Martin Brunner, Jonas Pfoh Sept. 6, Sept. 24, 2010

Transcription

1 Martin Brunner, Jonas Pfoh IT Security Lab Technische Universität München Munich, Germany Sept. 6, Sept. 24, 2010

2 Outline

3 Welcome Goal: Build a tool that will recognize shellcode within packets. You will learn: 1 the layout and formation of IP packets 2 programming with the pcap library 3 what shellcode is and how it works 4 how shellcode can be recognized

4 Welcome Goal: Build a tool that will recognize shellcode within packets. You will learn: 1 the layout and formation of IP packets 2 programming with the pcap library 3 what shellcode is and how it works 4 how shellcode can be recognized

5 Curriculum Sept. 6 -, Course requirements, introduction, Milestone 1 assigned Sept Work on Milestone 1 Sept. 9 - Milestone 1 due, Milestone 2 assigned Sept Work on Milestone 2 Sept Milestone 2 due, to buffer overflows, shellcode, & shellcode detection, Milestone 3 & 4 assigned Sept Work on Milestone 3 & 4 Sept Milestone 3 due Sept Work on Milestone 4 Sept Milestone 4 due, Final demonstration

6 Curriculum Sept. 6 -, Course requirements, introduction, Milestone 1 assigned Sept Work on Milestone 1 Sept. 9 - Milestone 1 due, Milestone 2 assigned Sept Work on Milestone 2 Sept Milestone 2 due, to buffer overflows, shellcode, & shellcode detection, Milestone 3 & 4 assigned Sept Work on Milestone 3 & 4 Sept Milestone 3 due Sept Work on Milestone 4 Sept Milestone 4 due, Final demonstration

7 Curriculum Sept. 6 -, Course requirements, introduction, Milestone 1 assigned Sept Work on Milestone 1 Sept. 9 - Milestone 1 due, Milestone 2 assigned Sept Work on Milestone 2 Sept Milestone 2 due, to buffer overflows, shellcode, & shellcode detection, Milestone 3 & 4 assigned Sept Work on Milestone 3 & 4 Sept Milestone 3 due Sept Work on Milestone 4 Sept Milestone 4 due, Final demonstration

8 Curriculum Sept. 6 -, Course requirements, introduction, Milestone 1 assigned Sept Work on Milestone 1 Sept. 9 - Milestone 1 due, Milestone 2 assigned Sept Work on Milestone 2 Sept Milestone 2 due, to buffer overflows, shellcode, & shellcode detection, Milestone 3 & 4 assigned Sept Work on Milestone 3 & 4 Sept Milestone 3 due Sept Work on Milestone 4 Sept Milestone 4 due, Final demonstration

9 Milestones 1 tcpdump clone () 2 Simple signature detector (extend MS 1) page write-up explaining and defending your approach to shellcode detection 4 Shellcode detection tool (extend MS 2)

10 All programming milestones... must be done in C. must include a makefile and compile with make all. must compile on the workstations in the lab. must make use of the library.

11 All programming milestones... must be done in C. must include a makefile and compile with make all. must compile on the workstations in the lab. must make use of the library.

12 All programming milestones... must be done in C. must include a makefile and compile with make all. must compile on the workstations in the lab. must make use of the library.

13 All programming milestones... must be done in C. must include a makefile and compile with make all. must compile on the workstations in the lab. must make use of the library.

14 make & Makefiles What is make? What is a Makefile?

15 make & Makefiles What is make? make is a program that looks for a Makefile in the current working directory and compiles a program based on this Makefile. What is a Makefile?

16 make & Makefiles What is make? make is a program that looks for a Makefile in the current working directory and compiles a program based on this Makefile. What is a Makefile? A Makefile is a file that generally resides in the top-level directory of your source code and specifies how the program should be compiled.

17 Makefile CC=gcc CFLAGS= c Wall g LDFLAGS= g lpcap OBJS=pack. o a l l : pack Listing 1: Makefile pack : %.o : clean : ${OBJS} ${CC} ${LDFLAGS} ${OBJS} o $@ %.c ${CC} ${CFLAGS} $< rm r f. o pack Key: $@ = target, $< = dependencies, % = match Use: make all

18 Makefile CC=gcc CFLAGS= c Wall g LDFLAGS= g lpcap OBJS=pack. o a l l : pack Listing 2: Makefile pack : %.o : clean : ${OBJS} ${CC} ${LDFLAGS} ${OBJS} o $@ %.c ${CC} ${CFLAGS} $< rm r f. o pack Key: $@ = target, $< = dependencies, % = match Use: make all

19 getopt parser Use getopt 1 to parse commandline arguments! Important details: must include unistd.h char * optarg - the option argument (if required) int optopt - stores option char in case of error. int optind - stores index on next element in argv to be processed. int getopt (int argc, char **argv, const char *options) - returns the next option character (? on error) and stores the argument in optarg. Options are passed as single characters optionally followed by : if they require an argument or :: if they have an optional argument. 1 node/getopt.html

20 getopt parser - example a f l a g = 0 ; w h i l e ( ( c = g e t o p t ( argc, argv, ab : ) )!= 1){ s w i t c h ( c ) { c a s e a : a f l a g = 1 ; break ; c a s e b : bvalue = optarg ; break ; c a s e? : i f ( o p t o p t == b ) f p r i n t f ( s t d e r r, Option %c r e q u i r e s an argument.\ n, o p t o p t ) ; e l s e i f ( i s p r i n t ( o p t o p t ) ) f p r i n t f ( s t d e r r, Unknown o p t i o n %c. \ n, o p t o p t ) ; e l s e f p r i n t f ( s t d e r r, Unknown o p t i o n c h a r a c t e r \\ x%x. \ n, o p t o p t ) ; r e t u r n 1 ; d e f a u l t : a b o r t ( ) ; } } p r i n t f ( a f l a g = %d, b v a l u e = %s\n, a f l a g, b v a l u e ) ; f o r ( index = optind ; index < argc ; index++) p r i n t f ( Non o p t i o n argument %s\n, a r g v [ i n d e x ] ) ;

21 Debugging Don t rely on printf, debuggers are your friend! Learn to use them. Recommendations: gdb - traditional/powerful commandline debugger ddd - front-end GUI for gdb, nice for beginners valgrind - excellent for tracking down causes of segfaults and debugging memory leaks

22 Ethernet (Layer 2 - Data Link) Common Ether Types: IPv4 (0x0800) IPv6 (0x86DD) ARP (0x0806) 2 2

23 IPv4 (Layer 3 - Network) serial communication/ip-header-v4.png

24 TCP (Layer 4 - Transport) header.png

25 UDP (Layer 4 - Transport) 5 Length refers to length of entire datagram in bytes. 5

26 ICMP (Layer 4 - Transport) 6 6

27 Network Byte Order What is byte order (or endianness)?

28 Network Byte Order What is byte order (or endianness)? The order in which bytes are stored within a system. What is the byte order used in IP? in x86?

29 Network Byte Order What is byte order (or endianness)? The order in which bytes are stored within a system. What is the byte order used in IP? in x86? IP = big endian byte order, x86 = little endian byte order How do we solve this problem?

30 Network Byte Order What is byte order (or endianness)? The order in which bytes are stored within a system. What is the byte order used in IP? in x86? IP = big endian byte order, x86 = little endian byte order How do we solve this problem? htons(), htonl(), ntohs(), ntohl() (include netinet/in.h )

31 Usage 1 Open source (device or file) pcap open offline pcap open live 2 Set filter pcap lookupnet pcap compile pcap setfilter 3 Set callback function pcap loop 4 Handle incoming packets 5 Close Source pcap close

32 Usage 1 Open source (device or file) pcap open offline pcap open live 2 Set filter pcap lookupnet pcap compile pcap setfilter 3 Set callback function pcap loop 4 Handle incoming packets 5 Close Source pcap close

33 Usage 1 Open source (device or file) pcap open offline pcap open live 2 Set filter pcap lookupnet pcap compile pcap setfilter 3 Set callback function pcap loop 4 Handle incoming packets 5 Close Source pcap close

34 Usage 1 Open source (device or file) pcap open offline pcap open live 2 Set filter pcap lookupnet pcap compile pcap setfilter 3 Set callback function pcap loop 4 Handle incoming packets 5 Close Source pcap close

35 Usage 1 Open source (device or file) pcap open offline pcap open live 2 Set filter pcap lookupnet pcap compile pcap setfilter 3 Set callback function pcap loop 4 Handle incoming packets 5 Close Source pcap close

36 Hints Include pcap.h and compile with -lpcap Protocol header structs already exist for the most part in various headers Read: Hakin9LuisMartinGarcia.pdf Use man page as reference (

37 1 getopt 1 Using-Getopt.html (read) (read) 2 Hakin9LuisMartinGarcia.pdf (read) 3 (ref) 3 Buffer Overflows/Shellcode 1 pdf (read) how-to-create-polymorphic-shellcode (read) 3 (read)