Exploiting Buffer Overflows on

AIX/PowerPCHP-UX/PA-RISCSolaris/SPARC

                                 

                 

Buffer Overflow

• “Buffer overflow” is a famous/infamous hacking technique in computer security.

• Buffer overflow conditions are caused by missed boundary checks of user-supplied data.

• Implementation and exploitation of buffer overflow vulnerabilities is heavily dependant on the target OS and architecture.

• Exotic architecture doesn’t mean – secure.

Function Call and Stack

Stack

Text

Data

Frame Pointer

Stack Pointer

Instruction Pointer

Function Call and Stack specifics

• Stack could grow in different directions• Stack frame formats are different• Different conditions has to be met on different

platforms for buffer overflow to be exploitable.(double return, calls of sub procedures, alignments …)

• Return address has to be overwritten• Frame ptr/stack ptr has to be overwritten

Function Call and Stack

Arguments

Return address

Local variables

Another framepointer

Frame pointer

Smashing the Stack

How to overwrite the return address?

void sickfunc(char *str)

{

char buf[512];

strcpy(buf, str);

}

int main(int argc, char *argv[])

{

if (argv[1])

sickfunc(argv[1]);

}

Smashing the Stack

• Generate a string length are more than 512, here we use 520 A’s (distance may differ)

• Use the string as argument of the program, and look at the stack.

Smashing the Stack

• It overwrites the return address to 0x41414141(AAAA)

• You can design an executable code in the string and overwrite the return address to the address of the code, then you can control the system.

Smashing the Stack

• The above example, buffer overflow is caused by absence of boundary checks.

• Not only absence of boundary checks, but also wrong typecastings lead to buffer overflow conditions.

Smashing the Stack

void sickfunc(char *foo)

{

int length=foo[0];

char baz[64];

if (length>=64)

return;

strncpy(baz, &foo[1], length);

buff[63]=‘\x0’;

}

Smashing the Stack

• Although in most cases, exploiting buffer overflow try to overwrite the return address to return the stack, but there are other ways.

• Overwrite the frame pointer is an alternative.• Overwrite a local variable pointer, and use the

pointer to overwrite GOT entries (stack and heap overflows).

• Overwrite the return address to libc (getting around non-executable stack protections)

Shellcode

• Shellcode is a short fragment of machine code which is ‘injected’ into execution flow.

• Shellcode is machine/OS specific• The most common shellcodes are shell-spawns

using execve syscalls (but not the only implementations)

What to do?

• Because of the implementation of stack differences in platform, to exploit buffer overflows on non-intel platform are a bit tricky

• These tricks and specifics are going to be explored in our presentation.

• An multi-platform shellcode design concept will be covered briefly.

What we will see?

• Buffer overflow exploitations on non-intel platforms are nearly as trivial as on its intel brother.

• Having vulnerable software running on some exotic platform doesn’t give you security

• Something else ;p

What you have to know

• Understanding of basics of assembly language• Understanding of i386 platform buffer overflows

concept• Tools and utilities (perl, adb, gdb, gcc, as)

What we will learn…

• Writing shellcodes on HP-UX, Solaris and AIX platforms.

• Basic requirements for buffer overflows on these platforms to be exploitable

• Injecting shellcode platform specifics• Creating advanced shellcodes