harden your program the hard way - hitcon · 2017-08-29 · harden your program the hard way by jhe...
TRANSCRIPT
![Page 1: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/1.jpg)
Harden your programthe hard way
by Jhe & Eddy@HITCON-CMT
![Page 2: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/2.jpg)
Who am I ?
● Jhe
● co-founder of UCCU
● know a little
○ Web security
○ Linux exploitation
○ Python
![Page 3: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/3.jpg)
Who are we ?
Kuon : PM
Jhe : Exploit PoC
Eddy : Solution implementation
AJ : Solution implementation
![Page 4: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/4.jpg)
![Page 5: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/5.jpg)
Why ?
![Page 6: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/6.jpg)
Operating System
Container Container
Application Application
Runtime Runtime Runtime
![Page 7: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/7.jpg)
Operating System
Container Container
Application Application
Runtime Runtime Runtime
![Page 8: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/8.jpg)
Operating System
Container Container
Application Application
Runtime Runtime Runtime
![Page 9: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/9.jpg)
Compiler-based approach security
solution
![Page 10: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/10.jpg)
In a nutshell
![Page 11: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/11.jpg)
Harden your program after compiled
![Page 12: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/12.jpg)
Prerequisites
Modern Linux Mitigations
Some Exploit Skills
Homemade Mitigations
UCCU
Summary & Discussion
![Page 13: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/13.jpg)
Prerequisites
Modern Linux Mitigations
Some Exploit Skills
Homemade Mitigations
UCCU
Summary & Discussion
![Page 14: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/14.jpg)
Prerequisites
1. Terms
![Page 15: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/15.jpg)
Prerequisites
1. Terms
2. Buffer overflow attack
![Page 16: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/16.jpg)
Prerequisites
1. Terms
2. Buffer overflow attack
3. Use after free
![Page 17: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/17.jpg)
Vulnerabilityvs
Exploit
Terms Buffer overflow Use after free
![Page 18: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/18.jpg)
Proof of Concept(PoC)
Terms Buffer overflow Use after free
![Page 19: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/19.jpg)
Mitigation
Terms Buffer overflow Use after free
![Page 20: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/20.jpg)
Buffer overflow(Bof)
Terms Buffer overflow Use after free
![Page 21: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/21.jpg)
Moving TargetDefense (MTD)
Terms Buffer overflow Use after free
![Page 22: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/22.jpg)
MTD = confuse yourenemie s
Terms Buffer overflow Use after free
![Page 23: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/23.jpg)
Terms Buffer overflow Use after free
Stack-based Heap-based
![Page 24: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/24.jpg)
Terms Buffer overflow Use after free
local variable
local variable base pointer return
address
![Page 25: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/25.jpg)
Terms Buffer overflow Use after free
AAAA local variable base pointer return
address
![Page 26: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/26.jpg)
Terms Buffer overflow Use after free
AAAA AAAA base pointer return address
![Page 27: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/27.jpg)
Terms Buffer overflow Use after free
AAAA AAAA AAAA return address
![Page 28: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/28.jpg)
Terms Buffer overflow Use after free
AAAA AAAA AAAA AAAA
![Page 29: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/29.jpg)
Terms Buffer overflow Use after free
AAAA AAAA AAAA AAAA
![Page 30: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/30.jpg)
Terms Buffer overflow Use after free
malloc(TWs)TWs->say()free(TWs)
![Page 31: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/31.jpg)
Terms Buffer overflow Use after free
malloc(TWs)TWs->say()free(TWs)
![Page 32: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/32.jpg)
Terms Buffer overflow Use after free
malloc(TWs)TWs->say()free(TWs)
Taiwan number ONE !!!!!!!!!!!!!!!!!!!
![Page 33: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/33.jpg)
Terms Buffer overflow Use after free
malloc(TWs)TWs->say()free(TWs)
![Page 34: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/34.jpg)
Terms Buffer overflow Use after free
malloc(TWs)free(TWs)malloc(Xs)TWs->say()
![Page 35: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/35.jpg)
Terms Buffer overflow Use after free
malloc(TWs)free(TWs)malloc(Xs)TWs->say()
![Page 36: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/36.jpg)
Terms Buffer overflow Use after free
malloc(TWs)free(TWs)malloc(Xs)TWs->say()
![Page 37: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/37.jpg)
Terms Buffer overflow Use after free
XXXXXXXX
malloc(TWs)free(TWs)malloc(Xs)TWs->say()
![Page 38: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/38.jpg)
Terms Buffer overflow Use after free
XXXXXXXX
malloc(TWs)free(TWs)malloc(Xs)TWs->say()
Segmentationfault(core dump)
![Page 39: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/39.jpg)
Prerequisites
Modern Linux Mitigations
Some Exploit Skills
Homemade Mitigations
UCCU
Summary & Discussion
![Page 40: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/40.jpg)
Address Space Layout
Randomization
ASLR DEP Stack guard
![Page 41: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/41.jpg)
ASLR DEP Stack guard
Code AAAA AAAA Addr.
![Page 42: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/42.jpg)
ASLR DEP Stack guard
Code AAAA AAAA Addr.
![Page 43: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/43.jpg)
ASLR DEP Stack guard
Code AAAA AAAA Addr.
![Page 44: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/44.jpg)
ASLR DEP Stack guard
Code AAAA AAAA Addr.
![Page 45: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/45.jpg)
Data Execution Prevention
ASLR DEP Stack guard
![Page 46: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/46.jpg)
Code AAAA AAAA Addr.
ASLR DEP Stack guard
![Page 47: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/47.jpg)
Code AAAA AAAA Addr.
ASLR DEP Stack guard
![Page 48: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/48.jpg)
Stack guard
ASLR DEP Stack guard
![Page 49: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/49.jpg)
ASLR DEP Stack guard
Local variable
Stack guard
Base pointer
Return address
![Page 50: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/50.jpg)
ASLR DEP Stack guard
Local variable
Stack guard
Base pointer
Return address
![Page 51: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/51.jpg)
ASLR DEP Stack guard
AAAA 0xDEAD Base pointer
Return address
![Page 52: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/52.jpg)
ASLR DEP Stack guard
AAAA AAAA Base pointer
Return address
![Page 53: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/53.jpg)
ASLR DEP Stack guard
AAAA AAAA AAAA AAAA
![Page 54: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/54.jpg)
ASLR DEP Stack guard
AAAA AAAA AAAA AAAA
![Page 55: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/55.jpg)
Prerequisites
Some Exploit Skills
Modern Linux Mitigations
Homemade Mitigations
UCCU
Summary & Discussion
![Page 56: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/56.jpg)
Function Pointer overwrite
FP overwrite
ROP BROP offset2lib
![Page 57: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/57.jpg)
FP overwrite
ROP BROP offset2lib
local variable
function pointer
Stack GUARD
base pointer
return address
![Page 58: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/58.jpg)
FP overwrite
ROP BROP offset2lib
local variable
function pointer
Stack GUARD
base pointer
return address
![Page 59: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/59.jpg)
FP overwrite
ROP BROP offset2lib
AAAA
XXXX
Stack GUARD
base pointer
return address
![Page 60: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/60.jpg)
Return Oriented Programming
FP overwrite
ROP BROP offset2lib
![Page 61: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/61.jpg)
FP overwrite
ROP BROP offset2lib
pop RSIret
pop RDIret
pop RDXret
pop RCXret
Function
![Page 62: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/62.jpg)
FP overwrite
ROP BROP offset2lib
pop RSIret
pop RDIret
pop RDXret
pop RCXret
Function
![Page 63: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/63.jpg)
FP overwrite
ROP BROP offset2lib
pop RSIret
pop RDIret
pop RDXret
pop RCXret
Function
![Page 64: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/64.jpg)
Blind ROP
FP overwrite
ROP BROP offset2lib
http://www.scs.stanford.edu/brop/
![Page 65: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/65.jpg)
Stack reading
FP overwrite
ROP BROP offset2lib
![Page 66: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/66.jpg)
FP overwrite
ROP BROP offset2lib
Apache
Nginx
Samba
OpenSSH
Parent process
worker
CVE 2013-2028
worker worker
![Page 67: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/67.jpg)
FP overwrite
ROP BROP offset2lib
Apache
Nginx
Samba
OpenSSH
Parent process
worker
fork fork fork
CVE 2013-2028
worker worker
![Page 68: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/68.jpg)
FP overwrite
ROP BROP offset2lib
![Page 69: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/69.jpg)
Offset to library
FP overwrite
ROP BROP offset2lib
https://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
![Page 70: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/70.jpg)
![Page 71: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/71.jpg)
Prerequisites
Modern Linux Mitigations
Some Exploit Skills
Homemade Mitigations
UCCU
Summary & Discussion
![Page 72: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/72.jpg)
Compiler-based = Front-end +
IR +Back-end
![Page 73: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/73.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
![Page 74: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/74.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
return address is also pointer
![Page 75: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/75.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
buffer
function pointer
Stack GUARD
base pointer
return address
![Page 76: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/76.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
buffer
function pointer
Stack GUARD
base pointer
return address
function pointer
buffer
Stack GUARD
base pointer
return address
![Page 77: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/77.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
buffer
function pointer
Stack GUARD
base pointer
return address
function pointer
buffer
Stack GUARD
base pointer
return address
function pointer
buffer
Stack GUARD
base pointer
return address
encode
encode
decode
decode
![Page 78: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/78.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
Function
Function
Function
Function
Function
CVE 2012-4221
![Page 79: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/79.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
Function
Function
Function
Function
Function
Function
padding
Function
padding
CVE 2012-4221
padding
![Page 80: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/80.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
Function
Function
Function
Function
Function
Function
padding
Function
padding
CVE 2012-4221
padding
Function
Function
padding
Function
padding
![Page 81: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/81.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
local variable local variable local variable local variable
![Page 82: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/82.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
local variable local variable local variable local variable
local variable local variable local variable local variable
![Page 83: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/83.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
buffer
Canary
Canary
base pointer
return address
![Page 84: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/84.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
buffer
Canary
Canary
base pointer
return address
extra bird
original bird
![Page 85: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/85.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
AAAAAAAA
AAAAary
Canary
base pointer
return address
![Page 86: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/86.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
AAAAAAAA
AAAAary
Canary
base pointer
return address
![Page 87: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/87.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
AAAAAAAA
AAAAary
Canary
base pointer
return address
(Usually)
![Page 88: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/88.jpg)
FP protection
Functionpadding
Variablere-order
Two birds
buffer
Canary
Canary
base pointer
return address
extra bird
original bird
![Page 89: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/89.jpg)
Prerequisites
Modern Linux Mitigations
Some Exploit Skills
Homemade Mitigations
UCCU
Summary & Discussion
![Page 90: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/90.jpg)
Summary & discussion
1. Any trade-off ?
![Page 91: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/91.jpg)
Summary & discussion
1. Any trade-off ?
2. Does it work ? How to proof ?
![Page 92: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/92.jpg)
Building Environment(Docker,VM)
![Page 93: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/93.jpg)
Building Environment(Docker,VM)
Building reliablePoC
![Page 94: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/94.jpg)
Building Environment(Docker,VM)
Building reliablePoC
Solution apply(Compiler-based)
![Page 95: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/95.jpg)
Building Environment(Docker,VM)
Building reliablePoC
Exploit failed Solution apply(Compiler-based)
![Page 96: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/96.jpg)
Building Environment(Docker,VM)
Building reliablePoC
Exploit failed Solution apply(Compiler-based)
![Page 97: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/97.jpg)
Summary & discussion
1. Any trade-off ?
2. Does it work ? How to proof ?
3. Seems perfect ?
![Page 98: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/98.jpg)
Prerequisites
Modern Linux Mitigations
Some Exploit Skills
Homemade Mitigations
UCCU
Summary & Discussion
![Page 99: Harden your program the hard way - HITCON · 2017-08-29 · Harden your program the hard way by Jhe & Eddy@HITCON-CMT. Who am I ? Jhe co-founder of UCCU ... Harden your program after](https://reader030.vdocuments.net/reader030/viewer/2022040308/5f086caa7e708231d421f1c0/html5/thumbnails/99.jpg)
Questions ?
https://fb.com/UCCU.Hacker