ss 6
play

ss 6 Cl Class CSC 472/583 Software Security Return-oriented - PowerPoint PPT Presentation

Dec 03, 2022 •258 likes •636 views

ss 6 Cl Class CSC 472/583 Software Security Return-oriented programming (ROP) Dr. Si Chen (schen@wcupa.edu) Compile the code gcc -m32 fno-stack-protector z execstack o ./overflow2 ./overflow2.c Page 2 No eXecute (NX) -z

  1. ss 6 Cl Class CSC 472/583 Software Security Return-oriented programming (ROP) Dr. Si Chen (schen@wcupa.edu)

  2. Compile the code gcc -m32 –fno-stack-protector –z execstack –o ./overflow2 ./overflow2.c Page § 2

  3. No eXecute (NX) § -z execstack § Also known as Data Execution Prevention (DEP), this protection marks writable regions of memory as non-executable. § This prevents the processor from executing in these marked regions of memory. Page § 3

  4. No eXecute (NX) After the function returns, the program will set the instruction pointer to 0xbfff0000 and attempt to execute the instructions at that address. However, since the region of memory mapped at that address has no execution permissions, the program will crash. Page § 4

  5. No eXecute (NX) Thus, the attacker's exploit is thwarted. Page § 5

  6. Data Execution Prevention (DEP): No eXecute bit (NX) NX bit is a CPU feature – On Intel CPU, it works only on x86_64 or with Physical Address Extension (PAE) enable Enabled, it raises an exception if the CPU tries to execute something that doesn't have the NX bit set The NX bit is located and setup in the Page Table Entry Page § 6

  7. Page Table • Each process in a multi-tasking OS runs in its own memory sandbox. • This sandbox is the virtual address space , which in 32-bit mode is always a 4GB block of memory addresses . • These virtual addresses are mapped to physical memory by page tables , which are maintained by the operating system kernel and consulted by the processor. • Each process has its own set of page tables. Page § 7

  8. Page Table To each virtual page there corresponds one page table entry (PTE) in the page tables, which in regular x86 paging is a simple 4-byte record shown below: Page § 8

  9. Data Execution Prevention (DEP): No eXecute bit (NX) The last bit is the NX bit (exb) ● 0 = disabled – 1 = enabled – Page § 9

  10. Return-oriented programming (ROP) Page § 10

  11. ROP Introduction ● When Good Instructions Go Bad: Generalizing Return- Oriented Programming to RISC [1] - Buchanan, E.; Roemer, R.; Shacham, H.; Savage, S. (October 2008) ● Return-Oriented Programming: Exploits Without Code Injection [2] - Shacham, Hovav; Buchanan, Erik; Roemer, Ryan; Savage, Stefan. Retrieved 2009-08-12. Page § 11

  12. Page § 12

  13. Ordinary programming: the machine level insn insn insn insn instruction pointer • Instruction pointer (EIP) determines which instruction to fetch & execute • Once processor has executed the instruction, it automatically increments EIP to next instruction • Control flow by changing value of EIP Page § 13

  14. EIP • Instruction pointer (EIP) determines which instruction to fetch & execute • Once processor has executed the instruction, it automatically increments EIP to next instruction Page § 14 • Control flow by changing value of EIP

  15. ROP: The Main Idea Page § 15

  16. ROP Gadget “The Gadget”: July 1945 Page § 16

  17. Attack Process on x86 • Gadget1 is executed and returns • Gadget2 is executed and returns • Gadget3 is executed and returns ● So, the real execution is: Page § 17

  18. How can we find gadgets? Several ways to find gadgets • Old school method : objdump and grep • Some gadgets will be not found: objdump aligns instructions • Make your own tool which scans an executable segment • Use an existing tool Page § 18

  19. Finding instruction sequences • Any instruction sequence ending in “ret” is useful — could be part of a gadget • Algorithmic problem : recover all sequences of valid instructions from libc that end in a “ret” insn • Idea: at each ret (c3 byte) lookback: • are preceding i bytes a valid length- i insn? • recurse from found instructions • Collect instruction sequences in a trie Page § 19

  20. ROPgadget Page § 20

  21. Execution Path main() à vulnerable_function (hacked) à add_bin() à add_bash() à exec_string() à Spawn shell Page § 21

  22. x Execution Path à add_bin() à magic == 0xdeadbeef à add_bash() à magic1 == 0xcafebabe à magic2 == 0x0badf00d à exec_string() à Spawn shell Page § 22

  23. Basic Structure of Return Chaining Page § 23

  24. Return Chaining Function Address Return Address (Old EIP) Arguments Page § 24

  25. Return Chaining Execution Path Without parameters, the ROP chain main() à vulnerable_function (hacked) looks much simpler à add_bash() à add_bin() à exec_string() à Spawn shell Add_bin() Add_bash() Exec_string() Similarly to lab1, Dummy Character “A”s we use gdb to Address for Add_bin() adjust the length of Address for Add_bash() the dummy characters to Address for exec_string() trigger buffer overflow Page § 25

  26. Return Chaining Execution Path à add_bin() à magic == 0xdeadbeef For add_bin(), we need to pass 0xdeadbeef, à add_bash() So the ROP chain looks like: à magic1 == 0xcafebabe à magic2 == 0x0badf00d à exec_string() à Spawn shell Add_bin() Add_bash() Exec_string() à magic == 0xdeadbeef Function Address Dummy Character “A”s Address for Add_bin() Return Address Address for Add_bash() (Old EIP) 0xdeadbeef Address for exec_string() Arguments Broken link Page § 26

  27. Return Chaining Execution Path à add_bin() The previous ROP chain does not work, à magic == 0xdeadbeef because argument à add_bash() 0xdeadbeef is still on the stack, we need to find à magic1 == 0xcafebabe à magic2 == 0x0badf00d a way to ” clean ” it à exec_string() à Spawn shell Add_bin() Add_bash() Exec_string() à magic == 0xdeadbeef Solution: use a pop, ret gadget to push the argument 0xdeadbeef into a register to remove it from the stack Dummy Character “A”s Address for Add_bin() Address for pop_ret 0xdeadbeef Address for Add_bash() Page § 27

  28. Return Chaining Execution Path à add_bin() For add_bash(), we need to pass 0xcafebabe à magic == 0xdeadbeef and 0x0badf00d, à add_bash() So we need to pop twice to remove both of à magic1 == 0xcafebabe à magic2 == 0x0badf00d them from the stack à exec_string() à Spawn shell Add_bin() Add_bash() Exec_string() à magic1 == 0xcafebabe à magic2 == 0x0badf00d Dummy Character “A”s Address for Add_bin() Address for pop_ret 0xdeadbeef Address for Add_bash() Address for pop_pop_ret 0xcafebabe 0x0badf00d Page § 28

  29. Return Chaining Execution Path à add_bin() Finally, call exec_string() à magic == 0xdeadbeef à add_bash() à magic1 == 0xcafebabe à magic2 == 0x0badf00d à exec_string() à Spawn shell Add_bin() Add_bash() Exec_string() Dummy Character “A”s Address for Add_bin() Address for pop_ret 0xdeadbeef Address for Add_bash() Address for pop_pop_ret 0xcafebabe 0x0badf00d Address for exec_string() Page § 29

  30. Page § 30

  31. rop2.c Since the binary is not big enough to give us a decent number of ROP gadgets, we will cheat a bit and compile the binary as a statically linked ELF . This should include library code in the final executable and bulk up the size of the binary. Page § 31

  32. rop2.c Since the binary is not big enough to give us a decent number of ROP gadgets, we will cheat a bit and compile the binary as a statically linked ELF . This should include library code in the final executable and bulk up the size of the binary. Page § 32

  33. Linux Syscalls § Linux system calls or syscalls are interfaces between the user space application and the Linux kernel. § Functionality performed by the Linux kernel can be invoked by placing parameters into the right registers and passing control to the interrupt vector 0x80 using the int 0x80 opcode. Typically, this is not done by the program directly but by calling glibc wrappers. Application ./program fwrite() C libc.a write() Run libc.so Time libc.a interrupt 0x80 Library libc.so API (Windows) Kernel sys_write() ./vlinuxz Kernel Page § 33

  34. Linux System Call http://syscalls.kernelgrok.com Page § 34

  35. Linux System Call § Typically, we invoke this function in the following manner to spawn shells. – execve("/bin/sh", {0}, {0}) Page § 35

  36. Linux System Call § f we take a look at the syscall reference, we can see that some parameters are expected in the eax, ebx, ecx, and edx registers. – eax - holds the number of the syscall to be called – ebx - a pointer to the string containing the file name to be executed – ecx - a pointer to the array of string pointers representing argv – edx - a pointer to the array of string pointers representing envp § For our purposes, the value that each of the registers should contain are: eax = 0xb ebx = "/bin/sh" ecx = memory address -> 0 edx = memory address -> 0 Page § 36

  37. Page § 37

Recommend

More recommend