Leveraging CVE for ASLR Bypass & RCE. Gal De Leon & Nadav Markus
|
|
|
- Lilian Thompson
- 5 years ago
- Views:
Transcription
1 Leveraging CVE for ASLR Bypass & RCE Gal De Leon & Nadav Markus 1
2 Who We Are Nadav Markus, Gal De-Leon Security PaloAltoNetworks Vulnerability research and exploitation Reverse engineering Traps exploits mitigation research Security enthusiasts 2
3 Introduction Vulnerability in glibc Discovered by Google, patched at 16-feb-2016 Released crash-poc This presentation is about exploitation strategy 3
4 getaddrinfo() A function used to resolve a hostname to IP-address(es) OUT-addressinfo* is later used for connect() or bind() Performs DNS queries Stack-overflow vulnerability was found, handling DNS-replies Given node and service, which identify an Internet host and a service, getaddrinfo() returns one or more addrinfo structures, each of which contains an Internet address that can be specified in a call to bind(2) or connect(2). 4
5 getaddrinfo() struct addrinfo -> ai_family AF_INET, AF_INET6, AF_UNSPEC AF_UNSPEC indicates any address family is valid, IPv4 or IPv6 IPv4=A, IPv6=AAAA This is the common usecase int getaddrinfo(const char *node, const char *service, const struct addrinfo *hints, struct addrinfo **res); 5
6 The Bug dns-query A & AAAA over UDP Victim Attacker calls glibc s getaddrinfo() alloca(2048) _nss_dns_gethostbyname4_r(..) { host_buffer.buf = orig_host_buffer = (querybuf *) alloca (2048); 6
7 The Bug dns-reply FLAGS=TRUNCATED, \xaa *2500 Victim _alloca() buffer isn t sufficient malloc(maxpacket) instead (MAXPACKET=0x10000) Attacker If the answer section of the response is truncated and if the requester supports TCP, it SHOULD try the query again using TCP. (RFC-DNS) 7
8 The Bug dns-query A & AAAA over TCP Victim Attacker 8
9 The Bug A valid dns-reply Victim Attacker reuses the malloced buffer 9
10 The Bug A valid dns-reply AAAA malformed dns-reply Victim Attacker Mismatch between the stack and the heap buffer! If AAAA dns-response s size is greater than 2048, we smash the stack! 10
11 DEP & ASLR Unable to exploit reliably without bypassing DEP & ASLR We can set RIP to anywhere, but where to? How to ROP? original buffer retaddress Overflow... RET ; pop, jmp
12 ASLR Bypass Techniques Non PIE executables Read memory vulnerability Spray (without DEP) Can t get reliable address at 64 bit.. How about guessing? 12
13 fork() Standard way of creating processes in UNIX Child process inherits: Memory Layout (includes loaded modules ) Registers state Stack pid = fork(); if (0 < pid) { /* Parent code goes here... */ } else if (0 == pid) { /* Child code goes here... */ } 13
14 Reply Arbitrary DNS Assume attacker can answer arbitrary DNS requests Acquiring the domain Local Arp Poisoning Any other way.. 14
15 Victim Trigger fork() Attacker
16 fork() Victim child-process (PID=3312): Attacker
17 fork() Victim dns-queries child-process (PID=3312): C CALL getaddrinfo test eax, eax Attacker
18 fork() Victim malicious dns-replies child-process (PID=3312): C CALL getaddrinfo OVERFLOW RIP=0x INVALID-OPCODE CRASH! test eax, eax Attacker
19 Victim Trigger fork() Attacker
20 fork() Victim dns-queries child-process (PID=3313): C CALL getaddrinfo test eax, eax Attacker
21 fork() Victim malicious dns-replies child-process (PID=3313): C CALL getaddrinfo OVERFLOW RIP=0x test eax, eax Attacker
22 fork() Victim 0x is the correct address! child-process (PID=3313): C CALL getaddrinfo OVERFLOW RIP=0x test eax, eax connect() TCP syn Attacker
23 Exploit Strategy We can enumerate all possible addresses ~2 ^ 64 Not feasible 23
24 Byte by Byte Approach Instead of overwriting RIP entirely, we can overwrite just a portion of it Remaining bytes are of the original address CALL getaddrinfo() Original RIP = 0x Overwritten RIP = 0x DNS request-response (malformed) AAAAA..AAA../x00 Attacker Original RIP Overwritten RIP LSB MSB 24
25 Byte by Byte Approach Return Address Sent Buffer 0x AAA...0x00 0x AAA...0x01 0x x AAA...0x12 0x AAA0x12 0x00 0x AAA0x12 0x01 0x x AAA0x12 0x10. Response? NO NO NO YES NO NO NO YES 8 *
26 Finding Potentially Exploitable Applications fork() && getaddrinfo() Using the correct flow Indexes source code of ~18,000 packages ~1,300 potential exploitable apps 26
27 Finding Potentially Exploitable Applications 914 xtrace 915 openbgpd 916 balsa 917 tinyproxy 918 powerman 919 mahimahi 920 pcs 921 eric 922 ruby-pg 923 nut 924 gnulib 27
28 28
29 Finding Potentially Exploitable Applications 914 xtrace 915 openbgpd 916 balsa 917 tinyproxy 918 powerman 919 mahimahi 920 pcs 921 eric 922 ruby-pg 923 nut 924 gnulib 29
30 tinyproxy child process fork() dns-query A & AAAA somewhere.com CONNECT DNS server HTTP request (tcp-syn 80) Tinyproxy user 1. CONNECT is used to trigger fork() remotely 2. http-request is used as an indication of success 30
31 Game Over? 31
32 Is RIP Really Controlled? So let s enumerate getaddrinfo s return address But we crash Local-variables are overridden Some are pointers.. So let s leak them Stack buffer Local variable Local variable Local variable Local variable Frame pointer Return address 32
33 Segfault (1st) RBX originally points the stack We can leak this address too! Address pointed by RBX only has to be writeable Flow is not effected 33
34 Leak RBX (arbitrary stack address) (/proc/pid/maps) limit base length 0x7ffd x7ffd078a3000 0x x0 [stack] 0x7ffd079f0000 0x7ffd079f2000 0x2000 0x0 [vvar] 0x7ffd078a3000 AA A FD 7F Stack We cannot leak lower 12 bits, since anything will do Stack size is greater than 0x1000 0x7ffd
35 Segfault (2 nd ) RDI is controlled (hostbuffer.buf) R14 is the original alloca() buffer free(rdi) if not equal Abort crash... host_buffer.buf = orig_host_buffer = (querybuf *) alloca (2048);... /* might malloc host_buffer.buf */ if (host_buffer.buf!= orig_host_buffer) free (host_buffer.buf);... return status; We don t get to overwrite RIP.. How to predict R14 value? 35
36 Stack is Identical for Different fork()s tinyproxy daemon fork() fork() fork() child child child orig_host_buffer = alloca(2048); 0x7ffd078a3080 orig_host_buffer = alloca(2048); 0x7ffd078a3080 orig_host_buffer = alloca(2048); 0x7ffd078a
37 Precise Pointers Stack is identical in different forks host_buffer.buf PTR is the same in all executions Use constant offset from... host_buffer.buf = orig_host_buffer = (querybuf *) alloca (2048);... /* might malloc host_buffer.buf */ if (host_buffer.buf!= orig_host_buffer) free (host_buffer.buf);... return status; stack base! 37
38 Leak Stack Base Use 1th crash (mov [rbx], sil) Use leaked arbitrary stack address as a starting point Add 0x1000 offset at a time rbx Sent Buffer 0x00007fffed AAA...0x00 0x00 0x00 0xed 0xff 0x7f 0x00007fffed AAA...0x00 0x10 0x00 0xed 0xff 0x7f 0x00007fffed AAA...0x00 0x20 0x00 0xed 0xff 0x7f 0x00007fffed AAA...0x00 0x30 0x00 0xed 0xff 0x7f 0x00007fffed AAA...0x00 0x40 0x00 0xed 0xff 0x7f 0x00007fffed AAA...0x00 0x50 0x00 0xed 0xff 0x7f 0x00007fffed AAA...0x00 0x60 0x00 0xed 0xff 0x7f 0x00007fffed AAA...0x00 0x70 0x00 0xed 0xff 0x7f 0x00007fffed AAA...0x00 0x80 0x00 0xed 0xff 0x7f Response? YES YES YES YES YES YES YES YES NO 38
39 Game Over? Leaked => 0x400 is constant offset => 0xaa0000 0xa9fc00 (-0x400) 0xa9f500 (-0xb00) 0xa9f4f8 (-0xb08) 0xa9f400 (-0xc00) 0xa9f3f8 (-0xc08) Stack base orig_host_buffer Local variable Local variable Frame pointer Return address 39
40 Offset from Stack-Base is Constant? /arch/x86/kernel/process.c unsigned long arch_align_stack(unsigned long sp) { if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) sp -= get_random_int() % 8192; return sp & ~0xf; } 40
41 Leak libc base (for fun & gadgets) Gain control over RIP (leak all local variables in the way ) Leak getaddrinfo() s return address ( 0 ) glibc start => Get libc s base address Constant offset from ret address! glibc module ROP (ret2libc) (+0xaabbcc ) return address => 41
42 libc Version? Different offset for different versions We don t know what the version is So we just enumerate ( 0 ) glibc start => ( 0 ) glibc start => (+0xaabbcc ) return address => glibc module (+0x998877) return address => glibc module... 42
43 Complete Exploitation Flow Leak arbitrary stack pointer ( 1st segfault => rbx) Leak stack base Leak random stack offset (for precise stack variables) Leak getaddrinfo() s return address Enumerate ret2libc offsets, until successfully exploited 43
44 Demo 44
45 Conclusion Security Mitigations Bypass by abusing OS features ( fork syscall ) This technique can be used with other server vulnerabilities How to protect? Use Palo Alto Networks security platform Patch libc! 45
46 Questions? 46
Defeat Exploit Mitigation Heap Attacks. compass-security.com 1
Defeat Exploit Mitigation Heap Attacks compass-security.com 1 ASCII Armor Arbitrary Write Overflow Local Vars Exploit Mitigations Stack Canary ASLR PIE Heap Overflows Brute Force Partial RIP Overwrite
Lecture 08 Control-flow Hijacking Defenses
Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation
Smashing the Buffer. Miroslav Štampar
Smashing the Buffer Miroslav Štampar (mstampar@zsis.hr) Summary BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 2 Buffer overflow (a.k.a.) Buffer overrun An anomaly where a program, while writing
Return-orientated Programming
Return-orientated Programming or The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) Hovav Shacham, CCS '07 Return-Oriented oriented Programming programming
CS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 2 Question 1 Software Vulnerabilities (15 min) For the following code, assume an attacker can control the value of basket passed into eval basket.
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES CMSC 414 FEB 01 2018 RECALL OUR CHALLENGES How can we make these even more difficult? Putting code into the memory (no zeroes) Finding the return address (guess
CSE 509: Computer Security
CSE 509: Computer Security Date: 2.16.2009 BUFFER OVERFLOWS: input data Server running a daemon Attacker Code The attacker sends data to the daemon process running at the server side and could thus trigger
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 1 January 26, 2011 Question 1 Buffer Overflow Mitigations Buffer overflow mitigations generally fall into two categories: (i) eliminating the cause
Exploring CVE , a Skeleton key in DNS. Jaime Cochran, Marek Vavrusa
Exploring CVE-2015-7547, a Skeleton key in DNS Jaime Cochran, Marek Vavrusa What is this about? Vulnerability in glibc DNS clients Similar to CVE-2015-0235 GHOST 2015-07-13 reported 2016-02-16 disclosed
String Oriented Programming Exploring Format String Attacks. Mathias Payer
String Oriented Programming Exploring Format String Attacks Mathias Payer Motivation Additional protection mechanisms prevent many existing attack vectors Format string exploits are often overlooked Drawback:
CSE 127: Computer Security Control Flow Hijacking. Kirill Levchenko
CSE 127: Computer Security Control Flow Hijacking Kirill Levchenko October 17, 2017 Control Flow Hijacking Defenses Avoid unsafe functions Stack canary Separate control stack Address Space Layout Randomization
Security Workshop HTS. LSE Team. February 3rd, 2016 EPITA / 40
Security Workshop HTS LSE Team EPITA 2018 February 3rd, 2016 1 / 40 Introduction What is this talk about? Presentation of some basic memory corruption bugs Presentation of some simple protections Writing
Applications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it 29.11.2012 Secure Software Engineering Andreas Follner 1 Andreas Follner Graduated earlier
CSE 333 Section 8 - Client-Side Networking
CSE 333 Section 8 - Client-Side Networking Welcome back to section! We re glad that you re here :) Networking Quick Review What are the following protocols used for? (bonus: what layer of the networking
Writing Exploits. Nethemba s.r.o.
Writing Exploits Nethemba s.r.o. norbert.szetei@nethemba.com Motivation Basic code injection W^X (DEP), ASLR, Canary (Armoring) Return Oriented Programming (ROP) Tools of the Trade Metasploit A Brief History
CSE 127 Computer Security
CSE 127 Computer Security Alex Gantman, Spring 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on
SA30228 / CVE
Generated by Secunia 29 May, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Tested Versions 5 Fixed Versions 5 References 5 Generated by Secunia 29 May,
CSC 405 Computer Security Stack Canaries & ASLR
CSC 405 Computer Security Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer overflow defenses
This time. Defenses and other memory safety vulnerabilities. Everything you ve always wanted to know about gdb but were too afraid to ask
This time We will continue Buffer overflows By looking at Overflow Defenses and other memory safety vulnerabilities Everything you ve always wanted to know about gdb but were too afraid to ask Overflow
Module: Return-oriented Programming. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Return-oriented Programming Professor Trent Jaeger 1 Anatomy of Control-Flow Exploits 2 Anatomy of Control-Flow Exploits Two steps in control-flow
20: Exploits and Containment
20: Exploits and Containment Mark Handley Andrea Bittau What is an exploit? Programs contain bugs. These bugs could have security implications (vulnerabilities) An exploit is a tool which exploits a vulnerability
Vulnerability Analysis I:
Vulnerability Analysis I: Exploit Hardening Made Easy Surgically Returning to Randomized Lib(c) Mitchell Adair September 9 th, 2011 Outline 1 Background 2 Surgically Returning to Randomized lib(c) 3 Exploit
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer
Infecting the Embedded Supply Chain
SESSION ID: PDAC-F01 Infecting the Embedded Supply Chain Zach Miller Security Researcher in8 Solutions (Formerly Somerset Recon) @bit_twidd1er Inspiration Inspiration Countless embedded devices exist Each
CNIT 127: Exploit Development. Ch 14: Protection Mechanisms. Updated
CNIT 127: Exploit Development Ch 14: Protection Mechanisms Updated 3-25-17 Topics Non-Executable Stack W^X (Either Writable or Executable Memory) Stack Data Protection Canaries Ideal Stack Layout AAAS:
CSE 127: Computer Security. Memory Integrity. Kirill Levchenko
CSE 127: Computer Security Memory Integrity Kirill Levchenko November 18, 2014 Stack Buffer Overflow Stack buffer overflow: writing past end of a stackallocated buffer Also called stack smashing One of
Hacking Blind. Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières, Dan Boneh. Stanford University
Hacking Blind Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières, Dan Boneh Stanford University Hacking 101 Exploit GET /0xDEAD HTTP/1.0 shell $ cat /etc/passwd root:x:0:0:::/bin/sh sorbo:x:6:9:pac:/bin/sh
Software Security: Buffer Overflow Defenses
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Defenses Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Patching Exploits with Duct Tape: Bypassing Mitigations and Backward Steps
SESSION ID: EXP-R01 Patching Exploits with Duct Tape: Bypassing Mitigations and Backward Steps James Lyne Global Head of Security Research Sophos / SANS Institute @jameslyne Stephen Sims Security Researcher
Exploit Mitigation - PIE
Exploit Mitigation - PIE Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch ASCII Armor Arbitrary Write Overflow Local
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Fall 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on the
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Spring 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on
Is Exploitation Over? Bypassing Memory Protections in Windows 7
Is Exploitation Over? Bypassing Memory Protections in Windows 7 Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Published research into reliable exploitation techniques: Heap
Software Security II: Memory Errors - Attacks & Defenses
1 Software Security II: Memory Errors - Attacks & Defenses Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab1 Writeup 3 Buffer overflow Out-of-bound memory writes (mostly sequential) Allow
Module: Return-oriented Programming. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Return-oriented Programming Professor Trent Jaeger 1 1 Anatomy of Control-Flow Exploits Two steps in control-flow exploitation First -- attacker
Play with FILE Structure Yet Another Binary Exploitation Technique. Abstract
Play with FILE Structure Yet Another Binary Exploitation Technique An-Jie Yang (Angelboy) angelboy@chroot.org Abstract To fight against prevalent cyber threat, more mechanisms to protect operating systems
Exploits and gdb. Tutorial 5
Exploits and gdb Tutorial 5 Exploits and gdb 1. Buffer Vulnerabilities 2. Code Injection 3. Integer Attacks 4. Advanced Exploitation 5. GNU Debugger (gdb) Buffer Vulnerabilities Basic Idea Overflow or
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Università Ca Foscari Venezia
Stack Overflow Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Introduction Buffer overflow is due to careless programming in unsafe languages like C
18-600: Recitation #4 Exploits
18-600: Recitation #4 Exploits 20th September 2016 Agenda More x86-64 assembly Buffer Overflow Attack Return Oriented Programming Attack 3 Recap: x86-64: Register Conventions Arguments passed in registers:
Lecture 1: Buffer Overflows
CS5431 Computer Security Practicum Spring 2017 January 27, 2017 1 Conficker Lecture 1: Buffer Overflows Instructor: Eleanor Birrell In November 2008, a new piece of malware was observed in the wild. This
Qiang Li && Zhibin Hu/Qihoo 360 Gear Team Ruxcon 2016
Qiang Li && Zhibin Hu/Qihoo 360 Gear Team Ruxcon 2016 Who are we Security researcher in Qihoo 360 Inc(Gear Team) Vulnerability discovery and analysis Specialize in QEMU currently 50+ security issues, 33
CSE 333 SECTION 6. Networking and sockets
CSE 333 SECTION 6 Networking and sockets Overview Network Sockets IP addresses and IP address structures in C/C++ DNS Resolving DNS names Demos Section exercise Sockets Network sockets are network interfaces
Introduction to Computer Systems , fall th Lecture, Sep. 28 th
Introduction to Computer Systems 15 213, fall 2009 9 th Lecture, Sep. 28 th Instructors: Majd Sakr and Khaled Harras Last Time: Structures struct rec { int i; int a[3]; int *p; }; Memory Layout i a p 0
On The Effectiveness of Address-Space Randomization. H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh Stanford University CCS 2004
On The Effectiveness of Address-Space Randomization H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh Stanford University CCS 2004 Code-Injection Attacks Inject malicious executable code
Inject malicious code Call any library functions Modify the original code
Inject malicious code Call any library functions Modify the original code 2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks 2 3 Sadeghi, Davi TU Darmstadt
Homework 3 CS161 Computer Security, Fall 2008 Assigned 10/07/08 Due 10/13/08
Homework 3 CS161 Computer Security, Fall 2008 Assigned 10/07/08 Due 10/13/08 For your solutions you should submit a hard copy; either hand written pages stapled together or a print out of a typeset document
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
CS 33 (Week 4) Section 1G, Spring 2015 Professor Eggert (TA: Eric Kim) v1.0
CS 33 (Week 4) Section 1G, Spring 2015 Professor Eggert (TA: Eric Kim) v1.0 Announcements Midterm 1 was yesterday. It's over! Don't stress out too much. We'll go over the midterm next week Homework 3 due
Documentation for exploit entitled nginx 1.3.9/1.4.0 x86 Brute Force Remote Exploit
Documentation for exploit entitled nginx 1.3.9/1.4.0 x86 Brute Force Remote Exploit about a generic way to exploit Linux targets written by Kingcope Introduction In May 2013 a security advisory was announced
Return Oriented Programming
ROP gadgets Small instruction sequence ending with a ret instruction 0xc3 Gadgets are found in existing, resident code and libraries There exist tools to search for and find gadgets Gadgets are put together
Changelog. Corrections made in this version not in first posting: 1 April 2017: slide 13: a few more %c s would be needed to skip format string part
1 Changelog 1 Corrections made in this version not in first posting: 1 April 2017: slide 13: a few more %c s would be needed to skip format string part OVER questions? 2 last time 3 memory management problems
DHCP is hard. Felix Wilhelm HITB Dubai 2018
DHCP is hard. Felix Wilhelm HITB Dubai 2018 A story of 5 bugs Intro Dynamic Host Configuration Protocol (DHCP) is a 25 year old protocol designed to dynamically assign an IP address and other related config
18-600: Recitation #4 Exploits (Attack Lab)
18-600: Recitation #4 Exploits (Attack Lab) September 19th, 2017 Announcements Some students have triggered the bomb multiple times Use breakpoints for explode_bomb() Attack lab will be released on Sep.
From Over ow to Shell
From Over ow to Shell An Introduction to low-level exploitation Carl Svensson @ Google, December 2018 1 / 25 Biography MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail:
CSE / / 60567: Computer Security. Software Security 4
CSE 40567 / 44567 / 60567: Computer Security Software Security 4 91 Homework #5 Due: Tonight at 11:59PM Eastern Time (ND) / Pacific Time (SV) See Assignments Page on the course website for details 92 Notes
Lecture 4 September Required reading materials for this class
EECS 261: Computer Security Fall 2007 Lecture 4 September 6 Lecturer: David Wagner Scribe: DK Moon 4.1 Required reading materials for this class Beyond Stack Smashing: Recent Advances in Exploiting Buffer
MWR InfoSecurity Security Advisory. Intersystems Caché CSP (Caché Server Pages) Stack Overflow. 17 th December 2009
MWR InfoSecurity Security Advisory Intersystems Caché CSP (Caché Server Pages) Stack Overflow 17 th December 2009 2009-12-17 Page 1 of 8 CONTENTS CONTENTS 1 Detailed Vulnerability Description... 5 1.1
SYSTEM CALL IMPLEMENTATION. CS124 Operating Systems Fall , Lecture 14
SYSTEM CALL IMPLEMENTATION CS124 Operating Systems Fall 2017-2018, Lecture 14 2 User Processes and System Calls Previously stated that user applications interact with the kernel via system calls Typically
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Bypassing DEP with WPM & ROP Case Study : Audio Converter by D.R Software Exploit and Document by Sud0 sud0.x90 [ at ] gmail.com sud0 [at] corelan.
![Bypassing DEP with WPM & ROP Case Study : Audio Converter by D.R Software Exploit and Document by Sud0 sud0.x90 [ at ] gmail.com sud0 [at] corelan.](/thumbs/92/109415801.jpg "Bypassing DEP with WPM & ROP Case Study : Audio Converter by D.R Software Exploit and Document by Sud0 sud0.x90 [ at ] gmail.com sud0 [at] corelan.")
Bypassing DEP with WPM & ROP Case Study : Audio Converter by D.R Software Exploit and Document by Sud0 sud0.x90 [ at ] gmail.com sud0 [at] corelan.be (May 2010) Introduction : For this first tutorial,
Heap Off by 1 Overflow Illustrated. Eric Conrad October 2007
Heap Off by 1 Overflow Illustrated Eric Conrad October 2007 1 The Attack Older CVS versions are vulnerable to an Off by 1 attack, where an attacker may insert one additional character into the heap CVS
Software Vulnerabilities August 31, 2011 / CS261 Computer Security
Software Vulnerabilities August 31, 2011 / CS261 Computer Security Software Vulnerabilities...1 Review paper discussion...2 Trampolining...2 Heap smashing...2 malloc/free...2 Double freeing...4 Defenses...5
Machine-Level Programming V: Buffer overflow
Carnegie Mellon Machine-Level Programming V: Buffer overflow Slides adapted from Bryant and O Hallaron Bryant and O Hallaron, Computer Systems: A Programmer s Perspective, Third Edition 1 Recall: Memory
Countermeasures in Modern Operating Systems. Yves Younan, Vulnerability Research Team (VRT)
Countermeasures in Modern Operating Systems Yves Younan, Vulnerability Research Team (VRT) Introduction Programs in C/C++: memory error vulnerabilities Countermeasures (mitigations): make exploitation
Security and Privacy in Computer Systems. Lecture 5: Application Program Security
CS 645 Security and Privacy in Computer Systems Lecture 5: Application Program Security Buffer overflow exploits More effective buffer overflow attacks Preventing buffer overflow attacks Announcement Project
Beyond Stack Smashing: Recent Advances in Exploiting. Jonathan Pincus(MSR) and Brandon Baker (MS)
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns Jonathan Pincus(MSR) and Brandon Baker (MS) Buffer Overflows and How they Occur Buffer is a contiguous segment of memory of a fixed
What Cannot be Read, Cannot be Leveraged?
What Cannot be Read, Cannot be Leveraged? Revisiting Assumptions of JIT-ROP Defenses Giorgi Maisuradze, Michael Backes, Christian Rossow CISPA, Saarland University, Germany Overview Code Reuse Attacks/Defenses
Buffer. This time. Security. overflows. Software. By investigating. We will begin. our 1st section: History. Memory layouts
This time We will begin our 1st section: Software Security By investigating Buffer overflows and other memory safety vulnerabilities History Memory layouts Buffer overflow fundamentals Software security
Other array problems. Integer overflow. Outline. Integer overflow example. Signed and unsigned
Other array problems CSci 5271 Introduction to Computer Security Day 4: Low-level attacks Stephen McCamant University of Minnesota, Computer Science & Engineering Missing/wrong bounds check One unsigned
Biography. Background
From Over ow to Shell An Introduction to low-level exploitation Carl Svensson @ KTH, January 2019 1 / 28 Biography MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail: calle.svensson@zeta-two.com
Attacking Next- Generation Firewalls
Attacking Next- Generation Firewalls Breaking PAN-OS Felix Wilhelm #whoami Security Researcher @ ERNW Research Application and Virtualization Security Recent Research Hypervisors (Xen) Security Appliances
4. Jump to *RA 4. StackGuard 5. Execute code 5. Instruction Set Randomization 6. Make system call 6. System call Randomization
04/04/06 Lecture Notes Untrusted Beili Wang Stages of Static Overflow Solution 1. Find bug in 1. Static Analysis 2. Send overflowing input 2. CCured 3. Overwrite return address 3. Address Space Randomization
Buffer Overflow. Jo, Heeseung
Buffer Overflow Jo, Heeseung IA-32/Linux Memory Layout Heap Runtime stack (8MB limit) Dynamically allocated storage When call malloc(), calloc(), new() DLLs (shared libraries) Data Text Dynamically linked
BUFFER OVERFLOW. Jo, Heeseung
BUFFER OVERFLOW Jo, Heeseung IA-32/LINUX MEMORY LAYOUT Heap Runtime stack (8MB limit) Dynamically allocated storage When call malloc(), calloc(), new() DLLs (shared libraries) Data Text Dynamically linked
Fastbin_dup into stack exploitation
Fastbin_dup into stack exploitation This tutorial is about the fastbin_dup into stack heap exploitation. First we re going to analyze what is fastbin and how to exploit the heap by double freeing and reallocating
CMPSC 497 Buffer Overflow Vulnerabilities
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Buffer Overflow
CSE 333 SECTION 7. Client-Side Network Programming
CSE 333 SECTION 7 Client-Side Network Programming Overview Domain Name Service (DNS) Client side network programming steps and calls dig and ncat tools Network programming for the client side Recall the
CPSC 213. Introduction to Computer Systems. Procedures and the Stack. Unit 1e
CPSC 213 Introduction to Computer Systems Unit 1e Procedures and the Stack 1 Readings for Next 3 Lectures Textbook Procedures - 3.7 Out-of-Bounds Memory References and Buffer Overflow - 3.12 2 Local Variables
Writing your first windows exploit in less than one hour
Writing your first windows exploit in less than one hour Klaus Gebeshuber klaus.gebeshuber@fh-joanneum.at http://www.fh-joanneum.at/ims AGENDA Workshop 10.00 13.00 Memory & stack basics, function calling
CSE 333 SECTION 7. C++ Virtual Functions and Client-Side Network Programming
CSE 333 SECTION 7 C++ Virtual Functions and Client-Side Network Programming Overview Virtual functions summary and worksheet Domain Name Service (DNS) Client side network programming steps and calls dig
I Control Your Code Attack Vectors through the Eyes of Software-based Fault Isolation. Mathias Payer
I Control Your Code Attack Vectors through the Eyes of Software-based Fault Isolation Mathias Payer Motivation Current exploits are powerful because Applications run on coarse-grained
Analysis of MS Multiple Excel Vulnerabilities
Analysis of MS-07-036 Multiple Excel Vulnerabilities I. Introduction This research was conducted using the Office 2003 Excel Viewer application and the corresponding security patch for MS-07-036 - Vulnerabilities
CSE 333 SECTION 8. Sockets, Network Programming
CSE 333 SECTION 8 Sockets, Network Programming Overview Domain Name Service (DNS) Client side network programming steps and calls Server side network programming steps and calls dig and ncat tools Network
Stack Vulnerabilities. CS4379/5375 System Security Assurance Dr. Jaime C. Acosta
1 Stack Vulnerabilities CS4379/5375 System Security Assurance Dr. Jaime C. Acosta Part 1 2 3 An Old, yet Still Valid Vulnerability Buffer/Stack Overflow ESP Unknown Data (unused) Unknown Data (unused)
CSE 124 Discussion Section Sockets Programming 10/10/17
CSE 124 Discussion Section Sockets Programming 10/10/17 Topics What s a socket? Creating a socket Connecting a socket Sending data Receiving data Resolving URLs to IPs Advanced socket options Live code
Runtime Defenses against Memory Corruption
CS 380S Runtime Defenses against Memory Corruption Vitaly Shmatikov slide 1 Reading Assignment Cowan et al. Buffer overflows: Attacks and defenses for the vulnerability of the decade (DISCEX 2000). Avijit,
Software Security: Buffer Overflow Attacks
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks (continued) Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Midterm 1 Review. Memory Safety & Web Attacks
Midterm 1 Review Memory Safety & Web Attacks What s on the midterm? Lecture material through Feb 9 Lecture notes ("Notes on..." on the course site) Section material, per "Handout w/ solutions" Concepts
EXPLOITING BUFFER OVERFLOWS ON MIPS ARCHITECTURES
EXPLOITING BUFFER OVERFLOWS ON MIPS ARCHITECTURES A Walkthrough by Lyon Yang @l0op3r Editing and Support: Bernhard Mueller PUBLIC VERSION Table of Contents 1.! Introduction,...,3! 2.! Triggering,and,Debugging,the,Exploit,...,3!
Payload Already Inside: Data re-use for ROP Exploits
Payload Already Inside: Data re-use for ROP Exploits Long Le longld at vnsecurity.net Thanh Nguyen rd at vnsecurity.net 1 HITB2010KUL DEEPSEC Agenda Introduction Recap on stack overflow & mitigations Multistage
Software Security: Buffer Overflow Attacks (continued)
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks (continued) Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Lecture 10 Code Reuse
Lecture 10 Code Reuse Computer and Network Security 4th of December 2017 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 10, Code Reuse 1/23 Defense Mechanisms static & dynamic analysis
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Spring 2018, Lecture 5 Low Level Software Security III: Integers, ROP, & CFI Integer Arithmetic in C Quiz time! What does this code produce? 100 200 300 100 200
logistics LEX assignment out exam in on week come with questions on Monday (review)
Stack Smashing 1 logistics 2 LEX assignment out exam in on week come with questions on Monday (review) last few times encrypted code changing code polymorphic, metamorphic anti-vm/emulation anti-debugging
The Geometry of Innocent Flesh on the Bone
The Geometry of Innocent Flesh on the Bone Return-into-libc without Function Calls (on the x86) Hovav Shacham hovav@cs.ucsd.edu CCS 07 Technical Background Gadget: a short instructions sequence (e.x. pop
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler return-oriented programming Hovav Shacham presented by: Fabian
Secure Systems Engineering
Secure Systems Engineering Chester Rebeiro Indian Institute of Technology Madras Flaws that would allow an attacker access the OS flaw Bugs in the OS The Human factor Chester Rebeiro, IITM 2 Program Bugs
Hacking Blind BROP. Presented by: Brooke Stinnett. Article written by: Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazie`res, Dan Boneh
Hacking Blind BROP Presented by: Brooke Stinnett Article written by: Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazie`res, Dan Boneh Overview Objectives Introduction to BROP ROP recap BROP key phases