Dangling Pointer Dangling Pointer Jonathan Afek, 2/ 8/ 07, BlackHat - PowerPoint PPT Presentation

Dangling Pointer Dangling Pointer Jonathan Afek, 2/ 8/ 07, BlackHat USA 1

Table of Contents � What is a Dangling Pointer? � Code Injection � Object Overriding � Demonstrations � Remediation � Summary � Q&A 2

What is a Dangling Pointer? Invalid Pointer: � Dangerous Dangling Dangling Pointer Pointer � Easy to Exploit Pointer Pointer Pointer Pointer Pointer Pointer � Common Deleted Deleted Object Object New Data Object New Data Object Object Object Object Object 3

What is a Dangling Pointer? – An Example � Results: Crash 4

What is a Dangling Pointer? – An Example � Debugger View 5

Where are We � What is a Dangling Pointer? � Code I njection � Object Overriding � Demonstrations � Remediation � Summary � Q&A 6

Code I njection – The Layout of an Object � Class_A: class Class_A Instance_A memory Class_A VFTable vfunc_A1 Code class Class_A Instance_A memory Class_A VFTable vfunc_A1 Code VFTABLE Pointer vfunc_A1 address { VFTABLE Pointer vfunc_A1 address { Assembly code Assembly code member_of_A int member_of_A; vfunc_A2 address member_of_A int member_of_A; vfunc_A2 address public: public: vfunc_A2 Code virtual long vfunc_A1(); vfunc_A2 Code virtual long vfunc_A1(); { { … virtual long vfunc_A2(); … virtual long vfunc_A2(); ... ... Assembly code Assembly code MOVE EAX, [ECX] MOVE EAX, [ECX] static void sfunc_A(); static void sfunc_A(); this.vfunc_A2(); this.vfunc_A2(); CALL [EAX + 4] CALL [EAX + 4] ... ... void funcA(); void funcA(); … } … } }; }; 7

Code I njection – The Double Reference Exploit Exploit Overview: – Free the Object – Override the Object – covered later – Execute a Virtual Function 8

Code I njection – The Double Reference Exploit � Injecting Code � Continue – Free the Object – Automation – Shellcode – Call/Jmp ECX ECX – Original – Finding a “VFTABLE” ECX – Original Object Object – Interpreted as Code VFTABLE Pointer VFTABLE VFTABLE Pointer VFTABLE VFTABLE + 4 VFTABLE + 4 Original Object Freed Space Original Object Freed Space VFTABLE + 8 Pointer VFTABLE + 8 Pointer SHELLCODE SHELLCODE VFTABLE + C VFTABLE + C VFTABLE + 10 CALL/JMP ECX VFTABLE + 10 CALL/JMP ECX 9 9

Code I njection – Double I nheritance Class_A::vfunc_A1 Class_A::vfunc_A1 � Multiple Inheritance Assembly code Assembly code Inherited::Class_A Inherited::Class_A Object’s memory Object’s memory VFTable VFTable class Inherited: public Class_A, public Class_B Inherited::vfunc_A2 class Inherited: public Class_A, public Class_B Inherited::vfunc_A2 A VFTABLE Pointer vfunc_A1 address A VFTABLE Pointer vfunc_A1 address { { Class A member_of_A vfunc_A2 address member_of_A vfunc_A2 address Assembly code public: Assembly code public: � We can now override the second VFTABLE!!! B VFTABLE Pointer B VFTABLE Pointer virtual int vfunc_A2(); virtual int vfunc_A2(); Inherited::Class_B Inherited::Class_B member1_of_B VFTable Class B member1_of_B VFTable virtual int vfunc_B2(); Class_B::vfunc_B1 virtual int vfunc_B2(); Class_B::vfunc_B1 vfunc_B1 address vfunc_B1 address Member2_of_B }; Member2_of_B }; vfunc_B2 address vfunc_B2 address Assembly code Assembly code Inherited::vfunc_B2 Inherited::vfunc_B2 Assembly code Assembly code 10 10

Where are We � What is a Dangling Pointer? � Code Injection � Object Overriding � Demonstrations � Remediation � Summary � Q&A 11

Object Overriding � Allocation Implementation – Numerous heaps • Two Default heaps • Different API • C-Runtime functions – Malloc – Free – New – Delete – Etc. 12 12

Object Overriding � Allocation implementation details – Lookaside List • A list for each size (8-1024) (8) and for each heap • First Allocation Priority • Merges A De-Allocated Buffer Another De-Allocated A De-Allocated Buffer Another De-Allocated Buffer Buffer Next Buffer Pointer NULL Next Buffer Pointer NULL 40 40 40 40 Bytes Bytes Bytes Bytes Lookaside Lookaside list base list base pointer pointer 13 13

Object Overriding � And Finally – Overriding – Search for Allocations • Static Analysis – Method: Disassembly – Restriction: Static Size – Validation: Controllable Content – Usage: Causing the Allocation • Dynamic analysis – Method: API Breakpoints – Restriction: Static/Dynamic Size – Validation: Controllable Content 14 14

Object Overriding – The VFTABLE Exploit � Exploitation: � Continue: – Empty the Lookaside List – Free the Object – Allocate a Buffer – Execute a VFunc – Insert Content – Free the Buffer VFTABLE VFTABLE VFTABLE Pointer VFTABLE Pointer NULL SHELLCODE New Buffer SHELLCODE New Buffer Original Object Original Object VFTABLE + 8 Pointer Rest of Rest of CALL/JMP EAX CALL/JMP EAX SHELLCODE SHELLCODE 15

Object Overriding – The Lookaside Exploit � Empty the Lookaside � Free One Buffer � Allocate Two Buffers � Free The Other � Insert Shellcode � Free The Object � Execute the Destructor The De-Allocated The De-Allocated The Shellcode The De-Allocated The De-Allocated The Shellcode Object Buffer Buffer Object Buffer Buffer A VFTABLE A Function NULL A VFTABLE A Function NULL Pointer Pointer GAME OVER!!! Pointer Pointer Shellcode … … Shellcode … … 16 16

Object Overriding – The Lookaside Exploit � Executing NULL – NO Problem 17 17

Summary � Summary – Double Reference • Controllable First DWORD • Static Address – VFTABLE Exploit • Controllable Allocations • No First DWORD • Static Address – Lookaside Exploit • Controllable Allocations • No First DWORD • No Static Address • Destructor Execution 18

Where are We � What is a Dangling Pointer? � Code Injection � Object Overriding � Demonstrations � Remediation � Summary � Q&A 19

Demonstrations – Configuration I tem � Allocating the Object � De-Allocation the Object 20

Demonstrations – Configuration I tem � Allocating User Data 21

Demonstrations – Configuration I tem � Executing a VFunc 22

Demonstrations – Configuration I tem � Putting it Together – De-Allocate – Re-Allocate – Execute 23

Demonstrations – Remote Exploit � Another Exploit on IIS, but this time – a remote one 24

Where are We � What is a Dangling Pointer � Code Injection � Object Overriding � Demonstrations � Remediation? � Summary � Q&A 25

Remediation � Known Protection Mechanisms – NX Bit – ASLR � VFTABLE Sanitation � Safe Programming 26

Summary � Technical Background – Memory Allocations – Objects Implementation � Exploits – Double Reference Exploit – VFTABLE Exploit – Lookaside Exploit � Demonstrations – Configuration Item – Remote Exploit � Dangling Pointer – Only Object Oriented Objects 27

Questions � Ask Away… 28