Lab 2: Buffer Overflows Fengwei Zhang Wayne State University CSC - PowerPoint PPT Presentation

Lab 2: Buffer Overflows Fengwei Zhang Wayne State University CSC 5991 Cyber Security PracCce 1

Buffer Overflows • One of the most common vulnerabiliCes in soGware • Programming languages commonly associated with buffer overflows including C and C++ • OperaCng systems including Windows, Linux and Mac OS X are wriOen in C or C++ Wayne State University CSC 5991 Cyber Security PracCce 2

How It Works • ApplicaCons define buffers in the memory – unsigned int char [10] • ApplicaCons use adjacent memory to store variables, arguments, and return address of a funcCon. • Buffer Overflows occurs when data wriOen to a buffer exceeds its size. Wayne State University CSC 5991 Cyber Security PracCce 3

Overflowing A Buffer • Defining a buffer in C – char buf[10]; • Overflowing the buffer – Char buf [10] = ‘x’; – strcpy(buf, “AAAAAAAAAAAAAAAAAAAAAAA”) Wayne State University CSC 5991 Cyber Security PracCce 4

Why We Care • Because adjacent memory stores program variables, parameters, and arguments • AOackers can change these values through overflowing a buffer • AOackers can gain control over the program flow to execute arbitrary code Wayne State University CSC 5991 Cyber Security PracCce 5

Process Memory Layout High memory Stack Heap Data Segment Text Segment Low memory Wayne State University CSC 5991 Cyber Security PracCce 6

Memory Layout for 32-bit Linux 1GB Kernel Space Local variable: int a Stack FuncCon malloc() Heap 3GB UniniCalized staCc variables: staCc char *u BSS Segment staCc char *s = “Hello world” Data Segment Text Segment (ELF) Binary of the program Wayne State University CSC 5991 Cyber Security PracCce 7

Virtual Memory Layout Wayne State University CSC 5991 Cyber Security PracCce 8

Stack Frame • The stack contains acCvaCon frames including local variables, funcCon parameters, and return address • StarCng at the highest memory address and growing downwards • Last in first out Wayne State University CSC 5991 Cyber Security PracCce 9

A Simple Program Add (2,3) High memory 3 2 int add (int a, int b) { Ret Address int c; EBP c = 1+b; C return c; } Low memory ESP Wayne State University CSC 5991 Cyber Security PracCce 10

Another Program int func (char * str) { char mybuff[512]; strcpy(myBuff, str); Draw the Stack Frame! return 1; } int main (int argc, char ** argv) { func (argv[1]); return 1; } Wayne State University CSC 5991 Cyber Security PracCce 11

Overflowing “myBuff” High memory (A) str(A) Ret addr(A) EBP(A) A A A A A A Low memory ESP Wayne State University CSC 5991 Cyber Security PracCce 12

Buffer Overflow Defenses • The aOack described is a classical stack smashing aOack which execute the code on the stack • It does not work today – NX – non-executable stack. Most compilers now default to a non-executable stack. Meaning a segmentaCon fault occurs if running code from the stack (i.e., Data ExecuCon PrevenCon - DEP) • Disable it with –zexecstack opCon • Check it with readelf –e <PROGRAM> | grep STACK – StackGuard: Cannaries • Disable it with –fno-stack-protector opCon • Enable it with –fstack-protector opCon Wayne State University CSC 5991 Cyber Security PracCce 13

Stack Canaries • Stack smashing aOacks do two things – Overwrite the return address – Wait for algorithm to complete and call RET • Stack Canaries: Stack Smashing Protector (SSP) – Placing a integer value to stack just before the return address – To overwrite the return address, the canary value would also be modified – Checking this value before the funcCon returns Wayne State University CSC 5991 Cyber Security PracCce 14

Stack Canaries (cont’d) High memory (A) str(A) Ret addr(A) EBP(A) Canary(A) A A A A A Low memory ESP Wayne State University CSC 5991 Cyber Security PracCce 15

Bypassing NX and Canaries • NX - non-executable stack – ExecuCng code in the heap – Data ExecuCon PrevenCon (DEP) – Return Oriented Programming (ROP) • Stack Canaries – OverwriCng the Canary with the same value – Brute force aOack (e.g., DynaGuard in ACSAC’15) Wayne State University CSC 5991 Cyber Security PracCce 16

Reminders • Lab 0 – Turn in the class agreement • Lab 1 – Due today at 11:59pm – Late assignment policy – Submit it via Blackboard • Lab 2 instrucCons Wayne State University CSC 5991 Cyber Security PracCce 17