Lab 2: Buffer Overflows Fengwei Zhang Wayne State University - PowerPoint PPT Presentation

Lab 2: Buffer Overflows Fengwei Zhang Wayne State University Course: Cyber Security Prac@ce 1

Buffer Overflows • One of the most common vulnerabili@es in soEware • Programming languages commonly associated with buffer overflows including C and C++ • Opera@ng systems including Windows, Linux and Mac OS X are wriMen in C or C++ Wayne State University Course: Cyber Security Prac@ce 2

How It Works • Applica@ons define buffers in the memory – Unsigned char [10] • Applica@ons use adjacent memory to store variables, arguments, and return address of a func@on. • Buffer Overflows occurs when data wriMen to a buffer exceeds its size. Wayne State University Course: Cyber Security Prac@ce 3

Overflowing A Buffer • Defining a buffer in C – char buf[10]; • Overflowing the buffer – Char buf [10] = ‘x’; – strcpy(buf, “AAAAAAAAAAAAAAAAAAAAAAA”) Wayne State University Course: Cyber Security Prac@ce 4

Why We Care • Because adjacent memory stores program variables, parameters, and arguments • AMackers can change these values through overflowing a buffer • AMackers can gain control over the program flow to execute arbitrary code Wayne State University Course: Cyber Security Prac@ce 5

Process Memory Layout High memory Stack Heap Data Segment Text Segment Low memory Wayne State University Course: Cyber Security Prac@ce 6

Memory Layout for 32-bit Linux 1GB Kernel Space Local variable: int a Stack Func@on malloc() Heap 3GB Unini@alized sta@c variables: sta@c char *u BSS Segment sta@c char *s = “Hello world” Data Segment Text Segment (ELF) Binary of the program Wayne State University Course: Cyber Security Prac@ce 7

Virtual Memory Layout Wayne State University Course: Cyber Security Prac@ce 8

Stack Frame • The stack contains ac@va@on frames including local variables, func@on parameters, and return address • Star@ng at the highest memory address and growing downwards • Last in first out Wayne State University Course: Cyber Security Prac@ce 9

A Simple Program Add (2,3) High memory 3 2 int add (int a, int b) { Ret Address int c; EBP c = 1+b; C return c; } Low memory ESP Wayne State University Course: Cyber Security Prac@ce 10

Another Program int func (char * str) { char mybuff[512]; strcpy(myBuff, str); Draw the Stack Frame! return 1; } int main (int argc, char ** argv) { func (argv[1]); return 1; } Wayne State University Course: Cyber Security Prac@ce 11

Overflowing “myBuff” High memory (A) str(A) Ret addr(A) EBP(A) A A A A A A Low memory ESP Wayne State University Course: Cyber Security Prac@ce 12

Buffer Overflow Defenses • The aMack described is a classical stack smashing aMack which execute the code on the stack • It does not work today – NX – non-executable stack. Most compilers now default to a non-executable stack. Meaning a segmenta@on fault occurs if running code from the stack (i.e., Data Execu@on Preven@on - DEP) • Disable it with –zexecstack op@on • Check it with readelf –e <PROGRAM> | grep STACK – StackGuard: Cannaries • Disable it with –fno-stack-protector op@on • Enable it with –fstack-protector op@on Wayne State University Course: Cyber Security Prac@ce 13

Stack Canaries • Stack smashing aMacks do two things – Overwrite the return address – Wait for algorithm to complete and call RET • Stack Canaries: Stack Smashing Protector (SSP) – Placing a integer value to stack just before the return address – To overwrite the return address, the canary value would also be modified – Checking this value before the func@on returns Wayne State University Course: Cyber Security Prac@ce 14

Stack Canaries (cont’d) High memory (A) str(A) Ret addr(A) EBP(A) Canary(A) A A A A A Low memory ESP Wayne State University Course: Cyber Security Prac@ce 15

Bypassing NX and Canaries • NX - non-executable stack – Execu@ng code in the heap – Data Execu@on Preven@on (DEP) – Return Oriented Programming (ROP) • Stack Canaries – Overwri@ng the Canary with the same value – Brute force aMack (e.g., DynaGuard in ACSAC’15) Wayne State University Course: Cyber Security Prac@ce 16

Reminders • Lab 0 – Turn in the class agreement • Lab 1 – Due today at 11:59pm – Late assignment policy – Submit it via Blackboard • Lab 2 instruc@ons Wayne State University Course: Cyber Security Prac@ce 17