smashing the buffer smashing the buffer
play

Smashing the Buffer Smashing the Buffer Miroslav tampar Miroslav - PowerPoint PPT Presentation

Jun 22, 2023 •97 likes •462 views

Smashing the Buffer Smashing the Buffer Miroslav tampar Miroslav tampar (mstampar@zsis.hr ) (mstampar@zsis.hr ) Summary BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 2 Buffer overflow (a.k.a.)

  1. Smashing the Buffer Smashing the Buffer Miroslav Štampar Miroslav Štampar (mstampar@zsis.hr ) (mstampar@zsis.hr )

  2. Summary BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 2

  3. Buffer overflow  (a.k.a.) Buffer overrun  An anomaly where a program, while writing data to the buffer, overruns its boundary, thus overwriting adjacent memory location(s)  Commonly associated with programming languages C and C++ (no boundary checking)  Stack-based (e.g. statically allocated built-in array at compile time) – overwriting stack elements  Heap-based (e.g. dynamically allocated malloc() array at run time) – overwriting heap internal structures (e.g. linked list pointers) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 3

  4. Stack-based overflow BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 4

  5. Heap-based overflow BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 5

  6. Vulnerable code (stack-based) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 6

  7. Vulnerable code (heap-based) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 7

  8. History  1961 - Burroughs 5000 (executable space protection)  1972 - Computer Security T echnology Planning Study (buffer overflow as an idea)  1988 - Morris worm (earliest exploitation – gets() in fingerd)  1995 - Buffer overflow rediscovered (Bugtraq)  1996 - “Smashing the Stack for Fun and Profit” (Aleph One)  1997 - “Return-into-lib(c) exploits” (Solar Designer)  2000 - The Linux PaX project  2001 - Code Red (IIS 5.0); Heap spraying (MS01-033)  2003 - SQL Slammer (MsSQL 2000); Microsoft VS 2003 flag /GS  2004 - NX on Linux (kernel 2.6.8); DEP on Windows (XP SP2); Egg hunting (skape)  2005 - ASLR on Linux (kernel 2.6.12); GCC flag -fstack-protector  2007 - ASLR on Windows (Vista); ROP (Sebastian Krahmer) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 8

  9. Stack canaries  (a.k.a.) Stack cookies, Stack-Smashing Protector (SSP)  Named for analogy to a canary in a coal mine  Implemented by the compiler  Placing a small (e.g. random) integer value to stack just before the return pointer  In order to overwrite the return pointer (and thus take control of the process) the canary value would also be overwritten  This value is checked to make sure it has not changed before a routine uses the return pointer from the stack BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 9

  10. ASCII armor  Generally maps important library addresses (e.g. libc) to a memory range containing a NULL byte (e.g. 0x00****** - 0x0100****** )  Makes it hard to construct address or pass arguments by exploiting string functions (e.g. strcpy() )  Not effective when NULL (i.e. 0x00 ) byte is not an issue (rarely)  Easily bypassable by using PLT (Procedure Language T able) entries in case of position independent binary BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 10

  11. SEH  Structured Exception Handler  Implemented by the compiler  Pointer to the exception handler is added to the stack in the form of the “Exception Registration Record” (SEH) and “Next Exception Registration Record” (nSEH)  If the buffer is overflown and (junk) data is written to the SEH (located eight bytes after ESP), invalid handler is called due to the inherently raised exception (i.e. STATUS_ACCESS_VIOLATION), thus preventing successful execution of used payload BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 11

  12. SEH (chain) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 12

  13. SEHOP  Structured Exception Handler Overwrite Protection  Blocks exploits that use (highly popular) SEH overwrite method  Enabled by default on Windows Server 2008, disabled on Windows Vista SP1 and Windows 7  Symbolic exception registration record appended to the end of exception handler list  Integrity of exception handler chain is broken if symbolic record can't be reached and/or if it's found to be invalid BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 13

  14. SafeSEH  Safe Structured Exception Handling  (a.k.a.) Software-enforced DEP  All exception handlers' entry points collected to a designated read-only table collected at the compilation time  Safe Exception Handler T able  Attempt to execute any unregistered exception handler will result in the immediate program termination BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 14

  15. DEP/NX  Data Execution Prevention/No eXecute  (a.k.a.) Non-executable stack, Execute Disable, Exec Shield (Linux), W^X (FreeBSD)  Set of hardware and software technologies that perform additional checks on memory  Provides protection for all memory pages that are not specifically marked as executable  Processor must support hardware-enforced mechanism (NX/EVP/XD)  Executables and libraries have to be specifically linked (problems with older software) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 15

  16. ASLR  Address Space Layout Randomization  Introduces the randomness into the address space of process  Positions of key data areas are randomly scattered (i.e. dynamic/shared libraries, heap and stack)  Its strength is based upon the low chance of an attacker guessing the locations of randomly placed areas  Executables and dynamic/shared libraries have to be specifically linked (problems with older software) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 16

  17. Safe functions  Well-written functions that automatically perform buffer management (including boundary checking), reducing the occurrence and impact of buffer overflows  Usually by introducing explicit parameter size BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 17

  18. NOP sled  (a.k.a.) NOP slide, NOP ramp  Oldest and most widely known method for stack buffer overflow exploitation  Large sequence of NOP (no-operation) instructions meant to “slide” the CPU's execution flow  Used when jump location has to be given (payload), while it's impossible to be exactly predicted  T oday widely used in high profile exploits utilizing “Heap spraying” method (e.g. browsers) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 18

  19. NOP sled (visual) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 19

  20. ret2libc  (a.k.a.) ret2system, arc injection  Overwriting the return address with location of a function that is already loaded in the binary or via shared library  Required arguments are also provided through stack overwrite  Shared library libc(.so) is always linked to executables on UNIX style systems and provides useful calls (e.g. system() )  Dynamic library kernel32(.dll) is always loaded by executables on Win32 style systems and provides useful calls (e.g. WinExec() ) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 20

  21. ret2libc (visual) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 21

  22. ret2reg  Return-to-register (e.g. ESP, EAX, etc.)  (a.k.a.) Trampolining  Also, variants like ret2pop, ret2ret, etc.  We overwrite the EIP with the address of an existing instruction that would jump to the location of a register  Preferred choice is the register pointing to the location inside our buffer (usually ESP)  Much more reliable method than NOP sled  Without the need for extra room for NOP sled and without having to guess stack offset BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 22

  23. ret2reg (visual) BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 23

  24. Egg hunting  Used in reduced buffer space situations  Allows usage of a small payload (“egg hunter”) to find the actual (bigger) payload  The final payload must be somewhere in memory (i.e. stack, heap or secondary buffer) prepended with the unique marking string (2x4 bytes) called “egg” (e.g. “w00tw00t”)  Searching memory byte at a time  Memory “peeking” with syscall mechanism(s) to bypass access violation issues  Egg hunter types: SEH, IsBadReadPtr, NtDisplayString, NtAccessCheckAndAuditAlarm BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 24

Recommend

Smashing The Stack A detailed look at buffer overflows as described in Smashing the Stack for

Smashing The Stack A detailed look at buffer overflows as described in Smashing the Stack for

Smashing The Stack A detailed look at buffer overflows as described in Smashing the Stack for Fun and Profit by Aleph One Summer 2017 Roadmap 1 Process Memory Organization Text Fixed by program Includes code and read-only data

257 views • 22 slides
Stack Smashing as of Today A State-of-the-Art Overview on Buffer Overflow Protections on

Stack Smashing as of Today A State-of-the-Art Overview on Buffer Overflow Protections on

\x90\x90\x90\x90\x90\x90\x90\x90 Stack Smashing as of Today A State-of-the-Art Overview on Buffer Overflow Protections on linux_x86_64 <fritsch+blackhat@in.tum.de> Hagen Fritsch Technische Universitt Mnchen Black Hat Europe

928 views • 49 slides
Smashing the Stack Based on the paper by Aleph One Slides by Prof Yan Chen, Northwestern

Smashing the Stack Based on the paper by Aleph One Slides by Prof Yan Chen, Northwestern

Smashing the Stack Based on the paper by Aleph One Slides by Prof Yan Chen, Northwestern University Smashing the Stack for Fun and Profit Review: Process memory organization The problem: Buffer overflows How to exploit the problem

660 views • 46 slides
Smashing the Stack Protector for Fun and Profit 1 1996: Smashing The Stack for Fun and Profit

Smashing the Stack Protector for Fun and Profit 1 1996: Smashing The Stack for Fun and Profit

Smashing the Stack Protector for Fun and Profit 1 1996: Smashing The Stack for Fun and Profit ... overflow direction / higher addresses int main(int argc, char **argv) buf { stack growth char buf[0x10]; gets(buf); saved return address

911 views • 13 slides
Computer Security Buffer Overflows Denial of Service MIE456 Joseph Kong Overview Program

Computer Security Buffer Overflows Denial of Service MIE456 Joseph Kong Overview Program

Computer Security Buffer Overflows Denial of Service MIE456 Joseph Kong Overview Program Exploitation Buffer Overflows Memory Declaration Smashing The Stack TCP/IP Three Way Handshake Denial of Service SYN Flooding

403 views • 13 slides
ECS 153 Discussion Section April 6, 2015 1 What Well Cover Goal : To

ECS 153 Discussion Section April 6, 2015 1 What Well Cover Goal : To

ECS 153 Discussion Section April 6, 2015 1 What Well Cover Goal : To discuss buffer overflows in detail Stack-based buffer overflows Smashing the stack: execution from the stack

620 views • 37 slides
Buffer Manager Each relation is can be mapped onto many files (each file containing data from one

Buffer Manager Each relation is can be mapped onto many files (each file containing data from one

Buffer Management The database buffer is the mediator between the basic file system and the tuple-oriented file system. The buffer managers task is to make the pages addressable in main memory and to coordinate the writing of pages to disk

1.12k views • 8 slides
Introduction Buffer Overflows Buffer overflows were the most common form of security

Introduction Buffer Overflows Buffer overflows were the most common form of security

Introduction Buffer Overflows Buffer overflows were the most common form of security vulnerability in the 90s. Buffer overflows dominate in the area of remote network penetration vulnerabilities. CS 465 They represent one of the

651 views • 4 slides
64-bit Linux stack smashing tutorial: Part 2 Written on April 21, 2015 This is part 2 of my

64-bit Linux stack smashing tutorial: Part 2 Written on April 21, 2015 This is part 2 of my

Techorganic About PGP Disclaimer Vulnerabilities Musings from the brainpan 64-bit Linux stack smashing tutorial: Part 2 Written on April 21, 2015 This is part 2 of my 64-bit Linux Stack Smashing tutorial. In part 1 we exploited a 64- bit

451 views • 9 slides
Buffer Overflows with Content 2 A Process Stack Buffer Overflow Common Techniques employed

Buffer Overflows with Content 2 A Process Stack Buffer Overflow Common Techniques employed

1 Buffer Overflows with Content 2 A Process Stack Buffer Overflow Common Techniques employed in buffer overflow exploits to create backdoors Execution of additional network services via the INETD daemon The addition of new users

497 views • 30 slides
External buffer Raslan Darawsheh Mellanox External buffer First was introduced by Olivier

External buffer Raslan Darawsheh Mellanox External buffer First was introduced by Olivier

x External buffer Raslan Darawsheh Mellanox External buffer First was introduced by Olivier in his presentation in 2016. The support for External buffer has been there since DPDK 18.05 2 External buffer: Contd 3 External

544 views • 12 slides
Lab 2: Buffer Overflows Fengwei Zhang SUSTech CS 315 Computer Security 1 Buffer Overflows

Lab 2: Buffer Overflows Fengwei Zhang SUSTech CS 315 Computer Security 1 Buffer Overflows

Lab 2: Buffer Overflows Fengwei Zhang SUSTech CS 315 Computer Security 1 Buffer Overflows One of the most common vulnerabilities in software Programming languages commonly associated with buffer overflows including C and C++

1.14k views • 17 slides
Buffer Overflows and Defenses CS 419: Computer Security Lecture 10 and 11 Buffer Overflow a

Buffer Overflows and Defenses CS 419: Computer Security Lecture 10 and 11 Buffer Overflow a

Buffer Overflows and Defenses CS 419: Computer Security Lecture 10 and 11 Buffer Overflow a very common attack mechanism from 1988 Morris Worm to Code Red, Slammer, Sasser and many others prevention techniques known still of major concern

873 views • 53 slides
TinyOS Determine when Fill message Specify Pass buffer message buffer Network Communication

TinyOS Determine when Fill message Specify Pass buffer message buffer Network Communication

Inter-Node Communication General idea: Sender: TinyOS Determine when Fill message Specify Pass buffer message buffer Network Communication buffer with data Recipients to OS can be reused Computer Network Receiver:

176 views • 3 slides
Week 03 Lectures PostgreSQL Buffer Manager 1/95 PostgreSQL buffer manager: provides a shared

Week 03 Lectures PostgreSQL Buffer Manager 1/95 PostgreSQL buffer manager: provides a shared

Week 03 Lectures PostgreSQL Buffer Manager 1/95 PostgreSQL buffer manager: provides a shared pool of memory buffers for all backends all access methods get data from disk via buffer manager Buffers are located in a large region of shared

505 views • 25 slides
Riparian Buffer or Riparian Forest Buffer Equivalency Demonstration and Offsetting Water

Riparian Buffer or Riparian Forest Buffer Equivalency Demonstration and Offsetting Water

Implementation of Act 162 of 2014 Riparian Buffer or Riparian Forest Buffer Equivalency Demonstration and Offsetting Water Resources Advisory Committee August 12, 2015 Tom Wolf, Governor John Quigley, Secretary Agenda 1. Overview of Act 162

532 views • 37 slides
Chapter 10 Buffer Overflow Buffer Overflow Common attack mechanism first wide use by

Chapter 10 Buffer Overflow Buffer Overflow Common attack mechanism first wide use by

Chapter 10 Buffer Overflow Buffer Overflow Common attack mechanism first wide use by the Morris Worm in 1988 Prevention techniques known NX bit, stack canaries, ASLR Still of major concern Recent examples:

354 views • 21 slides
Buffer Trees Lars Arge. The Buffer Tree: A New Technique for Optimal I/O Algorithms . In

Buffer Trees Lars Arge. The Buffer Tree: A New Technique for Optimal I/O Algorithms . In

Buffer Trees Lars Arge. The Buffer Tree: A New Technique for Optimal I/O Algorithms . In Proceedings of Fourth Workshop on Algorithms and Data Structures (WADS), Lecture Notes in Computer Science Vol. 955, Springer-Verlag, 1995, 334-345. 1

518 views • 27 slides
AKC Education Webinar Series: Social Media Resources Buffer: What Is It? Buffer is a software

AKC Education Webinar Series: Social Media Resources Buffer: What Is It? Buffer is a software

AKC Education Webinar Series: Social Media Resources Buffer: What Is It? Buffer is a software application for the web and mobile, designed to manage accounts in social networks, by providing the means for a user to schedule posts to Twitter,

506 views • 35 slides
More Vulnerabilities (buffer overreads, format string, integer overflow, heap overflows) Chester

More Vulnerabilities (buffer overreads, format string, integer overflow, heap overflows) Chester

More Vulnerabilities (buffer overreads, format string, integer overflow, heap overflows) Chester Rebeiro Indian Institute of Technology Madras Buffer Overreads 2 Buffer Overread Example 3 Buffer Overread Example len read from command line

906 views • 76 slides
References Smashing the stack for fun and profit http://phrack.org/issues/49/14.html

References Smashing the stack for fun and profit http://phrack.org/issues/49/14.html

References Smashing the stack for fun and profit http://phrack.org/issues/49/14.html Exploiting format string vulnerabilities https://crypto.stanford.edu/cs155/papers/for matstring-1.2.pdf Once upon a free()

427 views • 19 slides
Buffer Software Security overflows and other memory safety vulnerabilities Buffer overflow

Buffer Software Security overflows and other memory safety vulnerabilities Buffer overflow

Last time We continued By launching our 1st section: Buffer Software Security overflows and other memory safety vulnerabilities Buffer overflow fundamentals This time We will finish up By looking at Buffer Overflow overflows

1.33k views • 103 slides
Dimer Interpretations in Cluster Algebras: Smashing, Splitting, and Finding the Perfect Match

Dimer Interpretations in Cluster Algebras: Smashing, Splitting, and Finding the Perfect Match

Dimer Interpretations in Cluster Algebras: Smashing, Splitting, and Finding the Perfect Match Piriyakorn Piriyatamwong and Caledonia Wilson University of Minnesota Twin Cities REU in Combinatorics Monday July 30, 2018 Introduction Consider

463 views • 45 slides
Smashing the Implementation Records of AES S-box Arash Reyhani-Masoleh, Mostafa Taha, and Doaa

Smashing the Implementation Records of AES S-box Arash Reyhani-Masoleh, Mostafa Taha, and Doaa

Smashing the Implementation Records of AES S-box Arash Reyhani-Masoleh, Mostafa Taha, and Doaa Ashmawy Western University London, Ontario, Canada CHES-2018 1 Outline Introduction. Proposed AES S-box Architecture. New

824 views • 58 slides

More recommend