noip2 stack buffer overflow

安全程式設計Noip2

Stack based buffer overflow第五組：林昱辰陳宗暉蘇才維吳尚浩閻昱萱

漏洞出處

軟體介紹： Noip

Noip 是全球最知名的動態 DNS 提供商，他們的動態更新客戶端存在於眾多的系統、軟體和嵌入式軟體中

漏洞成因：

Summary:

File Format:ELF 32 bitDynamically linkedNot Stripped

Payload = (292 - 21)*nop + shellcode + ret_address ↑ buffer 到 ret address 的 bytes 數 – shellcode bytes 數

Shellcode 21 個 bytes ↓

SCRIPT

Nop Slide

結束

才怪

因為 shellcode 出了點意外，換了好多個都無法提權， SO…… 我們決定做個小彌補

Noip2Stack based buffer overflow BETA

利用 ret2ibc+ROP 繞過 NX

DEPData Execution Prevention可寫的地方不可執行，可執行的地方不可寫gcc: -zexecstack( 關閉 NX)

shellcode

shellcodeshellcode

shellcode

STACK

ROPReturn Oriented Programming返回導向編程執行針對性的機器語言指令序列 (=Gadget)RET 到自身含有 ret 的代碼上

Gadget名詞：小機具、小組件一段一段由 ret 組成的程式碼片段

CODE:Func(argv1, argv2)

STACK

argv2ESP→

Assembly:PUSH argv2

STACK

argv2argv1ESP→


Assembly:PUSH argv2PUSH argv1

STACK

argv1argv2

Ret addrESP→


Assembly:PUSH argv2PUSH argv1call Func

STACK

argv2argv1

Ret addrPrev ebpESP→ CODE:

Func(argv1, argv2)

Assembly:PUSH argv2PUSH argv1call Funcpush EBP

argv2argv1

Ret addrPrev ebpEBP=ESP→ CODE:

Func(argv1, argv2)

Assembly:PUSH argv2PUSH argv1call Funcpush EBPMOV EBP,ESP

STACK

argv2argv1

Ret addrPrev ebpbuffer

EBP→ CODE:Func(argv1, argv2)

Assembly:PUSH argv2PUSH argv1call Funcpush EBPMOV EBP,ESPSUB ESP,8

ESP→

Ret2Libc

執行 C 語言程式通常都會載入Libc 裡面有很多好用的 function

覆蓋返回地址為現有函數地址※ 不能 return 到 shellcode ，就 return 到現有函式上偽造堆疊，建立函數呼叫

AAAA system() ret_addr ptr“/bin/bash”

STACK

HIGH

LOW

Ret_addr

Libc Function = Libc Base Address + Function Offset ↑ ↑ 動態載入決定固定不變 (NoASLR→ 固定 )

SCRIPT

AAAAgets_func@libc

pop_retgets_argv_addr

system@libcAAAA

gets_argv_addr

Padding

讀 /bin/bash 字串進來清空 stack + Chain

存 /bin/bash 字串在 bss segment

執行不重要隨便打system 的參數 ( 跟上面那個同地址 )

結束

真的啦

noip2 stack buffer overflow

Education

Stack based buffer overflow Exploitation- Tutorial · Stack Based Buffer Overflows Introduction: I decided to get a bit more into Linux exploitation, so I thought it would be nice

Buffer Overflow Attack

System Security - Attack and Defense for CSE 610 Special ... Stac… · 1. Stack-based buffer overflow-1 a. Brief history of buffer overflow b. Program variables (global, local, initialized,

[ Apple Quicktime TeXML Stack Buffer Overflow ]index-of.co.uk/Reverse-Engineering/Apple Quicktime TeXML Stack Buffer Overflow [NSHC...해당 모듈은 단순한 버퍼 오버플로우

Stack allocation and buffer overflow

Binary‐level program analysis: Stack Smashinggxt29/teaching/cse597s19/slides/04StackSmashi… · Buffer Overflow •A buffer overflow occurs when data is written ... Smashing the

Buffer Overflow and Stack Smashingshmat/courses/cs345/08overflow.pdfBuffer Overflow and Stack Smashing. slide 1. slide 2. Reading Assignment ... Morris Worm and Buffer Overflow One

Vitaly Shmatikov CS 345 Buffer Overflow and Stack Smashing slide 1

Stack Overflow

Buffer Overflow and Stack Smashing

Buffer overflow group

Vitaly Shmatikov Buffer Overflow and Stack Smashing slide 1

Stack Buffer Overflow Attack

Aprenda Stack Buffer Overflow Como Si Estuviera en Primero

Buffer Overflow or Stack smashing

Buffer Overflow Exploits

Buffer Overflow ou Stack Overrun ou Stack smashing

Buffer Overflow Attacks

LN. 6 Buffer Overflow Attacks (2)securesw.dankook.ac.kr/ISS19-2/2019_OS_Se_6_2_Buffer... · 2019-10-06 · Contents Buffer Overflows: Stack Smashing, Heap overflow, Global data overflow

Buffer Overflows and Defenses - Rutgers University...Stack Buffer Overflow occurs when buffer is located on stack used by Morris Worm “Smashing the Stack” paper popularized it

CISC 3320 C31b System Security: Threats - GitHub Pages · Protecting from Buffer Overflow •Buffer overflow can be disabled by disabling stack execution or adding bit to page table

· Web viewBOU (Buffer Overflow Utility) Testing for Heap Overflow Conditions: heap.exe Steps for Testing for Stack Overflow in OllyDbg Debugger Testing for Stack Overflow in OllyDbg

Buffer Overflow Attackscshen/367/notes/Buffer Overflow.pdf · 2016. 2. 9. · Stack Buffer Overflow • Occur when buffer is located on stack – also referred to as stack smashing

Buffer Overflows - University of Washington€¦ · L15: Buffer Overflow CSE351, Spring 2017 x86‐64 Linux Memory Layout Stack Runtime stack has 8 MiBlimit Heap Dynamically allocated

Smashing the Stack Overview The Stack Region Buffer Overflow Shell Program Notes Avoiding Buffer Overflows Conclusion

Buffer Overflow

Stack Based Windows Buffer Overflow

Buffer overflow and stack smashing attacks Principles of application software security

Buffer Overflow Attacksecuresw.dankook.ac.kr/.../2019_OS_Se_06_Buffer_Overflow.pdf · 2019-09-30 · •Buffer overflow is a common security flaw •We only focused on stack-based

Aprenda Stack Buffer Overflow

Network Security, 2015-2016 Stack Based Buffer Overflow ... Stack Based Buffer Overflow Exploit Laboratory Report Prepared By: ... In buffer overflow attack an application is manipulated

Buffer Overflow

Buffer overflow – Smashing The Stack

Documento Stack Buffer Overflow

Buffer Overflow Attacks - Donald Bren School of ...stasio/ics8-w12/Week4 - Buffer Overflow Attacks.pdf · Smashing The Stack For Fun And Profit. e-zine #49, 1996 •The attacker exploits