1 / 22

Introduction to InfoSec – Recitation 2

Introduction to InfoSec – Recitation 2. Nir Krakowski ( nirkrako at post.tau.ac.il) Itamar Gilad ( itamargi at post.tau.ac.il). Today. More assembly tips Review of the stack Stack overflows Implementation Tools. Little vs Big Endian.

calum
Download Presentation

Introduction to InfoSec – Recitation 2

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Introduction to InfoSec – Recitation 2 Nir Krakowski (nirkrako at post.tau.ac.il) ItamarGilad (itamargi at post.tau.ac.il)

  2. Today • More assembly tips • Review of the stack • Stack overflows • Implementation • Tools

  3. Little vs Big Endian • Endian-ity is the definition of how numbers are represented in memory (or on a data bus) • In the x86 architecture 0x11223344 would be represented in memory: • 44 33 22 11 • Intel Architecture is little endian. (we are using little) • However the same number in Big Endian would be: • 11 22 33 44 • (we don’t see the bit reordering because our minimum working unit is a byte)

  4. Registers • Common uses: • eax – used usually for fast calculations / system call numbers /used to pass the return value or self class in c++. • ecx – used as a counter frequently. • ebp – used to store the stack frame pointer • esp – used to store the stack pointer • edi/esi – used for string/buffer manipulations • ip – used to store the current instruction pointer – can not be accessed directly!

  5. More on register functionality • Most registers can be (CPU-wise) variably be used for different purposes. • However, Some register can not be used with certain commands. • Example: • moveip, 0xaddress ; this command is impossible. • loop some_label ;works only with ecx. • EIP specifically can’t be manipulated directly at all. instead we use: jmp, call, retto manipulate it.

  6. x86 stack manipulation • The x86 stack location is noted by ESP (EBP has no direct role). • There are two commands to manipulate the stack: • push 0ximmediatepush regpush [from memory] • pop reg • However the stack can also be manipulated directly, eg.: • mov [esp+10h], 4 • mov [ebp-15h], 0

  7. x86 alternative instructions • There are lots of assembly instructions with varying sizes, and they can be used alternatively to fit certain constraints. • Compilers use alternative ways for optimization purposes: • Some opcodes take up less space in memory. • Some code shortcuts can be made. • Examples: • add esp,4push eax • Alternatively: • mov [esp-4], eax • moveax, 0 • Alternatively: • xoreax,eax • There are also 8 bit commands to access partial registers • mov al, 5 • There are 16 bit commands • mov ax, 65535

  8. Buffer’Os • History: • First documented buffer overflows were thought of in 1972 COMPUTER SECURITY TECHNOLOGY PLANNING STUDY (Page 61) • The first buffer overflows known in the wild were Stack’Os • Stack Overflows were widely introduced by Aleph One • Phrack Magazine Issue 49on November 8, 1996 • Title: Smashing the stack for fun and profit • http://www.phrack.org/issues.html?issue=49&id=14#article • Purpose: • Like when patching, we re-route the code to new code which adds new functionality. • We modify the behavior of a program without modifying the binary, and only by controlling the input! • Therefore we can subvert the original functionality of the code to any purpose.

  9. Where does it get reallyinteresting • When the program input is from a remote connection • Example: telnet • When the program has higher privileges • Example: su

  10. Executable in Disk • This is how the programappears on disk. • The operating system loaderloads the file and maps itinto program memory. • Loader maps the file tomemory according toinstructions defined in theELF file. • Loader creates new memorysection such as the ‘Stack’. • Loader calls the start of the program

  11. Process Memory Abstract • /------------------\ lower • | | memory • | Text | addresses • | | • |------------------| • | (Initialized) | • | Data | • | (Uninitialized) | • |------------------| • | | • | Stack | higher • | | memory • \------------------/ addresses

  12. Example1.c • void function(int a, int b, int c) { • char buffer1[5]; • char buffer2[10]; • } • void main() { • function(1,2,3); • }

  13. Stack Structure • bottom of top of • memory memory • buffer2 buffer1 sfp ret a b c • <------ [ ][ ][ ][ ][ ][ ][ ] • top of bottom of • stack stack • Our purpose is to overflow from buffer2 until we reach “ret” so that we point EIP to an arbitrary location of our choosing.

  14. shellcode example made simple • allocate “/bin/sh” • call execv(“/bin/sh”, NULL); • call exit(exit_code); • We will use system calls (interrupt 0x80) • Unlike call interrupt arguments are passed via the registers: • moveax, 0xb ; execvsystem call • movebx, [addr to “/bin/sh” ] • movecx, 0 ; NULL • Int 0x80

  15. Allocating “/bin/sh” • Not knowing where our code is located presents a challenge, since we know its is located somewhere near EIP, but we can read EIP directly instead we use the following “trick”: jmp end end: pop ebx ; Now ebx will hold the address to “/bin/sh” call beginning .string “/bin/sh”

  16. shellcode example with interrupt calls • jmpcall_start # jump to the end of the code to /bin/sh • start_shellcode: # label to jump back • pop ebx # put point to /bin/sh in ebx • xoreax,eax # zero eax, but dont use mov, because it include \x00 • mov al, 0xb # system call 0xb, - execve • xorecx, ecx # clear pointer to envp • int 0x80 # call a system call! • xoreax,eax # ignore return and reset to zero. • mov al, 0x1 # call exit system call • int 0x80 • call_start: • call start_shellcode • .string "/bin/sh"

  17. Shellcode • In the exercise, shellcode will be provided for you, there is no need to compile it, simply use it “as is”.

  18. NOP Slide • Slides EIP tobeginning ofcode. • Avoids fromIllegal Instruction • Protects againststack differences NOP Start CPU/EIP Shellcode Start

  19. Stack’o Example • Demo

  20. Tools List • gdb – GNU Debugger • Core dump analysis: gdb –core=core.dump • Ollydbg – (for windows) which we will not cover in the course. • IDA • va_to_offset.py – easy program to get offset of code in orig file. • ghex– can be used to patch the binary : • Once we have a search string to find the binary code, we can modify it • Other common tools for linux debugging: • ltrace – library tracing • strace – system call tracing • objdump – dump elf file and symbol information • strings – can be used to view strings inside a binary. • shellcode

  21. GDB Quick browse • Running gdb: • gdb ./executable • gdb –args=“./executable [params]” • gdb –core=[core_file_name] • r arg1 arg2 – runs the file with the specified arguments • si, ni – step instruction • s, n – step • info reg – print all registers • dump memory filename startaddressstopaddress • x/i address – disassemble at this address • p (char *) 0x234234 – print at this address as if it was a c-string. • x/bx address – print hex starting from this address • c – continue • b somefunction – sets a breakpoint

  22. The end

More Related