U23 - Binary Exploitation

Transcription

1 U23 - Binary Exploitation Stratum Auhuur robbje@aachen.ccc.de November 21, 2016

2 Context OS: Linux

3 Context OS: Linux CPU: x86 (32 bit)

4 Context OS: Linux CPU: x86 (32 bit) Address Space Layout Randomization: off No execution: off Stack cookies: off

5 From source code to binary *.c *.s *.o Compiler Assembler Linker

6 From source code to binary *.c *.s *.o Compiler Assembler Linker 1. $ gcc -S test.c -o test.s

7 From source code to binary *.c *.s *.o Compiler Assembler Linker 1. $ gcc -S test.c -o test.s 2. $ gcc -c test.s -o test.o

8 From source code to binary *.c *.s *.o Compiler Assembler Linker 1. $ gcc -S test.c -o test.s 2. $ gcc -c test.s -o test.o 3. $ gcc test.o -o test

9 From source code to binary *.c *.s *.o Compiler Assembler Linker 1. $ gcc -S test.c -o test.s 2. $ gcc -c test.s -o test.o 3. $ gcc test.o -o test (There s also a preprocessor stage...)

10 Memory layout: Flat memory model Userspace (3GB): 0x = 0xbfffffff Kernelspace (1GB): 0xc = 0xffffffff Every program has this address space available

11 A binary is loaded into memory....text.rodata.bss [stack] Stack grows to low addresses!

12 A binary is loaded into memory....text.rodata.bss [stack] Stack grows to low addresses!

13 Demo of readelf

14 Functions Func A Func B Func C calls We can call functions and they return

15 Functions Func A Func B Func C calls returns calls We can call functions and they return

16 Functions Func A Func B Func C calls returns calls returns We can call functions and they return

17 Functions 2 Func A Func B Func C calls calls returns returns

18 Functions 2 Func A Func B Func C calls calls returns returns How does the CPU know where to return to?

19 The Stack layout Environment

20 The Stack layout Cmdline args Environment

21 The Stack layout EntryFn Frame Cmdline args Environment

22 The Stack layout Return addr ESP EBP EntryFn Frame Cmdline args Environment

23 The Stack layout Local vars Saved EBP Return addr ESP EBP EntryFn Frame Cmdline args Environment

24 Demo of gdb

25 CPU Registers: dumbed down Stack related: ESP, EBP

26 CPU Registers: dumbed down Stack related: ESP, EBP Instruction Pointer: EIP

27 CPU Registers: dumbed down Stack related: ESP, EBP Instruction Pointer: EIP More or less multi-purpose: EAX, EBX, ECX, EDX, ESI, EDI

28 CPU Registers: dumbed down Stack related: ESP, EBP Instruction Pointer: EIP More or less multi-purpose: EAX, EBX, ECX, EDX, ESI, EDI EAX

29 CPU Registers: dumbed down Stack related: ESP, EBP Instruction Pointer: EIP More or less multi-purpose: EAX, EBX, ECX, EDX, ESI, EDI EAX AX

30 CPU Registers: dumbed down Stack related: ESP, EBP Instruction Pointer: EIP More or less multi-purpose: EAX, EBX, ECX, EDX, ESI, EDI EAX AX AH AL

31 String and memory copy operations void *memcpy(void *dest, const void *src, size t n);

32 String and memory copy operations void *memcpy(void *dest, const void *src, size t n); char *strcpy(char *dest, const char *src);

33 String and memory copy operations void *memcpy(void *dest, const void *src, size t n); char *strcpy(char *dest, const char *src); char *strncpy(char *dest, const char *src, size t n);

34 String and memory copy operations void *memcpy(void *dest, const void *src, size t n); char *strcpy(char *dest, const char *src); char *strncpy(char *dest, const char *src, size t n); memmove, bcopy, memccpy, etc...

35 String and memory copy operations void *memcpy(void *dest, const void *src, size t n); char *strcpy(char *dest, const char *src); char *strncpy(char *dest, const char *src, size t n); memmove, bcopy, memccpy, etc... gets, fgets, read, fread (files, network)

36 String and memory copy operations void *memcpy(void *dest, const void *src, size t n); char *strcpy(char *dest, const char *src); char *strncpy(char *dest, const char *src, size t n); memmove, bcopy, memccpy, etc... gets, fgets, read, fread (files, network) rep movsb,... (from [%esi] to [%edi], %ecx bytes)

37 Stack growth vs copy operations memcpy, strcpy, strncpy,... Local vars Saved EBP Return addr ESP EBP EntryFn Frame Cmdline args Environment

38 pwn demo

39 Pwning Check /u23/pwn for sources and binaries Use gdb and reproduce my exploit Use the shellcode provided and try to execute it instead Pwn sob2 (advanced)