return to libc attacks
play

Return-to-libc Attacks Outline Non-executable Stack countermeasure - PowerPoint PPT Presentation

Aug 29, 2022 •244 likes •516 views

Return-to-libc Attacks Outline Non-executable Stack countermeasure How to defeat the countermeasure Tasks involved in the attack Function Prologue and Epilogue Launching attack Non-executable Stack Running shellcode in C

  1. Return-to-libc Attacks

  2. Outline ● Non-executable Stack countermeasure ● How to defeat the countermeasure ● Tasks involved in the attack ● Function Prologue and Epilogue ● Launching attack

  3. Non-executable Stack Running shellcode in C program Calls shellcode

  4. Non-executable Stack ● With executable stack ● With non-executable stack

  5. How to Defeat This Countermeasure Jump to existing code: e.g. libc library. Function: system(cmd) : cmd argument is a command which gets executed.

  6. Environment Setup This code has potential buffer overflow problem in vul_func() Buffer overflow problem

  7. Environment Setup “Non executable stack” countermeasure is switched on , StackGuard protection is switched off and address randomization is turned off . Root owned Set-UID program.

  8. Overview of the Attack Task A : Find address of system() . ● To overwrite return address with system()’s address. Task B : Find address of the “/bin/sh” string. ● To run command “/bin/sh” from system() Task C : Construct arguments for system() ● To find location in the stack to place “/bin/sh” address (argument for system())

  9. Task A : To Find system() ’s Address. ● Debug the vulnerable program using gdb ● Using p (print) command, print address of system() and exit().

  10. Task B : To Find “/bin/sh” String Address Export an environment variable called “ MYSHELL ” with value “ /bin/sh ”. MYSHELL is passed to the vulnerable program as an environment variable, which is stored on the stack. We can find its address.

  11. Task B : To Find “/bin/sh” String Address Export “ MYSHELL ” environment variable and execute the code. Code to display address of environment variable

  12. Task B : Some Considerations ● Address of “MYSHELL” environment variable is sensitive to the length of the program name. ● If the program name is changed from env55 to env77, we get a different address.

  13. Task C : Argument for system() ● Arguments are accessed with respect to ebp . ● Argument for system() needs to be on the stack. Need to know where exactly ebp is after we have “returned” to system(), so we can put the argument at ebp + 8 . Frame for the system() function

  14. Task C : Argument for system() Function Prologue esp : Stack pointer ebp : Frame Pointer

  15. Task C : Argument for system() Function Epilogue esp : Stack pointer ebp : Frame Pointer

  16. Function Prologue and Epilogue example 1 2 1 Function prologue Function epilogue 2 8(%ebp) ⇒ %ebp + 8

  17. How to Find system()’s Argument Address? Change ebp and esp Modified Use of vul_func() system() Return system()’s epilogue prologue Address argument ● In order to find the system() argument, we need to understand how the ebp and esp registers change with the function calls. ● Between the time when return address is modified and system argument is used, vul_func() returns and system() prologue begins.

  18. Memory Map to Understand system() Argument

  19. Flow Chart to understand system() argument Return address is ebp is replaced by esp changed to system() Jump to system() after vul_func() epilogue address. “/bin/sh” is stored in ebp is set to current system() prologue is ebp+8 value of esp executed Check the memory map ebp + 4 is treated as return address of system(). We can put exit() address so that on system() return exit() is called and the program doesn’t crash.

  20. Malicious Code ebp + 12 ebp + 8 ebp + 4

  21. Launch the attack Execute the exploit code and then the vulnerable code ●

  22. Return-Oriented Programming ● In the return-to-libc attack, we can only chain two functions together ● The technique can be generalized: ○ Chain many functions together ○ Chain blocks of code together ● The generalized technique is called Return-Oriented Programming (ROP)

  23. Chaining Function Calls (without Arguments)

  24. Chaining Function Calls with Arguments Idea: skipping function prologue

  25. Chaining Function Calls with Arguments Idea: using leave and ret

  26. Chaining Function Calls with Zero in the Argument Idea: using a function call to dynamically change argument to zero on the stack Sequence of function calls (T is the address of the zero): use 4 sprint() to change setuid()’s argument to zero, before the setuid function is invoked. Invoke setuid(0) before invoking system(“/bin/sh”) can defeat the privilege- dropping countermeasure implemented by shell programs.

  27. Summary ● The Non-executable-stack mechanism can be bypassed ● To conduct the attack, we need to understand low-level details about function invocation ● The technique can be further generalized to Return Oriented Programming (ROP)

Recommend

Return-to-libc Attacks Instructor: Fengwei Zhang 1 SUSTech CS 315 Computer Security Outline

Return-to-libc Attacks Instructor: Fengwei Zhang 1 SUSTech CS 315 Computer Security Outline

Return-to-libc Attacks Instructor: Fengwei Zhang 1 SUSTech CS 315 Computer Security Outline Non-executable Stack countermeasure How to defeat the countermeasure Tasks involved in the attack Function Prologue and Epilogue

266 views • 22 slides
The Geometry of Innocent Flesh on the Bone Return-into-libc without Function Calls (on the x86)

The Geometry of Innocent Flesh on the Bone Return-into-libc without Function Calls (on the x86)

The Geometry of Innocent Flesh on the Bone Return-into-libc without Function Calls (on the x86) Hovav Shacham CCS 07 hovav@cs.ucsd.edu Technical Background Gadget: a short instructions sequence (e.x. pop %edx; ret;)

520 views • 31 slides
Code-Injection Attacks in Browsers Supporting Policies Elias Athanasopoulos , Vasilis Pappas, and

Code-Injection Attacks in Browsers Supporting Policies Elias Athanasopoulos , Vasilis Pappas, and

Code-Injection Attacks in Browsers Supporting Policies Elias Athanasopoulos , Vasilis Pappas, and Evangelos P. Markatos FORTH-ICS What is all about? New code-injection attacks or return-to-libc attacks in the web

666 views • 48 slides
Binary Exploitation 1 Buffer Overflows (return-to-libc, ROP, Canaries, W^X, ASLR) Chester

Binary Exploitation 1 Buffer Overflows (return-to-libc, ROP, Canaries, W^X, ASLR) Chester

Binary Exploitation 1 Buffer Overflows (return-to-libc, ROP, Canaries, W^X, ASLR) Chester Rebeiro Indian Institute of Technology Madras Parts of Malware Two parts Subvert execution: change the normal execution behavior of the program

1.25k views • 102 slides
Software Security Return to Libc and ROP Jan Nordholz Prof. Jean-Pierre Seifert Security in

Software Security Return to Libc and ROP Jan Nordholz Prof. Jean-Pierre Seifert Security in

Software Security Return to Libc and ROP Jan Nordholz Prof. Jean-Pierre Seifert Security in Telecommunications TU Berlin SoSe 2014 jan (sect) Software Security SoSe 2014 1 / 13 Recap: Overflow Bugs Ingredients: fixed-size buffer on the

429 views • 13 slides
Optimizing std::sort in libc++ Aditya Kumar Divya Shanmughan Issues with std::sort (libc++)

Optimizing std::sort in libc++ Aditya Kumar Divya Shanmughan Issues with std::sort (libc++)

Optimizing std::sort in libc++ Aditya Kumar Divya Shanmughan Issues with std::sort (libc++) Worst case clang-libc++ O(N^2) vs. gcc-libstdc++ O(NlogN) Time complexity (worst case*) 40 gcc-libstdc++ 35 clang-libcxx 30 25 Time

75 views • 6 slides
ss 8 Class Cl CSC 495/583 Topics of Software Security PLT, GOT & Return-to-plt Attack

ss 8 Class Cl CSC 495/583 Topics of Software Security PLT, GOT & Return-to-plt Attack

ss 8 Class Cl CSC 495/583 Topics of Software Security PLT, GOT & Return-to-plt Attack & GOT Overwrite Attack Dr. Si Chen (schen@wcupa.edu) Review Page 2 ret2libc Attack Page 3 libc C standard library Provides

662 views • 36 slides
Control Flow Integrity Recap Buffer overflow Mitigation techniques WOX/DEP

Control Flow Integrity Recap Buffer overflow Mitigation techniques WOX/DEP

Control Flow Integrity Recap Buffer overflow Mitigation techniques WOX/DEP Return-to-libc RoP (Return-oriented Programming) StackGuard (insert canaries on stack) PointGuard (encrypt the pointers) ASLR CFI

809 views • 42 slides
Timing attacks How typical software checks 16-byte authenticator: 1970s: TENEX operating system

Timing attacks How typical software checks 16-byte authenticator: 1970s: TENEX operating system

1 2 Timing attacks How typical software checks 16-byte authenticator: 1970s: TENEX operating system for (i = 0;i < 16;++i) compares user-supplied string if (x[i] != y[i]) return 0; against secret password return 1; one character at a

1.29k views • 114 slides
CSC 2400: Computer Systems Stack Buffer Overflow Attacks Summary Invoking a function ! CALL

CSC 2400: Computer Systems Stack Buffer Overflow Attacks Summary Invoking a function ! CALL

CSC 2400: Computer Systems Stack Buffer Overflow Attacks Summary Invoking a function ! CALL : call the function ! RET : return from the instruction Stack Frame for a function call includes ! Function arguments ! Return address ! Local

576 views • 15 slides
STAY HEALTHY | RETURN SMARTER | RETURN STRONGER THANK YOU STAY HEALTHY | RETURN SMARTER | RETURN

STAY HEALTHY | RETURN SMARTER | RETURN STRONGER THANK YOU STAY HEALTHY | RETURN SMARTER | RETURN

STAY HEALTHY | RETURN SMARTER | RETURN STRONGER THANK YOU STAY HEALTHY | RETURN SMARTER | RETURN STRONGER STAY HEALTHY. RETURN SMARTER. RETURN STRONGER. CALM & STEADY URGENT ACTION TO PROTECT PUBLIC HEALTH APPROACH LATER TIMING AND

499 views • 37 slides
Iteration Announcements Return Return Statements A return statement completes the evaluation of

Iteration Announcements Return Return Statements A return statement completes the evaluation of

Iteration Announcements Return Return Statements A return statement completes the evaluation of a call expression and provides its value f(x) for user-defined function f : switch to a new environment; execute f's body return statement within f :

234 views • 8 slides
Large scale libc++ deployment Evgenii Stepanov, Google Ivan Krasin, Google Containers of

Large scale libc++ deployment Evgenii Stepanov, Google Ivan Krasin, Google Containers of

Large scale libc++ deployment Evgenii Stepanov, Google Ivan Krasin, Google Containers of incomplete types class A { std::deque<A> d; }; class B { std::set<B>::iterator p; } Super-popular patterns. Some algorithms are much harder

408 views • 11 slides
Outline W X (DEP) CSci 4271W Return-oriented programming (ROP) Development of Secure

Outline W X (DEP) CSci 4271W Return-oriented programming (ROP) Development of Secure

Outline W X (DEP) CSci 4271W Return-oriented programming (ROP) Development of Secure Software Systems Day 6: Memory safety defenses and counter-attacks Announcements break Stephen McCamant University of Minnesota, Computer Science &

394 views • 4 slides
Returns Optimization 101 Episode 7: Examining Return Reasons Power of Return Reasons Return

Returns Optimization 101 Episode 7: Examining Return Reasons Power of Return Reasons Return

Returns Optimization 101 Episode 7: Examining Return Reasons Power of Return Reasons Return rates are great for identifying products to check out Return reasons allow you to dive into those returns and summarize them very quickly Proportion

326 views • 10 slides
Return Return Statements A return statement completes the evaluation of a call expression and

Return Return Statements A return statement completes the evaluation of a call expression and

Return Return Statements A return statement completes the evaluation of a call expression and provides its value f(x) for user-defined function f : switch to a new environment; execute f's body return statement within f : switch back to the

432 views • 32 slides
Risk & Return Three hypothetical stocks Javier Go Estrada Returns IESE Go

Risk & Return Three hypothetical stocks Javier Go Estrada Returns IESE Go

Corporate Finance Risk, Return, Diversification, and the CAPM Javier Estrada Spring, 2014 1. Risk & Return Return, mean return, and volatility 2. Diversification Four viewpoints on diversification Essential variables in portfolio

336 views • 20 slides
Memory Exploits & Defenses Presenter: Kevin Snow What is the threat? How do we defend

Memory Exploits & Defenses Presenter: Kevin Snow What is the threat? How do we defend

Memory Exploits & Defenses Presenter: Kevin Snow What is the threat? How do we defend ourselves? What is the threat? Stack Smashing Return-to-libc Format String Error Heap Overflow Generic Stack Frame Caller Callee Stack

1.12k views • 79 slides
NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3

NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3

CMPS122: COMPUTER SECURITY NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3 due tonight NETWORKING ATTACKS LAST TIME TCP/IP networking stack Physical layer Data link layer Network

1.1k views • 61 slides
l N N l i w E E M M t n e I I Your monthly return C C m E E u P P c This

l N N l i w E E M M t n e I I Your monthly return C C m E E u P P c This

Contractors monthly return d e t p e c CIS Helpline 0845 366 7899 c a e b t o n - l N N l i w E E M M t n e I I Your monthly return C C m E E u P P c This return is for payments to subcontractors in the

334 views • 4 slides
Serve-and-Return Us Time 3-5 minutes of hard core Serve-and-Return Scheduled: At a set

Serve-and-Return Us Time 3-5 minutes of hard core Serve-and-Return Scheduled: At a set

Serve-and-Return is what the brain needs to feel secure, understand other people, and a sense of control I AM SEEN / I AM HEARD We never stop needing S&R! Serve-and-Return Us Time 3-5 minutes of hard core Serve-and-Return

367 views • 4 slides
About Me @brandonphilips CTO/CO-FOUNDER github.com/philips systems engineer Why build CoreOS?

About Me @brandonphilips CTO/CO-FOUNDER github.com/philips systems engineer Why build CoreOS?

About Me @brandonphilips CTO/CO-FOUNDER github.com/philips systems engineer Why build CoreOS? containers run and isolate apps containers what is it exactly? libc python django app.py $ /usr/bin/python run app.py libc python django

812 views • 68 slides
Print and None >>> def does_not_return_square(x): ... x * x No return ... None

Print and None >>> def does_not_return_square(x): ... x * x No return ... None

None Indicates that Nothing is Returned The special value None represents nothing in Python A function that does not explicitly return a value will return None Careful : None is not displayed by the interpreter as the value of an expression Print

398 views • 8 slides
Generic Attacks on Stream Ciphers John Mattsson Generic Attacks on Stream Ciphers 2/22

Generic Attacks on Stream Ciphers John Mattsson Generic Attacks on Stream Ciphers 2/22

Generic Attacks on Stream Ciphers John Mattsson Generic Attacks on Stream Ciphers 2/22 Overview What is a stream cipher? Classification of attacks Different Attacks Exhaustive Key Search Time Memory Tradeoffs

656 views • 22 slides

More recommend