1 / 76

Advanced Buffer Overflow Technique

Advanced Buffer Overflow Technique. Greg Hoglund. Attack Theory. Formalize the Attack Method Re-Use of Attack Code Separate the Deployment from the Payload Payloads can be chosen for desired effect Details and Restraints of both Payload and Deployment code. Exploits. A “BUG” in Software

vernon-wiggins
Download Presentation

Advanced Buffer Overflow Technique

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Advanced Buffer Overflow Technique Greg Hoglund

  2. Attack Theory • Formalize the Attack Method • Re-Use of Attack Code • Separate the Deployment from the Payload • Payloads can be chosen for desired effect • Details and Restraints of both Payload and Deployment code

  3. Exploits • A “BUG” in Software • New bugs reported every day • automated testing tools • USSR Labs • “Exploit” is code that takes advantage of a bug in order to cause an effect

  4. What can happen? • Machine Crash • kernel exception • VIP process • Application Crash (most common) • Recoverable Exception • Mobile Code (deadly) • File Access (read or write) • Denial of Service

  5. Exploits can be grouped • Some bugs are all the same • Some bugs keep coming back • improper filtering • bounds checking • bad authentication • impersonation • In other words, need better testing

  6. Entry -vs- Effect • The attack payload is not the same as the entry point • Missle -vs- Warhead analogy • The Delivery Mechanism can be decoupled from the Payload

  7. Exploits come in 2 parts • Injection Vector (deployment) • the actual entry-point, usually tied explicity with the bug itself • Payload (deployed) • usually not tied to bug at all - limited only by imagination. Some restraints.

  8. Injection Vector • Target Dependant • OS Dependant • Application Version Dependant • Protocol Dependant • Encoding Dependant

  9. Payload • Independent of Injection Vector • Still Depends on Machine, Processor, etc. • With some exceptions • Mobile Code, Just like a Virus • Once established, can spread by any means • trust • scanning for more bugs

  10. Payload • Denial of Service • use as launching point (arp spoofing) • Remote Shell (common) • covert channel or ‘netcat’ like • Worm/Virus • extremely dangerous • Rootkit (common - stealth)

  11. Injector/Payload Pairs • One injector works on ‘n qualified hosts’ • Example - IIS Injector works on ~20% of Web Hosts. • Payload • Remote Shell for control • Shutdown Machine • Shutdown ALL Machines on subnet

  12. Types of Injection • Content Based • characters inserted into a data stream that result in the remote process doing something it shouldn’t. Process is still in control. • Buffer Overflow • poor programming practice subverts architecture of code execution. Process loses control.

  13. Types of Injection • Trust Based • Boot virus/ Floppy/ CD (parasite process) • MACRO virus • Email Attachments (Melissa, etc) • Web Browsing (exploit user’s trust, etc) • click thru

  14. Governments write Injector Code? • 1995 US Defense Intelligence Agency Report • Cuban Military targets US w/ custom virii • University of Havana, team of less than 20 computer experts • Russian KGB • prior to 1991 coup attempt, KGB has virii intended to shut down US computers in times of war

  15. Mobile code in Global 2000? • 1995 E&Y report • 67% of companies hit bit virus • 1996 E&Y report • 63% of companies hit by virus • 1996 UK Information Security Breaches Survey • 51% of companies hit by virus

  16. How hard can it hit? • NCSA 1997 report • 33% of all machines infected with virus • average cost of recovery ~$8000 US dollars • November 1988 Morris Worm • strikes ~6,000 computers (10% of Internet at time) within hours • spreads via Buffer Overflow in fingerd • spreads via Sendmail exploit

  17. How hard can it hit? • 1989, “WANK” Worm • Hits NASA Goddard Space Center • spreads to US DOE High Energy Physics network (HEPNET) • 2 weeks to clean all systems

  18. Buffer Overflow Injection • Overflow the Stack • Overflow the Heap • Goal: Must control the value of the instruction pointer (processor specific) • Goal: Get the Instruction Pointer to point to a user-controlled buffer.

  19. Challenges • Injector/Payload size restrictions • tight coding requirements • Injector and Payload in same buffer • cannot step on each other • Guessing Address Values • sometimes called ‘offsets’ • NULL characters, BAD characters • use encoding and stack tricks

  20. Stack Injection • Stack is used for execution housekeeping as well as buffer storage. • Stack-based buffer must be filled in direction of housekeeping data. • Must overwrite the housekeeping data

  21. IP Address Housekeeping A IP B DI code C SI D FLAG SP BP heap stack

  22. Stack Overflow 00 40 20 08 00 40 20 0C 00 40 20 10 00 40 20 14 00 40 20 18 00 40 20 1C

  23. STOPS The Problem with NULL 00 40 20 08 00 40 20 0C 00 40 20 10 00 40 20 14 00 40 20 18 00 40 20 1C

  24. OK NULL must be PAST housekeeping data 00 40 20 08 00 40 20 0C 00 40 20 10 00 40 20 14 00 40 20 18 00 40 20 1C

  25. Little and Big Endian • On Intel x86 (Little Endian), Values are stored ‘backwards’ - least significant byte goes first: • 00 40 10 FF is stored as: FF 10 40 00

  26. Original Address New Address CD 68 45 7F 0C 20 40 00 We store address in housekeeping data 00 40 21 04 00 40 21 00 00 40 20 0C 00 40 20 08 00 40 20 04 00 40 20 00

  27. New Address 04 21 40 00 Injection is Complete • We control the instruction pointer

  28. New Address 04 21 40 00 Where to put the payload 00 40 21 04 00 40 21 00 00 40 20 0C 00 40 20 08 00 40 20 04 00 40 20 00

  29. Confined Payload • Byte Compression • Use only preloaded functions • Payload doesn’t need to build jumptables • Useable functions must be loaded • Use Hardcoded addresses • Payload designed for a specific process with predictable features • Data portion of payload needs to be small

  30. OK NO NULL in Address 0D 45 68 77 Using more stack for payload 77 40 20 08 77 40 20 0C 77 40 20 10 77 40 20 14 77 40 20 18 77 40 20 1C

  31. Much Larger Payload

  32. When does the address contain a NULL character • Lowland Address - starts with 00 • stack is in lowland on Windows NT • usually 00 40 XX XX • limits size of payload • Highland Address - no zeros in address • stack is in highland under Linux • unlimited payload size

  33. Large payload, Lowland address • We cannot use a lowland address directly, because it limits our payload • We can use a CPU register • We can use stack values that remain undamaged

  34. IP A register points to the stack A IP B DI code C SI D FLAG SP BP heap stack

  35. Call thru a Register • Call eax, call ebx, etc • FF D0 = call eax • FF D3 = call ebx • FF D1 = call ecx • etc, etc

  36. Push a register then return • Push register • push eax = 50 • push ebx = 53 • etc • Then RET • RET = C3

  37. Guessing where to go • We jump to the wrong address • crashes software • payload doesn’t execute • Use NOP (no-op) - a single byte instruction • NOP = 90 • Fill buffer with NOP’s • “NOP Sled”

  38. End up at payload NOP Sled

  39. Inject the Payload into the HEAP • When the stack is limited in size • Store part on the payload on stack, the other on the heap • Protocol Headers • HTTP headers • Recent Transactions • Open Files

  40. IP Execute code on the heap A IP B DI code C SI D FLAG SP BP heap stack

  41. Trespassing the HEAP • Two C++ objects near one another • Any buffer that can overwrite a pointer • function pointer • string pointer (alter behavior w/o mobile code)

  42. Overwrite the VTABLE • C++ objects have a virtual function table Vtable pointer Member variables grow away from vtable pointer (NT)

  43. Overwrite vtable ptr Overwrite VTABLE • Must have 2 C++ Objects (on heap)

  44. Where do I make the VTABLE point?

  45. Your own VTABLE • The VTABLE has addresses for all virtual functions in the class. This usually includes a destructor - which will be called when the object is destroyed (deallocated from memory) • Overwrite any function that works

  46. Injection is complete • Kernel level overflows all over in NT • Off by one errors causing frame pointer overwrite • Multi-stage attacks where you must first get the target into a state before attempting overflow • The effects of URL or MIME encoding

  47. Now for the Payload • Using Loaded Functions • Encoding our own data • Loading new functions & DLL’s • Making a shell

  48. Real Code DATA NOP Sled The Payload

  49. Getting Bearings • Call RELOC: • RELOC: pop edi • EB 00 00 00 00 • edi now has our code address • we can use this as an offset to our data

  50. Reverse Short Call • NO NULL Bytes • RELOC: jmp RELOC2 • Call RELOC: • RELOC2: pop edi • EB FF FF FF FE

More Related