Pwning in c++ (basic)

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Linux Binary Exploitation
C++ Exploitation
angelboy@chroot.org
1

Outline
• Name Mangling
• Virtual function table
• Vtable Hijacking
• Vector & String
• New & delete
• Copy constructor & ...

Outline
• Name Mangling
• Virtual function table
• Vtable Hijacking
• Vector & String
• New & delete
• Copy constructor & ...

Name Mangling
• C++ 為了了 Overloading 時，可以讓 compiler 和
linker 可以辨別出相同 function 名稱，參參數不同的
function 引⽤用的機制
• 使 programer 在不同的 ...

Name Mangling
• ⽽而在 compiler 和 linker 處理理 symbol 時，就會使
⽤用該機制讓每個 function 名對應到⼀一個修飾過後
的名稱
• C++ 中全域變數和靜態變數也有相同的機制
5

Name Mangling
• 在 gdb 中可以使⽤用下列列指令讓 function 好看⼀一點
• set print asm-demangle on
6

Outline
• Name Mangling
• Virtual function table
• Vector & String
• New & delete
• Copy constructor & assignment operator...

Virtual function table
• Virtual function is a key mechanism to support
polymorphism in C++
• For each class with virtual ...

Virtual function table
9
writable section
(heap)
typeinfo
Person::speak()
Person::phd()
typeinfo
Stu::speak()
Person::phd(...

Virtual function table
10
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
11
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
12
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
13
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
14
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
15
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
16
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
17
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
18
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Virtual function table
19
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo...

Vtable Hijacking
• Need other vulnerabilities
• Use-after-free, Heap overﬂow ….
• Force the table and Hijack the vfptr
• B...

Vtable Hijacking
21
writable section
(heap)
ddaa
meh
vfptr
a
vfptr
b
typeinfo
Person::speak()
Person::phd()
typeinfo
Stu::...

Vtable Hijacking
22
writable section
(heap)
meh
&shellcode
0xddaa
ddaa
0xdead
typeinfo
Person::speak()
Person::phd()
typei...

Vtable Hijacking
23
writable section
(heap)
meh
&shellcode
0xddaa
ddaa
0xdead
typeinfo
Person::speak()
Person::phd()
typei...

Vtable Hijacking
24
writable section
(heap)
meh
&shellcode
0xddaa
ddaa
0xdead
typeinfo
Person::speak()
Person::phd()
typei...

Vtable Hijacking
25
writable section
(heap)
meh
&shellcode
0xddaa
ddaa
0xdead
typeinfo
Person::speak()
Person::phd()
typei...

Vtable Hijacking
26
writable section
(heap)
meh
&shellcode
0xddaa
ddaa
0xdead
0xbeef
typeinfo
Person::speak()
Person::phd(...

Outline
• Name Mangling
• Virtual function table
• Vector & String
• New & delete
• Copy constructor & assignment operator...

Vector & String
• Vector
• A dynamic array
• 分配在 heap 段
• 比⼀一般 c 中的陣列列更更有彈性，當空間不夠⼤大時
會重新兩兩倍⼤大的的⼩小來來放置新的 vector ，再把
原本的空間還給...

Vector & String
• Vector
• member
• _M_start : vector 起始位置
• vector::begin()
• _M_ﬁnish : vector 結尾位置
• vector::end()
• _M...

Vector & String
• Vector
• member function
• push_back : 在 vector 最後加入新元素
• pop_back : 移除 vector 最後⼀一個元素
• insert ：插入元素到 v...

Vector & String
• Vector layout
31
vector <string> vec
_M_start
_M_ﬁnish
_M_end_of_storage

Vector & String
• Vector layout
32
vec.push_back(“meh”)
_M_start
_M_ﬁnish
_M_end_of_storage
address of meh string

Vector & String
• Vector layout
33
vec.push_back(“meheap”)
_M_start
_M_ﬁnish
_M_end_of_storage
address of meh string
因為 _M...

Vector & String
• Vector layout
34
vec.push_back(“meheap”)
_M_start
_M_ﬁnish
_M_end_of_storage
address of meh string
addre...

Vector & String
• Vector layout
35
vec.push_back(“meh.py”)
_M_start
_M_ﬁnish
_M_end_of_storage
address of meh string
addre...

Vector & String
• Vector layout
36
vec.push_back(“pwn”)
_M_start
_M_ﬁnish
_M_end_of_storage
address of meh string
address ...

Vector & String
• Vector layout
37
vec.pop_back()
_M_start
_M_ﬁnish
_M_end_of_storage
address of meh string
address of meh...

Vector & String
• Vector layout
38
vec.pop_back()
_M_start
_M_ﬁnish
_M_end_of_storage
address of meh string
address of meh...

Vector & String
• String
• a dynamic char array
• 比起以往的字串串陣列列更更加安全，全部動態配置記憶體空間，
減少⼀一般 buffer overﬂow 的發⽣生
• 在給定 input 時，會不...

Vector & String
• String
• member
• size ：字串串的長度
• Capacity : 該 string 空間的容量量
• reference count : 引⽤用計數
• 只要有其他元素引⽤用該字串串就會...

Vector & String
• String
• member function
• length() : string ⼤大⼩小
• capacity() : ⽬目前 string 空間容量量
• c_str() : Get C stri...

Vector & String
• String layout
42
str
string str
cin >> str

Vector & String
• String layout
43
str
string str
cin >> str
input : aa
size = 2
capacity = 2
refcnt = 0
aa

Vector & String
• String layout
44
str
string str
cin >> str
input : aaa
size = 2
capacity = 2
refcnt = -1
aa
size = 3
cap...

Vector & String
• String layout
45
str
string str
cin >> str
input : aaaaa
size = 2
capacity = 2
refcnt = -1
aa
size = 4
c...

Vector & String
• String layout
46
str
string str
cin >> str
input : a*125
size = 2
capacity = 2
refcnt = -1
aa
size = 4
c...

Vector & String
• String layout
47
str
vector<string> vec
vec.push_back(str)
size = 2
capacity = 2
refcnt = -1
aa
size = 4...

Vector & String
• String layout
48
str
size = 2
capacity = 2
refcnt = -1
aa
size = 4
capacity = 4
refcnt = -1
aaaa
size = ...

Vector & String
• String layout
49
str
size = 2
capacity = 2
refcnt = -1
aa
size = 4
capacity = 4
refcnt = -1
aaaa
size = ...

Vector & String
• String layout
50
str
size = 2
capacity = 2
refcnt = -1
aa
size = 4
capacity = 4
refcnt = -1
aaaa
size = ...

Vector & String
• String layout
51
size = 2
capacity = 2
refcnt = -1
aa
size = 4
capacity = 4
refcnt = -1
aaaa
size = 8
ca...

Vector & String
• String
• g++ > 5 之後取消了了 Copy-on-Write 機制
• 所以少掉了了 reference count 這個欄欄位
• 在 data length
• <= 15 時會⽤用 loc...

Vector & String
• String
• data pointer : 指向 data 位置
• size : 分配出去 string 的長度
• union
• local buffer : 在 size <= 15 時會直接把這...

Vector & String
• String
• size < 15
54
data pointer
size = 15
aaaaaaaa
aaaaaaaa

Vector & String
• String
• size > 15
55
data pointer
size = 17
capacity = 30
0
aaaaaaaa
aaaaaaaa
a
heap

Outline
• Name Mangling
• Virtual function table
• Vector & String
• New & delete
• Copy constructor & assignment operator...

New & Delete
• 在 c++ 預設的情況下，new/delete 的最底層實作依舊是靠
malloc/free 去處理理記憶體管理理
• 在 c++ 中，記憶體配置池稱為 free store ，但預設情況下
free store...

New & Delete
• new ⼤大致上流程
• operator new
• 與 malloc 類似，單純配置記憶體空間，但配置失敗會進入 exception
⽽而 malloc 則是返回 null ，有點像在 malloc 上⼀一層 ...

New & Delete
• 因此 new/delete 及 operator new / operator
delete 也應該成對配對
• 記憶體函式配對
59
配置函式解除函式
new delete
new [] delete []
o...

Outline
• Name Mangling
• Virtual function table
• Vector & String
• New & delete
• Copy constructor & assignment operator...

What’s wrong in this code
61

What’s wrong in this code
62

Copy constructor &
assignment operator
• shallow copy
• 只做單純 pointer (value) 的複製，複製完後內
容與原本的相同
• deep copy
• 會在配置更更多記憶體空間，...

Copy constructor &
assignment operator
• shallow copy
64
name
orange
StuA

Copy constructor &
assignment operator
• shallow copy
65
name
orange
name
StuA
StuB

Copy constructor &
assignment operator
• deep copy
66
name
orange
StuA

Copy constructor &
assignment operator
• deep copy
67
name
orange
name
StuA
StuB orange

Copy constructor &
assignment operator
• Copy constructor
• c++ 在進⾏行行複製 object 會使⽤用 copy constructor
• 通常 class 的 member 有...

Copy constructor &
assignment operator
• Assignment operator
• c++ 在進⾏行行 “=“ 這個 operator 時 object 會使⽤用
assignment operator...

Copy constructor &
assignment operator
• 何時會使⽤用 copy constructor
• func(Stu stu)
• return stu
• vector 等 STL 容器
• ….
70

Copy constructor &
assignment operator
• 何時會使⽤用 assignment operator
• stuA = stuB
• vector 等 STL 容器
• e.g. vector.erase()
...

Copy constructor &
assignment operator
72
call constructor
id
name
vector

Copy constructor &
assignment operator
73
new char [str.length() + 1]
id = 1337
name orange
vector

Copy constructor &
assignment operator
74
push_back(student)
id = 1337
name orange
vector
id = 1337
name copy the value
to...

Copy constructor &
assignment operator
75
~Stu()
id = 1337
name orange
vector
id = 1337
name 因 student 的
life time 結束
所以
c...

Copy constructor &
assignment operator
76
delete [] name
id = 1337
name orange
vector
id = 1337
name

Copy constructor &
assignment operator
77
~vector()
id = 1337
name orange
vector
id = 1337
name 因 stulist 的
life time 結束
所...

Copy constructor &
assignment operator
78
~Stu()
id = 1337
name orange
vector
id = 1337
name vector 會去
依次去呼叫
內容的
destructor

Copy constructor &
assignment operator
79
delete [] name
id = 1337
name orange
vector
id = 1337
name

Copy constructor &
assignment operator
80
delete [] name
id = 1337
name orange
vector
id = 1337
name
double free

Copy constructor &
assignment operator
• 總結
• 基本上 c++ 在只要做任何複製的動作時通常都
會去使⽤用 copy constructor 或者是 assignment
operator
• 所以基...

Lab 15
• zoo
82

Q & A

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

Execution by Angel Boy 26838 views
Heap exploitation by Angel Boy 36470 views
Advanced heap exploitaion by Angel Boy 28427 views
Sigreturn Oriented Programming by Angel Boy 27674 views
Play with FILE Structure - Yet Anot... by Angel Boy 40884 views
Return to dlresolve by Angel Boy 18156 views

Top clipped slide

View on SlideShare

1 of 83 Ad

1 of 83 Ad