return oriented programming (rop) based exploits - part i
DESCRIPTION
Return Oriented Programming (ROP) Based Exploits - Part I by Anish & Team @ null B'lore Meet in September, 2010TRANSCRIPT
Return Oriented Programming (ROP) Based Exploits - Part I
Exploit - ex·ploit
to use selfishly for one's own ends
Exploit Discovery
Big space in computer security
Exploits are discovered by Security Researchers and Hackers alike
Zero day attacks are a result of newly created exploits or un-patched vulnerabilities
Exploit Mitigation
Windows XP Sp2 was the first widespread OS to incorporate exploit mitigation
Protected stack metadata (Visual studio compiler/ GS flag)Protected heap metadata (RtlHeap Safe Unlinking)SafeSEH (Compile time execution handler registration)Software, Hardware enforced Data Execution Prevention (DEP)
Windows Vista implements Address Space Layout Randomization (ASLR)
Break the mitigation
BlackHat Presentations
Security Forums
Blogs
Whose responsibility is it to mitigate ?
Heap ProtectionSEH Chain validation
Stack CookiesSafe SEH
DEPASLR
OS
ApplicationCompiler
DEP - Data Execution Prevention
When an attempt is made to execute code from a DEP protected data page,an access violation (STATUS_ACCESS_VIOLATION (0xc0000005)) will occur.
In most cases, this will result in process termination (unhandled exception).
DEP - Data Execution Prevention
Without DEP On
With DEP On
Problem
With DEP on, code from the stack won’t work
Work-Around
We need to build a chain of instructions. We need to jump from one part of the chain to the other part of the chain without ever executing a single bit from our DEP protected region.
Or, to use a better term, we need to return from one instruction to the address of the next instruction
Each instruction (series of instructions) in our chain will be called a "gadget".
Each gadget will return to the next gadget ( = to the address of the next gadget, placed on the stack), or will call the next address directly.
We will need to use existing instructions (instructions in executable areas within the process)
and put them in such an order (and "chain" them together) so they would produce what we
need and put data in registers and/or on the stack
Letter
The chocolate bombs you sent, bombs they are in size . Received them, yesterday. Planted the rose plant, bomb was delicious … had to mention again. Set to go for shopping, 5 p.m. tomorrow.
The chocolate bombs you sent, bombs they are in size . Received them, yesterday. Planted the rose plant, bomb was delicious … had to mention again. Set to go for shopping, 5 p.m. tomorrow.
The bombs Received yesterday Planted bomb Set 5 p.m. tomorrow
Don’t sleep yet
Gadget
We need to take a value from the stack, put it in EAX, and increase it with 0×80
Gadget
WindowsFunction_1()
ADD EBX, 30TEST AL, AL
WindowsFunction_2()
INC EAX
-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - --
-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - --
-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - --
POP EAXRET
ADD EAX, 80POP EBXRET
We need to take a value from the stack, put it in EAX, and increase it with 0×80
POP EAXRET
ADD EAX, 80POP EBXRET
Gadget
Stack address Stack value ESP points here -> 0010F730 10026D56 (pointer to POP EAX + RET)
0010F734 50505050 (this will be popped into EAX) 0010F738 1002DC24 (pointer to ADD EAX,80 + POP
EBX + RET) 0010F73C DEADBEEF (this will be popped into EBX,
padding)
Windows Function Calls to bypass DEP
VirtualAlloc(MEM_COMMIT + PAGE_READWRITE_EXECUTE) + copy memory. This will allow you to create a new executable memory region, copy your shellcode to it, and execute it
HeapCreate(HEAP_CREATE_ENABLE_EXECUTE) + HeapAlloc() + copy memory.
SetProcessDEPPolicy()
NtSetInformationProcess()
VirtualProtect(PAGE_READ_WRITE_EXECUTE). This function will change the access protection level of a given memory page, allowing you to mark the location where your shellcode resides as executable.
WriteProcessMemory()
Windows Function Calls to bypass DEP
Each one of those functions requires the stack or registers to be set up in a specific way.when an API is called, it will assume that the parameters to the function are placed at the top of the stack (= at ESP)
How to chain
Demo
Finding ROP gadgets
There are 2 approaches to finding gadgets that will help you building the ROP chain :
You can specifically search for instructions and see if they are followed by a RET. The instructions between the one you are looking for, and the RET instruction (which will end the gadget) should not break the gadget.
You can look for all RET instructions and then walk back, see if the previous instructions include the instruction you are looking for. pvefindaddr
First part of the Exploit
Testing ROP with a Windows APIVirtualProtect()
Demo
Now you can sleep
Thank You
Images
http://s280.photobucket.com/albums/kk176/sabbath_X/?action=view¤t=Pumpkin_ Grin_lll_by_midnightINK.jpg&newest=1
http://www.indiamike.com/india/attachments/7595d1210760693-what-the-strange-questions-for-india-experts-chilli-and-lemon.jpg
http://www.animevice.com/profile/kao/all-images/84-142612/albert_wesker___reside nt_evil_by_megakay/83-203102/
http://la-vie-bohem.deviantart.com/art/Yawn-115528201?q=boost%3Apopular+yawn+baby&qo=32
http://SillyScreamingQueen.deviantart.com/art/Sleepy-54882830?q=boost%3Apopular+sleepy&qo=6