Introduction to InfoSec Recitation 2. Nir Krakowski (nirkrako at post.tau.ac.il) Itamar Gilad (itamargi at post.tau.ac.il)

Transcription

1 Intrductin t InfSec Recitatin 2 Nir Krakwski (nirkrak at pst.tau.ac.il) Itamar Gilad (itamargi at pst.tau.ac.il)

2 Mre assembly tips Review f the stack Stack verflws Implementatin Tls Tday

3 Little vs Big Endian Endian-ity is the definitin f hw numbers are represented in memry (r n a data bus) In the x86 architecture 0x wuld be represented in memry: Intel Architecture is little endian. (we are using little) Hwever the same number in Big Endian wuld be: (we dn t see the bit rerdering because ur minimum wrking unit is a byte)

4 Cmmn uses: Registers eax used usually fr fast calculatins / system call numbers /used t pass the return value ecx used as a cunter frequently / as self class in c++. ebp used t stre the stack frame pinter esp used t stre the stack pinter edi/esi used fr string/buffer manipulatins ip used t stre the current instructin pinter can nt be accessed directly!

5 Mre n register functinality Mst registers can be (CPU-wise) variably be used fr different purpses. Hwever, Sme register can nt be used with certain cmmands. Example: mv eip, 0xaddress ; this cmmand is impssible. lp sme_label ;wrks nly with ecx. EIP specifically can t be manipulated directly at all. instead we use: jmp, call, ret t manipulate it.

6 x86 stack manipulatin The x86 stack lcatin is nted by ESP (EBP has n direct rle). There are tw cmmands t manipulate the stack: push 0ximmediate push reg push [frm memry] pp reg Hwever the stack can als be manipulated directly, eg.: mv [esp+10h], 4 mv [ebp-15h], 0

7 x86 alternative instructins There are lts f assembly instructins with varying sizes, and they can be used alternatively t fit certain cnstraints. Cmpilers use alternative ways fr ptimizatin purpses: Sme pcdes take up less space in memry. Sme cde shrtcuts can be made. Examples: add esp,4 push eax Alternatively: mv [esp-4], eax mv eax, 0 Alternatively: xr eax,eax There are als 8 bit cmmands t access partial registers mv al, 5 There are 16 bit cmmands mv ax, 65535

8 Histry: Buffer Os First dcumented buffer verflws were thught f in 1972 COMPUTER SECURITY TECHNOLOGY PLANNING STUDY (Page 61) The first buffer verflws knwn in the wild were Stack Os Stack Overflws were widely intrduced by Aleph One Phrack Magazine Issue 49 n Nvember 8, 1996 Title: Smashing the stack fr fun and prfit Purpse: Like when patching, we re-rute the cde t new cde which adds new functinality. We mdify the behavir f a prgram withut mdifying the binary, and nly by cntrlling the input! Therefre we can subvert the riginal functinality f the cde t any purpse.

9 Where des it get really interesting When the prgram input is frm a remte cnnectin Example: telnet When the prgram has higher privileges Example: su

10 Executable in Disk This is hw the prgram appears n disk. The perating system lader lads the file and maps it int prgram memry. Lader maps the file t memry accrding t instructins defined in the ELF file. Lader creates new memry sectin such as the Stack. Lader calls the start f the prgram

11 Prcess Memry Abstract / \ lwer memry Text addresses (Initialized) Data (Uninitialized) Stack higher memry \ / addresses

12 Example1.c vid functin(int a, int b, int c) { char buffer1[5]; char buffer2[10]; } vid main() { functin(1,2,3); }

13 Stack Structure bttm f tp f memry memry buffer2 buffer1 sfp ret a b c < [ ][ ][ ][ ][ ][ ][ ] tp f bttm f stack stack Our purpse is t verflw frm buffer2 until we reach ret s that we pint EIP t an arbitrary lcatin f ur chsing.

14 shellcde example made simple allcate /bin/sh call execv( /bin/sh, NULL); call exit(exit_cde); We will use system calls (interrupt 0x80) Unlike call interrupt arguments are passed via the registers: mv eax, 0xb ; execv system call mv ebx, [addr t /bin/sh ] mv ecx, 0 ; NULL Int 0x80

15 Allcating /bin/sh Nt knwing where ur cde is lcated presents a challenge, since we knw its is lcated smewhere near EIP, but we can read EIP directly instead we use the fllwing trick : jmp end end: pp ebx ; Nw ebx will hld the address t /bin/sh call beginning.string /bin/sh

16 shellcde example with interrupt calls jmp call_start # jump t the end f the cde t /bin/sh start_shellcde: # label t jump back pp ebx # put pint t /bin/sh in ebx xr eax,eax # zer eax, but dnt use mv, because it include \x00 mv al, 0xb # system call 0xb, - execve xr ecx, ecx # clear pinter t envp int 0x80 # call a system call! xr eax,eax # ignre return and reset t zer. mv al, 0x1 # call exit system call int 0x80 call_start: call start_shellcde.string "/bin/sh"

17 Shellcde In the exercise, shellcde will be prvided fr yu, there is n need t cmpile it, simply use it as is.

18 NOP Slide Slides EIP t beginning f cde. Avids frm Illegal Instructin Prtects against stack differences NOP Start CPU/EIP Shellcde Start

19 Dem Stack Example

20 gdb GNU Debugger Tls List Cre dump analysis: gdb cre=cre.dump Ollydbg (fr windws) which we will nt cver in the curse. IDA va_t_ffset.py easy prgram t get ffset f cde in rig file. ghex can be used t patch the binary : Once we have a search string t find the binary cde, we can mdify it Other cmmn tls fr linux debugging: ltrace library tracing strace system call tracing bjdump dump elf file and symbl infrmatin strings can be used t view strings inside a binary. shellcde

21 Running gdb: GDB Quick brwse gdb./executable gdb args=./executable [params] gdb cre=[cre_file_name] r arg1 arg2 runs the file with the specified arguments si, ni step instructin s, n step inf reg print all registers dump memry filename startaddress stpaddress x/i address disassemble at this address p (char *) 0x print at this address as if it was a c-string. x/bx address print hex starting frm this address c cntinue b smefunctin sets a breakpint

22 The end