Hijacking the Linux Kernel

Transcription

1 Hijacking the Linux Kernel Boris Procházka, Tomáš Vojnar and Martin Drahanský FIT Brno University of Technology : Aurelius Hall Your Name Your Title Your Organization MEMICS (Line #1) 2010 Your Organization (Line Mikulov #2)

2 Outline Introduction System Call Interface State of the Art The New Approach Experiments Conclusion 2/14

3 Introduction Operating System Hierarchy Attacks on user mode Applications Libraries Attacks on kernel mode System call interface Virtual file system Scheduler Drivers application libraries system call interface kernel subsystems hardware 3/14

4 System Call Interface Basic idea An abstract layer (an interface) between users and the kernel Services (kernel functions) identified by numbers Parameters passing throughout CPU's regs application libraries system call interface kernel subsystems hardware 4/14

5 System Call Interface Schema (IA-32) Interrupt Table 0x80 0x01 0x00 system_call debug divide_error CPU reg. idtr Application/Library movl $UID,%ebx movl $23,%eax int $0x80 System Call Handler system_call: pushl %eax SAVE_ALL cmpl $(nr_syscalls), %eax jae syscall_badsys call *sys_call_table(,%eax,4) movl %eax,pt_eax(%esp) cli movl TI_flags(%ebp), %ecx testw $WORK_MASK, %cx jne syscall_exit_work RESTORE_REGS addl $4, %esp iret System Call Table 23 sys_setuid 3 sys_read 2 sys_fork 1 sys_exit 0 sys_restart System Call Function sys_setuid(uid_t u) { int old_euid; int retval; return retval; } 5/14

6 State of the Art Attacks on: Interrupt Table 0x80 0x01 0x00 system_call debug divide_error CPU reg. idtr Application/Library movl $UID,%ebx movl $23,%eax int $0x80 System Call Handler system_call: pushl %eax SAVE_ALL cmpl $(nr_syscalls), %eax jae syscall_badsys call *sys_call_table(,%eax,4) movl %eax,pt_eax(%esp) cli movl TI_flags(%ebp), %ecx testw $WORK_MASK, %cx jne syscall_exit_work RESTORE_REGS addl $4, %esp iret System Call Table 23 sys_setuid 3 sys_read 2 sys_fork 1 sys_exit 0 sys_restart System Call Function sys_setuid(uid_t u) { int old_euid; int retval; return retval; } 6/14

7 The New Approach Basic Idea Change an execution flow in the middle of an existing function by a jump code Some existing function existing_function: pushl %ebp movl %ebp, %esp movzx %ecx, [%ebp+2] popl %ebp movzx %edx, %ecx addl %eax, %edx shl %eax, 2 addl %eax, %edx shr %eax, 8 popl %ebp ret Jump 1 Jump 2 Hijack function void hijack (pt_regs* regs) { } 7/14

8 The New Approach Three issues Seven bytes of space movl $0,%eax \xb8\x00\x00\x00\x00 jmp *%eax \xff\xe0 Keep valid code Respect the beginnings and ends of instructions Do not overwrite code containing labels Keep the original semantics Compensate the rewritten code to sustain the original function 8/14

9 System Call Interface Schema (IA-32) Interrupt Table 0x80 0x01 0x00 system_call debug divide_error CPU reg. idtr Application/Library movl $UID,%ebx movl $23,%eax int $0x80 System Call Handler system_call: pushl %eax SAVE_ALL cmpl $(nr_syscalls), %eax jae syscall_badsys call *sys_call_table(,%eax,4) movl %eax,pt_eax(%esp) cli movl TI_flags(%ebp), %ecx testw $WORK_MASK, %cx jne syscall_exit_work RESTORE_REGS addl $4, %esp iret System Call Table 23 sys_setuid 3 sys_read 2 sys_fork 1 sys_exit 0 sys_restart System Call Function sys_setuid(uid_t u) { int old_euid; int retval; return retval; } 9/14

10 The New Approach Where to Hijack Control Flow in the System Call Handler system_call: pushl %eax //Storing of system call number SAVE_ALL //Storing of all CPU's registers movl $0xffffe000, %ebx //Calculation of the pointer to #1 andl %esp, %ebx //current process 7 Bytes testw $W_ENTRY,TI_flags(%ebp) //Process traced? jnz syscall_trace_entry //If so, jump to trace function cmpl $(nr_syscalls), %eax //eax >= number of system calls? jae syscall_badsys //If so, abort call *sys_call_table(0, %eax, 4) //Calling sys_call_table[eax] movl %eax,pt_eax(%esp) //Storing of return value cli //Clear Interrupts movl TI_flags(%ebp), %ecx //Copy process flags in ecx #2 testw $W_MASK, %cx //Is needed extra work? 8 Bytes jne syscall_exit_work //If so, do extra work RESTORE_REGS //CPU's registers restoration addl $4, %esp //Clearing up stack iret //Return from interrupt 10/14

11 The New Approach Changing the Control Flow in the System Call Handler System call handler system_call: pushl %eax SAVE_ALL cmpl $(nr_syscalls), %eax jae syscall_badsys call *sys_call_table(,%eax,4) movl %eax,pt_eax(%esp) cli movl TI_flags(%ebp), movl %ecx trampoline, %eax testw $WORK_MASK, jmp %cx *%eax jne syscall_exit_work RESTORE_REGS addl $4, %esp iret Hijack function void hijack (pt_regs* regs) { switch(regs->orig_ax) { case NR_setuid: } } Trampoline trampoline: pushl %esp call hijack popl %esp movl TI_flags(%ebp), %ecx testw $WORK_MASK, %cx jmp comeback 11/14

12 Experiments and implementations Rootkit Molekit Implemented by new technique Using /dev/mem to infiltrate the kernel (no LKM needed) Only basic services for attacker Rootkit Powerkit Implemented by new technique Using module to infiltrate the kernel (access to kernel API) Advanced services Intelligent keylogging Escalation of privileges Sentinel scanner (detects Molekit & Powerkit) 12/14

13 Conclusion New method of hijacking the Linux kernel System call interface Intel Architecture Usability All 2.6.x kernel series Verified by real implementation (Molekit, Powerkit) Absence of detection tool (except for Sentinel) Result Undetectable compromitation of arbitrary Linux (if attacker has access to kernel memory ~ is root) 13/14

14 Hijacking the Linux Kernel Thank you for your attention! References: Love, R.: Linux Kernel Development Bovet P.D., Cesati M.: Understanding the Linux Kernel Mauerer W.: Professional Linux Kernel Architecture Linux Kernel Organization: 14/14