buffer overflows - courses.cs.washington.edu€¦ · buffer overflows spring 2016 x86-64 linux...

Spring 2016Buffer Overflows

Bufferoverflows¢ BufferoverflowsarepossiblebecauseCdoesnotcheckarray

boundaries¢ Bufferoverflowsaredangerousbecausebuffersforuser

inputareoftenstoredonthestack

¢ Specifictopics:§ Addressspacelayout§ Inputbuffersonthestack§ Overflowingbuffersandinjectingcode§ Defensesagainstbufferoverflows

1


x86-64LinuxMemoryLayout

¢ Stack§ Runtimestack(8MBlimit)§ E.g.,localvariables

¢ Heap§ Dynamicallyallocatedasneeded§ Whencallmalloc,calloc,new,…

¢ Data§ Staticallyallocateddata§ Read-only:stringliterals§ Read/write:globalarraysandvariables

¢ Code/SharedLibraries§ Executablemachineinstructions§ Read-only

HexAddress

0x00007FFFFFFFFFFF

0x000000

Stack

InstructionsData

Heap

0x400000

8MB

notdrawntoscale

SharedLibraries

2

Heap


Reminder:x86-64/LinuxStackFrame

¢ Caller’s StackFrame§ Arguments(if>6args)forthiscall§ Returnaddress

§ Pushedbycall instruction

¢ Current/ Callee StackFrame§ Oldframepointer(optional)§ Savedregistercontext

(whenreusingregisters)§ Localvariables

(Ifcan’tbekeptinregisters)§ “Argumentbuild”area

(Ifcallee needstocallanotherfunction-parametersforfunctionabouttocall,ifneeded)

ReturnAddr

SavedRegisters

+Local

Variables

ArgumentBuild

(Optional)

Old%rbp

Arguments7+

CallerFrame

Framepointer%rbp

Stackpointer%rsp

(Optional)

3LowerAddresses

HigherAddresses


MemoryAllocationExample

4

char big_array[1L<<24]; /* 16 MB */char huge_array[1L<<31]; /* 2 GB */

int global = 0;

int useless() { return 0; }

int main (){

void *p1, *p2, *p3, *p4;int local = 0;p1 = malloc(1L << 28); /* 256 MB */p2 = malloc(1L << 8); /* 256 B */p3 = malloc(1L << 32); /* 4 GB */p4 = malloc(1L << 8); /* 256 B *//* Some print statements ... */

}

notdrawntoscale

Wheredoeseverythinggo?

Stack

InstructionsData

Heap

SharedLibraries

Heap


MemoryAllocationExample

5

char big_array[1L<<24]; /* 16 MB */char huge_array[1L<<31]; /* 2 GB */

int global = 0;

int useless() { return 0; }

int main (){

void *p1, *p2, *p3, *p4;int local = 0;p1 = malloc(1L << 28); /* 256 MB */p2 = malloc(1L << 8); /* 256 B */p3 = malloc(1L << 32); /* 4 GB */p4 = malloc(1L << 8); /* 256 B *//* Some print statements ... */

}

notdrawntoscale

Wheredoeseverythinggo?

Stack

InstructionsData

Heap

SharedLibraries

Heap


x86-64ExampleAddresses

&local 0x00007ffe4d3be87c p1 0x00007f7262a1e010 p3 0x00007f7162a1d010 p4 0x000000008359d120 p2 0x000000008359d010 &big_array[0] 0x0000000080601060 huge_array 0x0000000000601060 main() 0x000000000040060cuseless() 0x0000000000400590

address range~24700007F

000000

InstructionsData

Heap

notdrawntoscale

Heap

Stack

6

Whatis&p1?(approximately)


Today¢ MemoryLayout¢ BufferOverflow

§ Vulnerability§ Protection

7


InternetWorm¢ ThesecharacteristicsofthetraditionalLinuxmemorylayout

provideopportunitiesformaliciousprograms§ Stackgrows“backwards”inmemory§ Dataandinstructionsbothstoredinthesamememory

¢ November,1988§ InternetWormattacksthousandsofInternethosts.§ Howdidithappen?

¢ Stackbufferoverflow exploits!

8


BufferOverflowinanutshell¢ ManyclassicUnix/Linux/Cfunctionsdonotcheckargumentsizes¢ Cdoesnotcheckarraybounds¢ Allowsoverflowing(writingpasttheendof)buffers(arrays)¢ Overflowsofbuffersonthestackoverwriteinterestingdata¢ Attackersjustchoosetherightinputs¢ Whyabigdeal?

§ Itis(was?)the#1technical causeofsecurityvulnerabilities§ #1overall causeissocialengineering/userignorance

¢ Simplestform§ Uncheckedlengthsonstringinputs§ Particularlyforboundedcharacterarraysonthestack

§ sometimesreferredtoas“stacksmashing”

9


StringLibraryCode¢ ImplementationofUnixfunctiongets()

§ Whatcouldgowronginthiscode?

/* Get string from stdin */char* gets(char* dest) {

int c = getchar();char* p = dest;while (c != EOF && c != '\n') {

*p++ = c;c = getchar();

}*p = '\0';return dest;

}

10

pointertostartofanarray

sameas:*p=c;p++;


StringLibraryCode¢ ImplementationofUnixfunctiongets()

§ Nowaytospecifylimit onnumberofcharacterstoread

¢ SimilarproblemswithotherUnixfunctions§ strcpy:Copiesstringofarbitrarylengthtoadest§ scanf,fscanf,sscanf,whengiven%s conversionspecification

11

/* Get string from stdin */char* gets(char* dest) {

int c = getchar();char* p = dest;while (c != EOF && c != '\n') {

*p++ = c;c = getchar();

}*p = '\0';return dest;

}


VulnerableBufferCode

void call_echo() {echo();

}

/* Echo Line */void echo(){

char buf[4]; /* Way too small! */gets(buf);puts(buf);

}

unix> ./bufdemo-nspType a string: 012345678901234567890123012345678901234567890123

unix> ./bufdemo-nspType a string: 0123456789012345678901234Segmentation Fault

12


BufferOverflowDisassembly

00000000004006cf <echo>:4006cf: 48 83 ec 18 sub $0x24,%rsp4006d3: 48 89 e7 mov %rsp,%rdi4006d6: e8 a5 ff ff ff callq 400680 <gets>4006db: 48 89 e7 mov %rsp,%rdi4006de: e8 3d fe ff ff callq 400520 <puts@plt>4006e3: 48 83 c4 18 add $0x24,%rsp4006e7: c3 retq

4006e8: 48 83 ec 08 sub $0x8,%rsp4006ec: b8 00 00 00 00 mov $0x0,%eax4006f1: e8 d9 ff ff ff callq 4006cf <echo>4006f6: 48 83 c4 08 add $0x8,%rsp4006fa: c3 retq

call_echo:

echo:

13


BufferOverflowStack

echo:subq $24, %rspmovq %rsp, %rdicall gets. . .



}

Beforecalltogets

14

Stackframeforcall_echo

Returnaddress(8bytes)

20bytesunused

[3] [2] [1] [0] buf ⟵%rsp


BufferOverflowStackExampleecho:

subq $24, %rspmovq %rsp, %rdicall gets. . .

void echo(){

char buf[4]; gets(buf);. . .

}

Beforecalltogets

. . .4006f1: callq 4006cf <echo>4006f6: add $0x8,%rsp. . .

call_echo:

15


00 00 00 00

00 40 06 f6

20bytesunused

[3] [2] [1] [0] buf ⟵%rsp


BufferOverflowStackExample#1Aftercalltogets


Overflowedbuffer,butdidnotcorruptstate 16


00 00 00 00

00 40 06 f6

00 32 31 30

39 38 37 36

35 34 33 32

31 30 39 38

37 36 35 34

33 32 31 30


void echo(){


}


call_echo:

buf ⟵%rsp



unix> ./bufdemo-nspType a string: 0123456789012345678901234Segmentation Fault

Overflowedbufferandcorruptedreturnpointer 17


void echo(){


}


call_echo:

buf ⟵%rsp


00 00 00 00

00 40 00 34

33 32 31 30

39 38 37 36

35 34 33 32

31 30 39 38

37 36 35 34

33 32 31 30




Overflowedbuffer,corruptedreturnpointer,butprogramseemstowork! 18


void echo(){


}


call_echo:

buf ⟵%rsp


00 00 00 00

00 40 06 00

33 32 31 30

39 38 37 36

35 34 33 32

31 30 39 38

37 36 35 34

33 32 31 30


BufferOverflowStackExample#3ExplainedAftercalltogets

. . .400600: mov %rsp,%rbp400603: mov %rax,%rdx400606: shr $0x3f,%rdx40060a: add %rdx,%rax40060d: sar %rax400610: jne 400614400612: pop %rbp400613: retq

register_tm_clones:

“Returns”tounrelatedcodeLotsofthingshappen,withoutmodifyingcriticalstateEventuallyexecutesretq backtomain

19

buf ⟵%rsp


00 00 00 00

00 40 06 00

00 32 31 30

39 38 37 36

35 34 33 32

31 30 39 38

37 36 35 34

33 32 31 30


MaliciousUseofBufferOverflow:CodeInjectionAttacks

¢ Inputstringcontainsbyterepresentationofexecutablecode¢ OverwritereturnaddressAwithaddressofbufferB¢ Whenbar() executes ret,willjumptoexploitcode

int bar() {char buf[64]; gets(buf); ...return ...;

}

void foo(){bar();

A:...}

returnaddressA

Stackaftercalltogets()

A (returnaddress)

foo stackframe

bar stackframe

B

exploitcode

paddatawrittenbygets()

20

LowAddresses

HighAddresses

AB+24

buf startshere


ExploitsBasedonBufferOverflows¢ Bufferoverflowbugscanallowremotemachinestoexecute

arbitrarycodeonvictimmachines¢ Distressinglycommoninrealprograms

§ ProgrammerskeepmakingthesamemistakesL§ Recentmeasuresmaketheseattacksmuchmoredifficult

¢ Examplesacrossthedecades§ Original“Internetworm”(1988)§ Stillhappens!!Heartbleed (2014,affected17%ofservers)§ Fun: Nintendohacks

§ Usingglitchestorewritecode:https://www.youtube.com/watch?v=TqK-2jUQBUY

§ FlappyBird inMario:https://www.youtube.com/watch?v=hB6eY73sLV0

§ …andmany,manymore

¢ Youwilllearnsomeofthetricksinlab3§ Hopefullytoconvinceyoutoneverleavesuchholesinyourprograms!!

21


Example:theoriginalInternetworm(1988)¢ Exploitedafewvulnerabilitiestospread

§ Earlyversionsofthefingerserver(fingerd)usedgets() toreadtheargumentsentbytheclient:§ finger [email protected]

§ Wormattackedfingerd serverbysendingphonyargument:§ finger “exploit-code padding new-return-address”

§ exploitcode:executedarootshellonthevictimmachinewithadirectTCPconnectiontotheattacker.

¢ Onceonamachine,scannedforothermachinestoattack§ invaded~6000computersinhours(10%oftheInternetJ )

§ seeJune1989articleinComm.oftheACM§ theyoungauthorofthewormwasprosecuted…

22


Heartbleed(2014!)¢ Bufferover-readinOpenSSL

§ Opensourcesecuritylibrary§ Buginasmallrangeofversions

¢ “Heartbeat”packet§ Specifieslengthofmessage§ Serverechoesitback§ Libraryjust“trusted”thislength§ Allowedattackerstoreadcontents

ofmemoryanywheretheywanted

¢ Est.17%ofInternetaffected§ “Catastrophic”§ Github,Yahoo,

StackOverflow,AmazonAWS,...

23

ByFenixFeather - Ownwork,CCBY-SA 3.0,https://commons.wikimedia.org/w/index.php?curid=32276981


Whattodoaboutbufferoverflowattacks…1. Avoidoverflowvulnerabilities

2. Employsystem-levelprotections

3. Havecompileruse“stackcanaries”

¢ Letstalkabouteach…

24


1.AvoidOverflowVulnerabilitiesinCode(!)

¢ Uselibraryroutinesthatlimitstringlengths§ fgets insteadofgets (secondargumenttofgets setslimit)§ strncpy insteadofstrcpy§ Don’tusescanfwith%s conversionspecification

§ Usefgets toreadthestring§ Oruse%nswheren isasuitableinteger


char buf[4]; /* Way too small! */fgets(buf, 4, stdin);puts(buf);

}

25


2.System-LevelProtectionscanhelpRandomizedstackoffsets¢ Atstartofprogram,allocaterandomamountof

spaceonstack¢ Shifts stackaddressesforentireprogram

§ Addresseswillvaryfromoneruntoanother¢ Makesitdifficult forhackertopredictbeginning of

insertedcode¢ E.g.:5executionsofmemoryallocationcodefrom

slide4,addressofvariablelocal changeseachtime:§ 0x7ffe4d3be87c

§ 0x7fff75a4f9fc

§ 0x7ffeadb7c80c

§ 0x7ffeaea2fdac

§ 0x7ffcd452017c

§ Stackrepositionedeachtimeprogramexecutes

main’sstackframe

Otherfunctions’

stackframes

Randomallocation

B?

B?

exploitcode

pad

26

LowAddresses

HighAddresses


2.System-LevelProtectionscanhelpNon-executablecodesegments¢ Intraditionalx86,canmarkregionof

memoryaseither“read-only”or“writeable”§ Canexecuteanythingreadable

¢ X86-64addedexplicit“execute”permission

¢ Stackmarkedasnon-executable§ DoNOTexecutecodeinstack,data,

orheapregions§ Hardwaresupportneeded

Stackaftercalltogets()

B

foo stackframe

bar stackframe

B

exploitcode

paddatawrittenbygets()

Anyattempttoexecutethiscodewill fail

27


3.StackCanariescanhelp¢ Idea

§ Placespecialvalue(“canary”)onstackjustbeyondbuffer§ Secret valueknownonlytocompiler§ “After”bufferbutbeforereturnaddress

§ Checkforcorruptionbeforeexitingfunction

¢ GCCImplementation§ -fstack-protector

§ Nowthedefaultforgcc§ Codebackonslide12(bufdemo-nsp) compiledwithoutthisoption

unix>./bufdemo-spType a string: 01234560123456

unix> ./bufdemo-spType a string: 01234567*** stack smashing detected ***

28


Protected BufferDisassembly

40072f: sub $0x18,%rsp400733: mov %fs:0x28,%rax40073c: mov %rax,0x8(%rsp)400741: xor %eax,%eax400743: mov %rsp,%rdi400746: callq 4006e0 <gets>40074b: mov %rsp,%rdi40074e: callq 400570 <puts@plt>400753: mov 0x8(%rsp),%rax400758: xor %fs:0x28,%rax400761: je 400768 <echo+0x39>400763: callq 400580 <__stack_chk_fail@plt>400768: add $0x18,%rsp40076c: retq

echo:

29


SettingUpCanary

echo:. . .movq %fs:40, %rax # Get canarymovq %rax, 8(%rsp) # Place on stackxorl %eax, %eax # Erase canary. . .



}

Beforecalltogets

30



Canary(8bytes)

[3] [2] [1] [0]

Segmentregister(don’tworryabout it)

buf ⟵%rsp


CheckingCanary

echo:. . .movq 8(%rsp), %rax # Retrieve from stackxorq %fs:40, %rax # Compare to canaryje .L6 # If same, OKcall __stack_chk_fail # FAIL

.L6:. . .



}

Aftercalltogets

Input:0123456

31



Canary(8bytes)

00 36 35 34

33 32 31 30 buf ⟵%rsp


Summary:Avoidingbufferoverflowattacks1. Avoidoverflowvulnerabilities

§ Uselibraryroutinesthatlimitstringlengths

2. Employsystem-levelprotections§ RandomizedStackoffsets§ Codeonthestackisnotexecutable

3. Havecompileruse“stackcanaries”

32

buffer overflows - courses.cs.washington.edu€¦ · buffer overflows spring 2016 x86-64 linux...

Documents

Sploit 101 Buffer Overflows, Format Strings, Heap Overflows

Lab 2: Buffer Overflows - Computer Science - Wayne … 2: Buffer Overflows Introduction In this lab, you will learn how buffer overflows and other memory vulnerabilities are used to

Buffer Overflows - University of Washington€¦ · L15: Buffer Overflow CSE351, Spring 2017 x86‐64 Linux Memory Layout Stack Runtime stack has 8 MiBlimit Heap Dynamically allocated

Stack Buffer Overflows at W ork Secure Bit

2 buffer overflows

DETECTING BUFFER OVERFLOWS USING TESTCASE SYNTHESIS …

ICT security 2002/2003 1 Buffer Overflows (stack based) Alberto Ornaghi Lorenzo Cavallaro

Finite Buffer Fluid Networks with Overflows

Exploit exercises.com stack-overflows

Buffer Overflows Dummies 481

Buffer Overflows Etc

International Summer School on Information and System Security 2003 1 Stack Based Buffer Overflows Alberto Ornaghi Lorenzo Cavallaro

Buffer Overflows - uniroma1.itparisi/Risorse/BufferOverflow.pdf · 2 3 Buffer Overflows a.k.a. "Buffer Overrun" A buffer overflow happens when a program attempts to read or write

Intro to Exploitation Stack Overflows

Buffer Overflows - Swarthmore CollegeClassic Security Vulnerability •“Smashing The Stack For Fun And Profit” … Older stack frames. … Caller’s local variables. Final Argument

Buffer Overflows Julio Auto - jam. Roteiro Introdução Stack Overflows Heap Overflows Integer Overflows Format String Attacks Conclusões Referências

Buffer Overflows - courses.cs.washington.edu

Buffer Overflows - Swarthmore Collegekwebb/cs31/f18/BufferOverflow.pdf•See “Smashing The Stack For Fun And Profit” … Older stack frames. … Caller’s local variables. Final

Buffer Overflows and Defenses - Rutgers University...Stack Buffer Overflow occurs when buffer is located on stack used by Morris Worm “Smashing the Stack” paper popularized it

LN. 6 Buffer Overflow Attacks (2)securesw.dankook.ac.kr/ISS19-2/2019_OS_Se_6_2_Buffer... · 2019-10-06 · Contents Buffer Overflows: Stack Smashing, Heap overflow, Global data overflow

Exploiting buffer overflows

Smashing the Stack Buffer Overflows for Fun and Profit Mark Shaneck November 2, 2004 Mark Shaneck November 2, 2004

buffer overflows for beginners - DavidLitchfield.comdavidlitchfield.com/buffer_overflows_for_beginners.pdf · Buffer Overflows for Beginners ... stack is also the place where data

Buffer Overflows - courses.cs.washington.edu€¦ · Buffer overflow bugs can allow attackers to execute arbitrary code on victim machines. L15: Buffer Overflows CSE351, Autumn 2019

Stack based buffer overflow Exploitation- Tutorial · Stack Based Buffer Overflows Introduction: I decided to get a bit more into Linux exploitation, so I thought it would be nice

Buffer Overflows 101: Some Assembly Required

Buffer Overflows : An In-depth Analysis. Introduction Buffer overflows were understood as early as 1972 The legendary Morris Worm made use of a Buffer

Brian E. Brzezicki. This tutorial just illustrates the underlying concepts of buffer overflows by way of an extremely simple stack overflow Most buffer

Smashing The Stack - University of RichmondSummer 2017 Roadmap 1 Smashing The Stack A detailed look at buffer overflows as described in Smashing the Stack for Fun and Profit by Aleph

Menos Buffer Overflows, más SQL Injections

Writing Windows Buffer Overflows _ Mad Irish

More on Buffer Overflows

CSE 127: Computer Security Stack Buffer Overflowsdstefan/cse127-winter19/slides/lecture6.pdf · Stack Buffer Overflows Deian Stefan Adopted from Kirill Levchenko, Stefan Savage, and

Buffer Overflows with Content

Buffer Overflows Dummies 481 - SANS