Linux system security researcher idkwim.tistory.com choicy90@nate.com (Nate-On) @idkwim idkwim.linknow.kr Zombie PC?? -> No! Return Oriented Programming
Software Security: Buffer Overflow Defenses
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Defenses Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Assembly Language: Function Calls" Goals of this Lecture"
Assembly Language: Function Calls" 1 Goals of this Lecture" Help you learn:" Function call problems:" Calling and urning" Passing parameters" Storing local variables" Handling registers without interference"
Security and Privacy in Computer Systems. Lecture 5: Application Program Security
CS 645 Security and Privacy in Computer Systems Lecture 5: Application Program Security Buffer overflow exploits More effective buffer overflow attacks Preventing buffer overflow attacks Announcement Project
Introduction to Reverse Engineering. Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins
Introduction to Reverse Engineering Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins Reverse Engineering (of Software) What is it? What is it for? Binary exploitation (the cool
Assembly Language: Function Calls. Goals of this Lecture. Function Call Problems
Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems: Calling and urning Passing parameters Storing local variables Handling registers without interference Returning
Exercise 6: Buffer Overflow and return-into-libc Attacks
Technische Universität Darmstadt Fachbereich Informatik System Security Lab Prof. Dr.-Ing. Ahmad-Reza Sadeghi M.Sc. David Gens Exercise 6: Buffer Overflow and return-into-libc Attacks Course Secure, Trusted
Lecture 4 CIS 341: COMPILERS
Lecture 4 CIS 341: COMPILERS CIS 341 Announcements HW2: X86lite Available on the course web pages. Due: Weds. Feb. 7 th at midnight Pair-programming project Zdancewic CIS 341: Compilers 2 X86 Schematic
Jump-Oriented Programming: A New Class of Code-Reuse Attack
Jump-Oriented Programming: A New Class of Code-Reuse Attack Tyler Bletsch, Xuxian Jiang, Vince Freeh Department of Computer Science North Carolina State University {tkbletsc, xuxian jiang, vwfreeh}@ncsu.edu
On The Effectiveness of Address-Space Randomization. H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh Stanford University CCS 2004
On The Effectiveness of Address-Space Randomization H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh Stanford University CCS 2004 Code-Injection Attacks Inject malicious executable code
Remix: On-demand Live Randomization
Remix: On-demand Live Randomization Yue Chen, Zhi Wang, David Whalley, Long Lu* Florida State University, Stony Brook University* Background Buffer Overflow -> Code Injection Attack Background Buffer Overflow
Lecture Embedded System Security A. R. Darmstadt, Runtime Attacks
2 ARM stands for Advanced RISC Machine Application area: Embedded systems Mobile phones, smartphones (Apple iphone, Google Android), music players, tablets, and some netbooks Advantage: Low power consumption
Smashing the Buffer. Miroslav Štampar
Smashing the Buffer Miroslav Štampar (mstampar@zsis.hr) Summary BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 2 Buffer overflow (a.k.a.) Buffer overrun An anomaly where a program, while writing
Software Security: Buffer Overflow Attacks
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks (continued) Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Writing Exploits. Nethemba s.r.o.
Writing Exploits Nethemba s.r.o. norbert.szetei@nethemba.com Motivation Basic code injection W^X (DEP), ASLR, Canary (Armoring) Return Oriented Programming (ROP) Tools of the Trade Metasploit A Brief History
ISA564 SECURITY LAB. Shellcode. George Mason University
ISA564 SECURITY LAB Shellcode George Mason University Outline Shellcode Basics Advanced Shellcode What is shellcode? Machine code used as the payload in the exploitation of a software bug Whenever altering
Stephen Checkoway, Lucas Davi, Alexandra Dmitrienko, Ahmad-Reza Sadeghi, Hovav Shacham, Marcel Winandy. ACM CCS 2010, Chicago, USA
Stephen Checkoway, Lucas Davi, Alexandra Dmitrienko, Ahmad-Reza Sadeghi, Hovav Shacham, Marcel Winandy ACM CCS 2010, Chicago, USA Ad hoc defense against code injection: W X DEP Code injection unnecessary
CS241 Computer Organization Spring 2015 IA
CS241 Computer Organization Spring 2015 IA-32 2-10 2015 Outline! Review HW#3 and Quiz#1! More on Assembly (IA32) move instruction (mov) memory address computation arithmetic & logic instructions (add,
CS429: Computer Organization and Architecture
CS429: Computer Organization and Architecture Warren Hunt, Jr. and Bill Young Department of Computer Sciences University of Texas at Austin Last updated: October 1, 2014 at 12:03 CS429 Slideset 6: 1 Topics
Low-Level Essentials for Understanding Security Problems Aurélien Francillon
Low-Level Essentials for Understanding Security Problems Aurélien Francillon francill@eurecom.fr Computer Architecture The modern computer architecture is based on Von Neumann Two main parts: CPU (Central
Secure Programming Lecture 6: Memory Corruption IV (Countermeasures)
Secure Programming Lecture 6: Memory Corruption IV (Countermeasures) David Aspinall, Informatics @ Edinburgh 2nd February 2016 Outline Announcement Recap Containment and curtailment Tamper detection Memory
CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08
CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 21: Generating Pentium Code 10 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Simple Code Generation Three-address code makes it
Outline. Heap meta-data. Non-control data overwrite
Outline CSci 5271 Introduction to Computer Security Day 5: Low-level defenses and counterattacks Stephen McCamant University of Minnesota, Computer Science & Engineering Non-control data overwrite Heap
The first Secure Programming Laboratory will be today! 3pm-6pm in Forrest Hill labs 1.B31, 1.B32.
Lab session this afternoon Memory corruption attacks Secure Programming Lecture 6: Memory Corruption IV (Countermeasures) David Aspinall, Informatics @ Edinburgh 2nd February 2016 The first Secure Programming
Return-Oriented Rootkits
Return-Oriented Rootkits Ralf Hund Troopers March 10, 2010 What is Return-Oriented Programming? New emerging attack technique, pretty hyped topic Gained awareness in 2007 in Hovav Shacham s paper The Geometry
Intro to x86 Binaries. From ASM to exploit
Intro to x86 Binaries From ASM to exploit Intro to x86 Binaries I lied lets do a quick ctf team thing Organization Ideas? Do we need to a real structure right now? Mailing list is OTW How do we get more
Procedure Calls. Young W. Lim Sat. Young W. Lim Procedure Calls Sat 1 / 27
Procedure Calls Young W. Lim 2016-11-05 Sat Young W. Lim Procedure Calls 2016-11-05 Sat 1 / 27 Outline 1 Introduction References Stack Background Transferring Control Register Usage Conventions Procedure
Biography. Background
From Over ow to Shell An Introduction to low-level exploitation Carl Svensson @ KTH, January 2019 1 / 28 Biography MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail: calle.svensson@zeta-two.com
Exploits and gdb. Tutorial 5
Exploits and gdb Tutorial 5 Exploits and gdb 1. Buffer Vulnerabilities 2. Code Injection 3. Integer Attacks 4. Advanced Exploitation 5. GNU Debugger (gdb) Buffer Vulnerabilities Basic Idea Overflow or
CSE 127: Computer Security. Memory Integrity. Kirill Levchenko
CSE 127: Computer Security Memory Integrity Kirill Levchenko November 18, 2014 Stack Buffer Overflow Stack buffer overflow: writing past end of a stackallocated buffer Also called stack smashing One of
Outline. Format string attack layout. Null pointer dereference
CSci 5271 Introduction to Computer Security Day 5: Low-level defenses and counterattacks Stephen McCamant University of Minnesota, Computer Science & Engineering Null pointer dereference Format string
OpenBSD Remote Exploit
OpenBSD Remote Exploit Only two remote holes in the default install Alfredo A. Ortega June 30, 2007 Mbuf buffer overflow Buffer overflow Researching the OpenBSD 008: RELIABILITY FIX a new vulnerability
Is stack overflow still a problem?
Morris Worm (1998) Code Red (2001) Secure Programming Lecture 4: Memory Corruption II (Stack Overflows) David Aspinall, Informatics @ Edinburgh 31st January 2017 Memory corruption Buffer overflow remains
Betriebssysteme und Sicherheit Sicherheit. Buffer Overflows
Betriebssysteme und Sicherheit Sicherheit Buffer Overflows Software Vulnerabilities Implementation error Input validation Attacker-supplied input can lead to Corruption Code execution... Even remote exploitation
Introduction to Operating Systems Prof. Chester Rebeiro Department of Computer Science and Engineering Indian Institute of Technology, Madras
Introduction to Operating Systems Prof. Chester Rebeiro Department of Computer Science and Engineering Indian Institute of Technology, Madras Week 08 Lecture 38 Preventing Buffer Overflow Attacks Hello.
Defense against Code-injection, and Code-reuse Attack
Operating Systems Security Defense against Code-injection, and Code-reuse Attack Computer Security & OS lab. Cho, Seong-je ( 조성제 ) sjcho at dankook.ac.kr Fall, 2018 Contents Buffer Overflows: Stack Smashing,
Process Layout and Function Calls
Process Layout and Function Calls CS 6 Spring 07 / 8 Process Layout in Memory Stack grows towards decreasing addresses. is initialized at run-time. Heap grow towards increasing addresses. is initialized
Turning C into Object Code Code in files p1.c p2.c Compile with command: gcc -O p1.c p2.c -o p Use optimizations (-O) Put resulting binary in file p
Turning C into Object Code Code in files p1.c p2.c Compile with command: gcc -O p1.c p2.c -o p Use optimizations (-O) Put resulting binary in file p text C program (p1.c p2.c) Compiler (gcc -S) text Asm
From Over ow to Shell
From Over ow to Shell An Introduction to low-level exploitation Carl Svensson @ Google, December 2018 1 / 25 Biography MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail:
Return Oriented Programming
ROP gadgets Small instruction sequence ending with a ret instruction 0xc3 Gadgets are found in existing, resident code and libraries There exist tools to search for and find gadgets Gadgets are put together
CSE 509: Computer Security
CSE 509: Computer Security Date: 2.16.2009 BUFFER OVERFLOWS: input data Server running a daemon Attacker Code The attacker sends data to the daemon process running at the server side and could thus trigger
Procedure Calls. Young W. Lim Mon. Young W. Lim Procedure Calls Mon 1 / 29
Procedure Calls Young W. Lim 2017-08-21 Mon Young W. Lim Procedure Calls 2017-08-21 Mon 1 / 29 Outline 1 Introduction Based on Stack Background Transferring Control Register Usage Conventions Procedure
Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998
Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998 Assembler Syntax Everything looks like this: label: instruction dest,src instruction label Comments: comment $ This is a comment
Defeat Exploit Mitigation Heap Attacks. compass-security.com 1
Defeat Exploit Mitigation Heap Attacks compass-security.com 1 ASCII Armor Arbitrary Write Overflow Local Vars Exploit Mitigations Stack Canary ASLR PIE Heap Overflows Brute Force Partial RIP Overwrite
Software Security II: Memory Errors - Attacks & Defenses
1 Software Security II: Memory Errors - Attacks & Defenses Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab1 Writeup 3 Buffer overflow Out-of-bound memory writes (mostly sequential) Allow
Second Part of the Course
CSC 2400: Computer Systems Towards the Hardware 1 Second Part of the Course Toward the hardware High-level language (C) assembly language machine language (IA-32) 2 High-Level Language g Make programming
18-600: Recitation #4 Exploits
18-600: Recitation #4 Exploits 20th September 2016 Agenda More x86-64 assembly Buffer Overflow Attack Return Oriented Programming Attack 3 Recap: x86-64: Register Conventions Arguments passed in registers:
X86 Review Process Layout, ISA, etc. CS642: Computer Security. Drew Davidson
X86 Review Process Layout, ISA, etc. CS642: Computer Security Drew Davidson davidson@cs.wisc.edu From Last Time ACL-based permissions (UNIX style) Read, Write, execute can be restricted on users and groups
On Compilers, Memory Errors and Control-Flow Integrity
On Compilers, Memory Errors and Control-Flow Integrity Advanced Compiler Design SS 2015 Antonio Hüseyin Barresi Zürich, 27.5.2015 CVE-2012-0158 is a buffer overflow Vulnerability in the ListView / TreeView
Software Vulnerabilities August 31, 2011 / CS261 Computer Security
Software Vulnerabilities August 31, 2011 / CS261 Computer Security Software Vulnerabilities...1 Review paper discussion...2 Trampolining...2 Heap smashing...2 malloc/free...2 Double freeing...4 Defenses...5
SYSTEM CALL IMPLEMENTATION. CS124 Operating Systems Fall , Lecture 14
SYSTEM CALL IMPLEMENTATION CS124 Operating Systems Fall 2017-2018, Lecture 14 2 User Processes and System Calls Previously stated that user applications interact with the kernel via system calls Typically
x86 assembly CS449 Fall 2017
x86 assembly CS449 Fall 2017 x86 is a CISC CISC (Complex Instruction Set Computer) e.g. x86 Hundreds of (complex) instructions Only a handful of registers RISC (Reduced Instruction Set Computer) e.g. MIPS
CNIT 127: Exploit Development. Ch 14: Protection Mechanisms. Updated
CNIT 127: Exploit Development Ch 14: Protection Mechanisms Updated 3-25-17 Topics Non-Executable Stack W^X (Either Writable or Executable Memory) Stack Data Protection Canaries Ideal Stack Layout AAAS:
Inject malicious code Call any library functions Modify the original code
Inject malicious code Call any library functions Modify the original code 2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks 2 3 Sadeghi, Davi TU Darmstadt
Q: Exploit Hardening Made Easy
Q: Exploit Hardening Made Easy E.J. Schwartz, T. Avgerinos, and D. Brumley. In Proc. USENIX Security Symposium, 2011. CS 6301-002: Language-based Security Dr. Kevin Hamlen Attacker s Dilemma Problem Scenario