This presentation deals with different scenarios in attacking applications vulnerable to Buffer overflow by exploiting the default SEH chain, by the SEH overwrite

1. SEH BASED BUFFER OVERFLOW

4. What is an Exception
• An Exception is an event which occurs during
execution, which requires execution of code outside
normal flow of control.

5. Exception Basics
Operating System
Process
__try{
//exception may occur here
…..
}
_except(exception filter) {
//This handles the exception
…..printf(“exception”);
}
Exception Handler

6. How dose the OS locate the Handlers
Process
Thread Information Block
Exception Registration
8 bytes
Pointer to Next Record
Pointer to Handler
Exception Registration Record
FS:[0]

7. Complicated Program with SEH
Main()
{
functionA();
}
fundtionA()
{
__try{
functionB();
}__except(…..)
{
…..
}
functionB()
{
__try(
functionC();
}__except(….)
{
…..
}
{
functionC()
{
__try{
print(“SHE Demo”)
}__except(….)
{
…..
}
}

8. Exception Registration Linked List
FS : [0]
Record 1
8 bytes
FFFFFF
OS Handler
Thread Information Block
Exception Registration
Process

9. Complicated Program with SEH
Main()
{
functionA();
}
fundtionA()
{
__try{
….previous line
functionB();
}__except(…..)
{
…..
}
}
functionB()
{
__try(
functionC();
}__except(….)
{
…..
}
{
functionC()
{
__try{
print(“SHE Demo”)
}__except(….)
{
…..
}
}

10. Exception Registration Linked List
Exception Registration
Thread Information Block
FFFFFFF
OS Handler
FS : [0]
Record 2
Ptr to R2
Function A
Handler
Record 1

11. Complicated Program with SEH
Main()
{
functionA();
}
fundtionA()
{
__try{
functionB();
}__except(…..)
{
…..
}
}
functionB()
{
__try(
….previous line
functionC();
}__except(….)
{
…..
}
{
functionC()
{
__try{
print(“SHE Demo”)
}__except(….)
{
…..
}
}

12. Exception Registration Linked List
Exception Registration
Thread Information Block
FS : [0]
Ptr to R2
FunctionB
Handler
Record 1
Record 2
Record 3
Ptr to R3
FunctionA
Handler
FFFFFFFF
OS Handler

13. Complicated Program with SEH
Main()
{
functionA();
}
fundtionA()
{
__try{
functionB();
B
}__except(…..)
{
…..
}
}
functionB()
{
__try(
functionC();
}__except(….)
{
…..
}
{
functionC()
{
__try{
print(“SEH Demo”)
}__except(….)
{
…..
}
}

14. Exception Registration Linked List
Exception Registration
Thread Information Block
FS : [0]
Ptr to R2
FunctionC
Handler
Record 1
Record 2
Record 3
Ptr to R3
FunctionB
Handler
Ptr to R4
Record 4
FFFFFFFF
OS Handler
FunctionA
Handler

15. Program without SEH
Main()
{
functionA();
}
fundtionA()
{
__try{
functionB();
}
functionB()
{
functionC();
{
FunctionC()
{
print(“SHE Demo”)
}

16. Program Stack without SEH
fundC Local Variables
funcB’s EBP
Return Address in funcB
funcC Argument 1
funcC Argument 2
fundB Local Variables
funcA’s EBP
Return Address in funcA
funcB Argument 1
funcB Argument 2
fundA Local Variables
Caller’s EBP
Return Address in Caller
funcAArgument 1
funcAA rgument 2
Bottom of Stack
(High memory addresses)
Unused Stack
(Lower monory addresses)
ESP
EBP funcC’s
Stack Frame
funcB’s
Stack Frame
funcA’s
Stake Frame

17. Program with SEH
Main()
{
functionA();
}
fundtionA()
{
__try{
functionB();
}__except(…..)
{
…..
}
}
functionB()
{
__try(
functionC();
}__except(….)
{
…..
}
{
Function
{
__try{
print(“SHE Demo”)
}__except(….)
{
…..
}
}

18. Program Stack with SEH
Bottom of Stack
(High memory addresses)
Unused Stack
(Lower monory addresses)
ESP
EBP
funcC’s
Stack Frame
funcB’s
Stack Frame
funcA’s
Stake Frame
funcC Local Variables
Next Exception_Registration_Record
funcC Exception Handler
funcB’s EBP
Return Address in funB
funcC Argument 1
funcC Arfument 2
funcB Local Variables
Next Exception_Registration_Record
funcB Exception Handler
funcA’s EBP
Return Address in funcA
funcB Argument 1
funcB Arfument 2
funcC Local Variables
Next Exception_Registration_Record
funcA Exception Handler
Caller’s EBP
Return Address in funB
funcC Argument 1
funcC Arfument 2
funcC’s
Exception
Registration
Record
funcB’s
Exception
Registration
Record
funcA’s
Exception
Registration
Record
EBP

19. Quick Recap of Concepts
• SEH Consist of a chain Exception Registration Records
• These Records are dynamically added and removed from a linked list
based on where we are in code
• FS : [0] points to the start of the SEH chain
• When an Exception happens OS walks the SEH chain to check who can
handle the exception
• If a handler is found, it handles the exception; else default OS handler
kicks in

20. Who walks the SEH chain ? Exception Dispatcher
KiUserExceptionDispatcher()
RtlDispatchException()
RtlExecuteHandlerForException()
ExecuteHandler()
_except_handler()

21. _except_handler3() in turns calls our handler
_except_handler3()
{
Scopetable filter-expression()
_global_unwind2()
RtlUnwind()
RtlExcuteHandlerForUnwind()
Scopetable_except block()
}
__try{
int*p = 0x000000
*p = 10;
} _except(filter(…….)) {
…..printf(“exception”);
}

22. Handler Prototype
• Protptype for the exception handler is as follows
( excpt.h ) :
EXCEPTION_DISPOSITION
__cdecl_except_handler(
struct_EXCEPTION_RECORD *ExceptionRecord,
void * EstablisherFrame,
struct_CONTEXT *ContexRecord,
void * Dispatchercontext
);

23. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
FS[0]
Low Memory
Analyzing the 2 Stack Frames
ExeceptionHandler()
{
…..EIP
Exception Dispatcher Stack
…..
…..
Establisher Frame
…..
…..
…..
…..
ESP
ESP+4
ESP+8

24. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
FS[0]
Low Memory
What if?
ExeceptionHandler()
{
EIP
Exception Dispatcher Stack
…..
…..
Establisher Frame
…..
…..
…..
…..
ESP
ESP+4
ESP+8
pop eax
pop ebx
retn

25. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
Low Memory
Pop EAX
ExeceptionHandler()
{
EIP
Exception Dispatcher Stack
ESP
ESP+4
ESP+8
pop eax
pop ebx
retn
…..
Establisher Frame
…..
…..
…..
…..

26. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
Low Memory
Pop EBX
ExeceptionHandler()
{
EIP
Exception Dispatcher Stack
ESP
ESP+4
ESP+8
pop eax
pop ebx
retn
…..
Establisher Frame
…..
…..
…..
…..

27. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
Low Memory
RETN
ExeceptionHandler()
{
Exception Dispatcher Stack
ESP
ESP+4
ESP+8
pop eax
pop ebx
retn
Establisher Frame
…..
…..
…..
…..

28. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
Low Memory
RETN
ExeceptionHandler()
{
Exception Dispatcher Stack
ESP
ESP+4
ESP+8
popup eax
popup ebx
retn
Establisher Frame
…..
…..
…..
…..
EIP

29. Demo of overwrite with AAAAA….
• Verify the POP/POP/RET instruction sends control to the
next ERR location
• Cause a buffer overflow in the Easy Chat program by
sending a large number of AAA

30. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
FS[0]
Low Memory
How do we exploit this condition?
AAAA
Program Stack after overwrite
FS[0]
Low Memory

31. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
FS[0]
Low Memory
How do we exploit this condition?
AAAA
Short JMP 6 Bytes
ExceptionHandler()
Program Stack after overwrite
FS[0]
Low Memory
ExeceptionHandler()
{
pop eax
pop ebx
retn

32. Local Variable
Next ERR
ExceptionHandler()
Func – B EBP
RET of Func – B
Func – C Arg 1
Func – C Arg 2
Program Stack
FS[0]
Low Memory
How do we exploit this condition?
AAAA
Short JMP 6 Bytes
ExceptionHandler()
NOP sled
Payload
Payload
Payload
Program Stack after overwrite
FS[0]
Low Memory
ExeceptionHandler()
{
pop eax
pop ebx
retn
Establisher Frame
EIP
Short JMP 6
Bytes
2 NOP Ptr to EH NOP Sled PayloadLow Memory
2 bytes 2 bytes 4 bytes Variable Length Variable Length

33. Lets exploit Easy chat server
• Steps :
Find exact offset of next ERR and ExceptionHindler() on the
stack
Find a POP/POP/RET sequence in module without
SAFESEH
Overwrite ExceptionHindler() with address of POP/POP/RET
Overwrite ERR with short JMP for 6 byes =>
“xEBx06x90x90”
Add payload 6 bytes below after the ExceptionHandler()

34. SEH Exploitation Protection
• Modules linked with /SAFESEH cannot be used
• Creates a list of “safe” exception handlers
• OS will match the exception handler address with this list
before executing it
• If there is a match in this list, only then execution will
happen
• This was made by Microsoft to protect SEH from
exploitation and applied Windows XP SP1 onwards

35. ABUSING SEH
Access violation / exception is triggered
Pointer to Next SEH record
Current SE Handler
Pop,pop,ret
Shellcode
(1) Exception Handler
kicks in
(2) Current SE Handler was overwritten and
points to pop,pop,ret
(3) pop,pop,ret During prologue of exception handler, address of
pointer to next SEH was put on stack of ESP+8 pop pop ret puts
this address in EIP and allows execution of the code at the address
of “pointer to next SEH”
(4) Pointer to next SEH was
overwritten with jmp to shellcode