Code Vulnerabilities & Attacks

TOCTOU Injection Conclusion
Code Vulnerabilities & Attacks
Marcus Botacin

Topics
1 TOCTOU
Back to O.S.
The security Problem
A real world case
2 Injection
Back to O.S. (again)
Buﬀer Overﬂow
Return to libc
Return Oriented Programming (ROP)
Mitigations
3 Conclusion

Back to O.S.
Topics
1 TOCTOU
Back to O.S.
A real world case
2 Injection
Buﬀer Overﬂow
Return to libc
Mitigations
3 Conclusion

Back to O.S.
Producer-Consumer Problem
Deﬁnition
Circular Buﬀer
How to guarantee order ?
Code
producer ()
while (1)
i f b u f f e r s i z e == FULL
s l e e p
consumer ()
while (1)
i f b u f f e r s i z e == EMPTY
s l e e p

Back to O.S.
Race Condition
Definition
“Condição em que o resultado do processo é dependente da
sequência ou sincronia de outros eventos”.
Problem
Leva a resultados incorretos.

Topics
1 TOCTOU
Back to O.S.
A real world case
2 Injection
Buﬀer Overﬂow
Return to libc
Mitigations
3 Conclusion

Password Check
Code
Checker ()
i f allowed
g r a n t a c c e s s
Creator ()
c r e a t e u s e r
allowed=True

TOCTOU
Definition
“Um bug causado por uma race condition”.
Severity
“De computações incorretas a acessos indevidos”.

A real world case
Topics
1 TOCTOU
Back to O.S.
A real world case
2 Injection
Buﬀer Overﬂow
Return to libc
Mitigations
3 Conclusion

A real world case
Background
Memory Management
Page faults retries
Dirty bits
Copy-on-write
Linux
PTRACE POKE DATAa
mdavise syscallb
a
man ptrace
b
man madvise

A real world case
Dirty Cow
Part I - Page Fault
h a n d l e p t e f a u l t
d o f a u l t <− pte i s not present
do cow fault <− FAULT FLAG WRITE
Part II - Write Fault
do wp page
PageAnon () <− t h i s i s CoWed page a l r e a d y
reuse swap page <− page i s e x c l u s i v e l y ours
wp page reuse
maybe mkwrite <− d i r t y but RO again
0
https://dirtycow.ninja/

A real world case
Dirty Cow
Part III - Read Fault
cond resched −> d i f f e r e n t thread w i l l now
unmap v i a madvise
follow page mask ! p t e p r e s e n t && pte none
f a u l t i n p a g e
handle mm fault
handle mm fault
h a n d l e p t e f a u l t
d o f a u l t <− pte i s not present
d o r e a d f a u l t <− t h i s i s a read
f a u l t and we w i l l get pagecache

Topics
1 TOCTOU
Back to O.S.
A real world case
2 Injection
Buﬀer Overﬂow
Return to libc
Mitigations
3 Conclusion

ABIs and Calling conventions
How parameters are passed.
The order they are passed.
Where they are passed.

Calling conventions
cstd: Arguments on the stack, on the reverse order.
x64: Arguments on registers.
syscalls: Syscall number on eax.

Concept Definitions
ABI
“Uma definição da interface entre módulos de software, tais como
entre códigos e o sistema operacional. Uma ABI especifica uma
calling convention.”
Calling Convention
“Uma definição de como trechos de código são chamados,
incluindo a ordem, localização, e a restauração dos parâmetros.”

Stack frame
Figure: Stack Frame
0
https://tinyurl.com/hhq934r

Stack Frame
Definition
“Uma definição de contexto de função de forma temporária.”

Buffer Overflow
Topics
1 TOCTOU
Back to O.S.
A real world case
2 Injection
Buffer Overflow
Return to libc
Mitigations
3 Conclusion

Buffer Overflow
For fun and for profit
Figure: Aleph One’s article.
0
http://phrack.org/issues/49/14.html

Buffer Overflow
A typical payload
Figure: Buffer overflow payload structure
0
https://tinyurl.com/y9dornpu

Buﬀer Overﬂow
Vulnerable code
Listing 1: Vulnerable code
i n t main ( i n t argc , char ∗ argv [ ] )
{
char s t r [ 3 2 ] ;
s t r c p y ( str , argv [ 1 ] ) ;
r e t u r n 0;
}

Buﬀer Overﬂow
Shellcodes
Figure: Shellcode Repository.
0
http://shell-storm.org/shellcode/

Buﬀer Overﬂow
No Executable pages
Figure: Page protection bits
0
https://tinyurl.com/y8wodhn2

Buffer Overflow
Still overflowing
Listing 2: variable overflow
i n t main ( i n t argc , char ∗ argv [ ] )
{
i n t a = 10;
char s t r [ 3 2 ] ;
scanf (”%s ” , s t r ) :
p r i n t f (”%dn ” , a ) ;
r e t u r n 0;
}

Buffer Overflow
Buffer
“Região cont´ıgua de memória, de tamanho limitado, utilizada
para armazenamento temporário.”
Buffer Overflow
“Exceder a capacidade de armazenamento de um buffer.”
Buffer Overflow Attack
“Utilizar-se de um buffer overflow para alterar intencionalmente
o estado de um programa.”

Buffer Overflow
Program Hijacking
Variable Hijacking: “Alterar uma variável que controla um
estado”.
Instruction Hijacking: “Inserção de instruções para alterar o
estado”.
Control Flow Hijacking: ”Uso das técnicas anteriores para
alterar o estado”.

Buffer Overflow
Payload
“Conteúdo de preenchimento do buffer em um ataque do tipo
overflow”
Shellcode
“Conjunto de instruções que compõem um payload”
NOP
“Uma operação que não altera estados”
NOP Sled
“Sequência de NOPs que compõem um payload”

Buffer Overflow
Buffer Overflow Classification
Types
Stack-based.
Heap-based.

Return to libc
Topics
1 TOCTOU
Back to O.S.
A real world case
2 Injection
Buﬀer Overﬂow
Return to libc
Mitigations
3 Conclusion

Return to libc
Back to O.S (again!!)
Libs and permissions
Figure: Memory mapping and protection

Return to libc
The attack
Figure: Return to libc
0
https://tinyurl.com/yd8r36q4

Return to libc
Payload building
Finding strings
objdump -s ret2libc
(gdb) ﬁnd 0x400000, 0x401000, ”/bin”
Finding gadgets
ropper –ﬁle ret2libc –search ”% ?di”

Return to libc
Ret2LibC Concepts
Definition
“Ataque de Control Flow Hijacking através da exploração de um
buffer overflow tendo o endereço de funções e argumentos da libc
como payload”

Topics
1 TOCTOU
Back to O.S.
A real world case
2 Injection
Buﬀer Overﬂow
Return to libc
Mitigations
3 Conclusion

The attack
Figure: ROP gadget chaining
0
https://tinyurl.com/y7p3hrkk

Questions
What is the relation between ROP attacks and the x64 calling
convention ?
How to ﬁnd gadgets ?

More background
Figure: Binary disassembly

Unaligned Instructions
Listing 3: Static disassembly of the MSVCR71.dll library.
c08 : f2 0 f 58 c3 addsd %xmm3,%xmm0
c0c : 66 0 f 13 44 24 04 movlpd %xmm0,0 x4(%esp )
Listing 4: ROP Gadget.
c0a : 58 pop rax
c0b : c3 r e t

ROP Concepts
Gadgets
“Sequência independente de instruções terminadas por RET”
Gadget Chain
“Encadeamento de gadgets com o objetivo de realizar uma
computação.”
ROP Attack
“Ataque de control flow hijacking através da exploração de um
buffer overlow tendo um gadget chain como parte do payload.”

Mitigations
Topics
1 TOCTOU
Back to O.S.
A real world case
2 Injection
Buﬀer Overﬂow
Return to libc
Mitigations
3 Conclusion

Mitigations
Safe functions/languages
Listing 5: Popular strcpy prototype
char ∗ s t r c p y ( char ∗ dst , char ∗ s r c ) ;
Listing 6: Not so popular strncpy prototype
char ∗ strncpy ( char ∗ det , char ∗ src , s i z e t num ) ;

Mitigations
Safe functions/languages
Listing 7: String deﬁnition example
typedef s t r u c t s t r {
char s t r [MAX] ;
u i n t s i z e ;
u i n t max=MAX;
} s t r i n g ;
Listing 8: Concat implementation example
concat ( str1 , s t r 2 )
i f str1 −>s i z e + str2 −>s i z e < str1 −>max

Mitigations
Safe String Functions
Definition
“Função que verifica os tamanhos dos buffers a fim de evitar um
overflow.”

Mitigations
Stack Canaries
Figure: Stack canary
0
https://tinyurl.com/yd9947ol
0
Disable with: gcc -fno-stack-protector

Mitigations
Stack Canaries
Definition
“Marcador da continência de um buffer.”

Mitigations
Question
Compile-time solutions
Advantages ?
Disadvantages ?

Mitigations
ASLR
Figure: Address Space Layout Randomization
0
https://tinyurl.com/ycg2dlvoCode Vulnerabilities & Attacks

Mitigations
ASLR
Table: aslr - library placement after two consecutive reboots.
library ntdll kernel32 kernelbase
address 1 0xbaf80000 0xb9610000 0xb8190000
address 2 0x987b0000 0x98670000 0x958c0000

Mitigations
ASLR
Definition
“Aleatorização do posicionamento de conteúdos de memória a fim
de evitar ataques de offset fixo.”

Mitigations
ASLR
Position Independent Code
GCC -fpic
Jump Tables
Figure: Jump Table

Mitigations
ASLR - Solution ?
Figure: Breaking ASLR 1
Figure: Breaking ASLR 2

Mitigations
Write XOR Execute Policy
Write Xor Execute
How to implement ?
Listing 9: /proc/cpuinfo
f l a g s : fpu vme de pse t s c msr pae mce apic nx

Mitigations
Write XOR Execute Policy
Definition
“Pol´ıtica que assegura que páginas de memória executáveis não
podem ser escritas.”

Mitigations
Control Flow Integrity
Figure: CALL-RET policy

Mitigations
Shadow Stacks
Figure: Branch Stack
0

Mitigations
CFI - solution ?
Figure: CFI Bypass.

Mitigations
CFI
CFI Definition
“Imposição de que o fluxo de execução siga uma determinada
pol´ıtica.”
CALL-RET Definition
“Pol´ıtica que exige que todas as instruções RET sejam precedidas
por um CALL.”

Mitigations
Heuristics
Questions
What gadget feature ?
Limitations ?

Mitigations
Gadget Size Heuristic - solution ?
Figure: Heuristic Bypass.

Conclusion
Questions ?

Code Vulnerabilities & Attacks

More Related Content

What's hot

Similar to Code Vulnerabilities & Attacks

More from Marcus Botacin

Recently uploaded

Code Vulnerabilities & Attacks