IoT exploitation: from memory corruption to code execution - Marco Romano - Codemotion Rome 2018

IoT exploitation: from memory corruption
to code execution
Marco Romano
ROME - APRIL 13/14 2018

Marco
Romano
(In)Security Researcher
sometimes for fun,
sometimes for proﬁt
FIND ME HERE
@nemux_
IoT exploitation
from memory corruption
to code execution
© Marco Romano - nemux.org

Independent
researches Publicly disclosed
vulnerabilities
2015
CVE-2015-7805
Heap-based buffer
overflow in libsndfile
1.0.25
2016
CVE-2016-2399
Integer overflow in the
quicktime_read_pascal
function in libquicktime
1.2.4
2018
CVE-2018-8072
????
2017

CVE-2018-8072
EDIMAX Network Cameras Stack Buffer Overﬂow
Models: IC-3140W, IC-5150W, IC-6220DC
An issue was
discovered on
EDIMAX IC-3140W
through 3.06,
IC-5150W through
3.09, and IC-6220DC
through 3.06 devices…

Stack Buffer Overflow
“2 minutes Crash Course”
Stack
For the sake of simplicity some stack info are missed

1) main() calls foo()
2) foo() copies “AA…” in buf[]
3) foo() “return;” —> go back in main()
Stack

Stack

Model number: IC-3140W
(1) …open-up the box…
(2) Information gathering
(3) Attack surface mapping
DAY 1 TARGET:
HD Wireless Day & Night Network Camera

Your are safe… you can see him…

…and yell at him
Image courtesy of: edimax.com

…but not at him!
(unauthenticated) Remote Code Execution

Information
Gathering & Attack
Hardware
Best friend: Screwdriver
Take note of the components
used in the device and collect
online resources

Software
Best friend: Google
Download everything the vendor
allows you to…
First of all the ﬁrmware!
Information
Gathering & Attack

They are 4 interesting holes!
UART Pinouts IC-3140W:
UART root shell:
3 Wires + 1 USB Serial Adapter +
Right baudrate (38400)
1. Tx 2. GND 3. Rx 4. Vcc
UART Exploitation

Get a root
shell
Goal: UART —> Serial Console —> telnetd &

Firmware
Firmware analysis
Best friend: binwalk
https://github.com/ReFirmLabs/
binwalk
binwalk -M -e IC-3140W_3.05.bin

Interesting
targets
Goal: Unauthenticated HTTP Request —> Binary CGI
got something to reverse….

telnetd.cgi?
sounds good!
Goal: HTTP Request —> telnetd.cgi —> telnetd &
(1) Undocumented “feature”
(2) Not available in the admin panel
(3) Run telnet daemon through an
HTTP GET request
…feature, really?
(it comes in handy for debugging
purpose)

telnetd.cgi
Reverse…
Typo here…

telnetd.cgi
Let’s test it!
No UART wires and “noise”,
from now on…
and typo here… so, it works :-)

Bug Hunting
TARGET:
DAY 2

Binary Reverse
Best friend: Debugger & Disassembler
How it works:
CGI manages parameter through
environment variables (take note for
debugging session)
Reverse ipcam_cgi

Goal: HTTP Request —> public/… —> vulnerability (?)
1) strcpy() —> dest with ﬁxed size (1024)
2) strcpy() —> i can control the source
3) strcpy() —> no check on src size
ipcam_cgi

HACKED POTATO!
HTTPdHTTP GET getSysteminfo.cgi
2016 ipcam_cgiHTTPd set ENV variables
strcpy()ipcam_cgi parse & copy
Stack Buffer Overﬂow
Recipe… …result
ipcam_cgi

ipcam_cgi
Let’s test it!
Value length > 1024 byte (0x400)

ipcam_cgi
some math…
“action=“ + 1017 + “BBBB” (0x42424242)
Invalid Read Access
Goal: HTTP Request —> public/… —> vulnerability (!)

Exploiting
TARGET:
DAY 3

Protection
Mechanisms
Goal: HTTP Request —> ipcam_cgi —> code exec
ASLR = Address Space Layout Randomization
Randomly arranges the address space positions of key data areas of a process:
executable, stack, heap and libraries.
(2) Memory Map
Stack Base = 0x7fad6000
Stack Base = 0x7fdac000
Partially Enabled
(1) Memory Map

Protection
Mechanisms
Goal: HTTP Request —> ipcam_cgi —> code exec
(2) Memory Map
(1) Memory Map
W^X = Write XOR Execute
Address space may be either writable or executable, but not both
Not Enabled
32bit arch no PAE

“Exploitation plan”
Steps
1) Hijack the control ﬂow
2) Bypass Protections
3) Inject arbitrary code
…and jump there!

Mips Note
Goal: Low-level note…MIPS
registers
Image courtesy of hmc.edu

Hijack the
flow
Goal: Overwrite Saved Return Pointer -> Control RA
Control “Return Address” register
Exception: “Invalid Read Access”
=
Pointer(s) stored in the Stack
=
“CONSTRAINTS”
Constraints solved…
Stack SrP —> 0x46464646 —>
RA = SrP
Control Flow Hijacked!

Bypass Stack ASLR
Jump there…. where!?
Stack + ASLR
“Code-Reuse” Attack
Bypass
Protections
Goal: Find a stack pointer

Bypass Stack ASLR
“Code reuse” attack… how it works?
Execute the code which is “already” present
in the memory
Usually used to bypass NX
Bypass
Protections

Bypass Stack ASLR
“System” applies a restriction…
Bypass
Protections

Bypass Stack ASLR
…but she’s smart!
Bypass
Protections
Answer is “NO”

Bypass Stack ASLR
“Code reuse” attack… exploitation purpose
1. Libraries: Fixed location in memory
2. Plan: Concatenate “pieces” of (that) code
3. Get a (randomized) stack pointer to defeat ASLR
Bypass
Protections

Cache coherence
Goal: Defeat cache coherence
MIPS CPUs have 2 separate caches
(data and instructions)
Cache != Protection… but aﬀect exploitation!
• Our payload will be in memory as data

• Hijack control ﬂow… and Shellcode in D-cache

• How to move Shellcode in Main Memory?
Bypass
Protections

“Bypass” Cache coherence
Cache Flushing… how to
1. Filling the D-cache to force the CPU to write-back

2. cacheﬂush() systemcall

3. Call a blocking function (like sleep() or similar)
Cache != Protection… and we can defeat it!
Bypass
Protections
Goal: Defeat cache coherence

put them all together…
Goal: Execute a “connect back” shellcode
Chain of “Gadgets” - Step 1 - Defeat Cache
Inject
arbitrary
code
Hijack Control Flow “Init” Gadget “Double-Jump” Gadget
call usleep()
set usleep() arg jump next…

Chain of “Gadgets” - Step 2 - Defeat Stack ASLR
Inject
arbitrary
code
Move Stack Pointer in $A1 Move $A1 in $V0 Jump to $V0

Chain of “Gadgets” - Step 3 - Execute Shellcode
Inject
arbitrary
code
Ehi! That’s my code…
Connect back shell… port 8080

Wait for a root shell…
Execute
arbitrary
code

Let’s play
the bad guys
Botnet

…while you wait for the crypto
miner botnet
Don’t do this at home! :-)

TIMELINE
2016
February
2018
ME —> EDIMAX
Proof of concept
March
2018
EDIMAX —> ME
Private Beta version
April
2018
New Firmware (??)
CVE-2018-8072

Thank you!
https://gitlab.com/nemux/CVE-2018-8072

IoT exploitation: from memory corruption to code execution - Marco Romano - Codemotion Rome 2018

More Related Content

What's hot

Similar to IoT exploitation: from memory corruption to code execution - Marco Romano - Codemotion Rome 2018

More from Codemotion

Recently uploaded

IoT exploitation: from memory corruption to code execution - Marco Romano - Codemotion Rome 2018