Return Oriented Programming (ROP) Based Exploits - Part I by Anish & Team @ null B'lore Meet in September, 2010

2. Return Oriented Programming (ROP) Based Exploits - Part I

3. Exploit - ex·ploit to use selfishly for one's own ends

4. Exploit Discovery Big space in computer security Exploits are discovered by Security Researchers and Hackers alike Zero day attacks are a result of newly created exploits or un-patched vulnerabilities

5. Exploit Mitigation Windows XP Sp2 was the first widespread OS to incorporate exploit mitigation Protected stack metadata (Visual studio compiler/ GS flag) Protected heap metadata (RtlHeap Safe Unlinking) SafeSEH (Compile time execution handler registration) Software, Hardware enforced Data Execution Prevention (DEP) Windows Vista implements Address Space Layout Randomization (ASLR)

6. Break the mitigation BlackHat Presentations Security Forums Blogs

7. Whose responsibility is it to mitigate ? Heap Protection SEH Chain validation DEP ASLR Stack Cookies Safe SEH

8. DEP - Data Execution Prevention When an attempt is made to execute code from a DEP protected data page,an access violation (STATUS_ACCESS_VIOLATION (0xc0000005)) will occur. In most cases, this will result in process termination (unhandled exception).

9. DEP - Data Execution Prevention Without DEP On With DEP On

10. Problem With DEP on, code from the stack won’t work

11. Work-Around We need to build a chain of instructions. We need to jump from one part of the chain to the other part of the chain without ever executing a single bit from our DEP protected region. Or, to use a better term, we need to return from one instruction to the address of the next instruction Each instruction (series of instructions) in our chain will be called a "gadget". Each gadget will return to the next gadget ( = to the address of the next gadget, placed on the stack), or will call the next address directly. We will need to use existing instructions (instructions in executable areas within the process) and put them in such an order (and "chain" them together) so they would produce what we need and put data in registers and/or on the stack

12. Letter The chocolate bombs you sent, bombs they are in size . Received them, yesterday. Planted the rose plant, bomb was delicious … had to mention again. Set to go for shopping, 5 p.m. tomorrow. The chocolate bombs you sent, bombs they are in size . Received them, yesterday. Planted the rose plant, bomb was delicious … had to mention again. Set to go for shopping, 5 p.m. tomorrow. ThebombsReceivedyesterday PlantedbombSet5 p.m. tomorrow

13. Don’t sleep yet

14. Gadget We need to take a value from the stack, put it in EAX, and increase it with 0×80

15. Gadget We need to take a value from the stack, put it in EAX, and increase it with 0×80 -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- WindowsFunction_1() ADD EBX, 30 TEST AL, AL POP EAX RET POP EAX RET ADD EAX, 80 POP EBX RET -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- WindowsFunction_2() INC EAX ADD EAX, 80 POP EBX RET -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - --

16. Gadget Stack address Stack value ESP points here -> 0010F730 10026D56 (pointer to POP EAX + RET) 0010F734 50505050 (this will be popped into EAX) 0010F738 1002DC24 (pointer to ADD EAX,80 + POP EBX + RET) 0010F73C DEADBEEF (this will be popped into EBX, padding)

17. Windows Function Calls to bypass DEP VirtualAlloc(MEM_COMMIT + PAGE_READWRITE_EXECUTE) + copy memory. This will allow you to create a new executable memory region, copy your shellcode to it, and execute it HeapCreate(HEAP_CREATE_ENABLE_EXECUTE) + HeapAlloc() + copy memory. SetProcessDEPPolicy() NtSetInformationProcess() VirtualProtect(PAGE_READ_WRITE_EXECUTE). This function will change the access protection level of a given memory page, allowing you to mark the location where your shellcode resides as executable. WriteProcessMemory()

18. Windows Function Calls to bypass DEP Each one of those functions requires the stack or registers to be set up in a specific way. when an API is called, it will assume that the parameters to the function are placed at the top of the stack (= at ESP)

19. How to chain Demo

20. Finding ROP gadgets There are 2 approaches to finding gadgets that will help you building the ROP chain : You can specifically search for instructions and see if they are followed by a RET. The instructions between the one you are looking for, and the RET instruction (which will end the gadget) should not break the gadget. You can look for all RET instructions and then walk back, see if the previous instructions include the instruction you are looking for. pvefindaddr

21. First part of the Exploit Testing ROP with a Windows API VirtualProtect() Demo

22. Now you can sleep 

23. Thank You

24. Images http://s280.photobucket.com/albums/kk176/sabbath_X/?action=view&current=Pumpkin_ Grin_lll_by_midnightINK.jpg&newest=1 http://www.indiamike.com/india/attachments/7595d1210760693-what-the-strange-questions-for-india-experts-chilli-and-lemon.jpg http://www.animevice.com/profile/kao/all-images/84-142612/albert_wesker___reside nt_evil_by_megakay/83-203102/ http://la-vie-bohem.deviantart.com/art/Yawn-115528201?q=boost%3Apopular+yawn+baby&qo=32 http://SillyScreamingQueen.deviantart.com/art/Sleepy-54882830?q=boost%3Apopular+sleepy&qo=6