a single gadget weird machine Highlights of Dutch Cyber Security - - PowerPoint PPT Presentation

▶
a single gadget weird machine
SMART_READER_LITE
LIVE PREVIEW

a single gadget weird machine Highlights of Dutch Cyber Security - - PowerPoint PPT Presentation

Feb 12, 2023 252 likes •880 views

a single gadget weird machine Highlights of Dutch Cyber Security Research Framing Signals a return to portable shellcode Erik Bosman and Herbert Bos memory corruption, the problem that just won't go away 25+ years after the morris worm and

slide-1
SLIDE 1

a single gadget weird machine

Framing Signals a return to portable shellcode

Erik Bosman and Herbert Bos

Highlights of Dutch Cyber Security Research

slide-2
SLIDE 2

memory corruption, the problem that just won't go away

25+ years after the morris worm and still going strong

1

slide-3
SLIDE 3

stack buffer overflow stack sp

return addr buffer

2

slide-4
SLIDE 4

stack buffer overflow stack sp

return addr buffer

2

slide-5
SLIDE 5

stack buffer overflow stack sp

return addr buffer

2

slide-6
SLIDE 6

stack buffer overflow stack sp

return addr buffer

2

slide-7
SLIDE 7

stack buffer overflow stack sp

return addr buffer

2

slide-8
SLIDE 8

stack buffer overflow stack sp

return addr buffer

2

slide-9
SLIDE 9

stack sp

return addr buffer

3

slide-10
SLIDE 10

stack sp

return addr buffer

code

3

slide-11
SLIDE 11

return oriented programming

stack

return addr buffer

code

gadgets

3

slide-12
SLIDE 12

return addr buffer

code

return addr return addr

gadgets

3

slide-13
SLIDE 13

Return Oriented Programming

  • dependent on available gadgets
  • non-trivial to program
  • chains may differ greatly between

different binaries

  • Turing complete

4

slide-14
SLIDE 14

Sigreturn Oriented Programming

  • minimal number of gadgets
  • constructing shellcode by

chaining system calls

  • easy to change functionality of

shellcode

  • shellcode portable

(gadgets are always present)

  • Turing complete

5

slide-15
SLIDE 15

unix signals stack sp

6

slide-16
SLIDE 16

unix signals stack sp

6

slide-17
SLIDE 17

unix signals stack sp

ucontext siginfo

6

slide-18
SLIDE 18

unix signals stack sp

ucontext sigreturn siginfo

6

slide-19
SLIDE 19

unix signals stack sp

ucontext sigreturn siginfo good: kernel agnostic about signal handlers

6

slide-20
SLIDE 20

unix signals stack sp

ucontext sigreturn siginfo bad: kernel agnostic about signal handlers (we can fake 'em)

6

slide-21
SLIDE 21

two gadgets

  • call to sigreturn
  • syscall & return

7

slide-22
SLIDE 22

forged signal frame sigreturn

8

slide-23
SLIDE 23

forged signal frame sigreturn program counter

8

slide-24
SLIDE 24

forged signal frame sigreturn program counter stack pointer

8

slide-25
SLIDE 25

sigreturn program counter stack pointer RAX RDX R10 R8 R9 RDI RSI ... ...

8

slide-26
SLIDE 26

sigreturn program counter stack pointer syscall number arg3 arg4 arg5 arg6 arg1 arg2 ... ...

8

slide-27
SLIDE 27

sigreturn syscall & return stack pointer syscall number arg3 arg4 arg5 arg6 arg1 arg2 ... ...

8

slide-28
SLIDE 28

sigreturn syscall & return next sigframe syscall number arg3 arg4 arg5 arg6 arg1 arg2 ... ...

8

slide-29
SLIDE 29

syscall(...) next

9

slide-30
SLIDE 30

socket() bind() listen() accept() execve() 10

slide-31
SLIDE 31

SROP exploit on x86-64

An exploit which does not make use

  • f any gadgets in the target program
  • control over the stack
  • a known writable memory location

(*any* location, and we don't need to write there beforehand)

11

slide-32
SLIDE 32

two gadgets

  • call to sigreturn
  • syscall & return

12

slide-33
SLIDE 33

two gadgets

  • call to sigreturn: RAX = 15 + syscall
  • syscall & return

12

slide-34
SLIDE 34
  • ne gadget
  • RAX = 15
  • syscall & return

12

slide-35
SLIDE 35

[vsyscall]

ffffffffff600000 48 c7 c0 60 00 00 00 0f 05 c3 cc cc cc cc cc cc gettimeofday() fffffffffff60010 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc * ffffffffff600400 48 c7 c0 c9 00 00 00 0f 05 c3 cc cc cc cc cc cc time() ffffffffff600410 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc * ffffffffff600800 48 c7 c0 35 01 00 00 0f 05 c3 cc cc cc cc cc cc getcpu() ffffffffff600810 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc * ffffffffff601000

0f05 syscall c3 return

13

slide-36
SLIDE 36

socket() bind() listen() accept() execve() 14

slide-37
SLIDE 37

socket() bind() listen() accept() execve() 14

slide-38
SLIDE 38

read(fd, buffer, 1024) RAX RDI RSI RDX

x64 syscall ABI

15

slide-39
SLIDE 39

read(fd, buffer, 1024) = 1024 RAX RDI RSI RDX

x64 syscall ABI

15

slide-40
SLIDE 40

read(fd, buffer, 1024) = 1024 RAX RDI RSI RDX RAX

x64 syscall ABI

15

slide-41
SLIDE 41

read() = 306 (syncfs) fsyncfs() = 0 (read) read() = 15 (sigreturn) sigreturn() execve() 16

slide-42
SLIDE 42

CVE-2012-5976 (asterisk)

17

slide-43
SLIDE 43

On some systems SROP gadgets are randomised, on others, they are not

Operating system Gadget Memory map Linux i386 sigreturn [vdso] Linux < 3.11 ARM sigreturn [vectors] Linux < 3.3 x86-64 syscall & return [vsyscall] Linux ≥ 3.3 x86-64 syscall & return Libc Linux x86-64 sigreturn Libc FreeBSD 9.2 x86-64 sigreturn 0x7ffffffff000 Mac OSX x86-64 sigreturn Libc iOS ARM sigreturn Libsystem iOS ARM syscall & return Libsystem 0xffff0000 0xffffffffff600000

18

slide-44
SLIDE 44

On some systems SROP gadgets are randomised, on others, they are not

Operating system Gadget Memory map Linux i386 sigreturn [vdso] Linux < 3.11 ARM sigreturn [vectors] Linux < 3.3 x86-64 syscall & return [vsyscall] Linux ≥ 3.3 x86-64 syscall & return Libc Linux x86-64 sigreturn Libc FreeBSD 9.2 x86-64 sigreturn 0x7ffffffff000 Mac OSX x86-64 sigreturn Libc iOS ARM sigreturn Libsystem iOS ARM syscall & return Libsystem 0xffff0000 0xffffffffff600000

non-ASLR :-( android

18

slide-45
SLIDE 45

questions?

19

slide-46
SLIDE 46

questions?

27

slide-47
SLIDE 47

mitigation:

It may be useful to disable vsyscall vsyscall=emulate (default from Linux 3.3 onward)

  • r

vsyscall=none

slide-48
SLIDE 48

mitigation:

  • Signal frame canaries
slide-49
SLIDE 49

stack canary stack sp

return addr buffer

slide-50
SLIDE 50

stack canary stack sp

return addr buffer

slide-51
SLIDE 51

sigreturn program counter stack pointer RAX RDX R10 R8 R9 RDI RSI ... ...

slide-52
SLIDE 52

sigreturn program counter stack pointer RAX RDX R10 R8 R9 RDI RSI ... ...

slide-53
SLIDE 53

mitigation:

  • Signal frame canaries
slide-54
SLIDE 54

mitigation:

  • Signal frame canaries
  • Counting signals in progress
slide-55
SLIDE 55

CVE-2012-5976 (asterisk)

stack sp stack sp

slide-56
SLIDE 56

CVE-2012-5976 (asterisk)

stack sp stack sp alloca

slide-57
SLIDE 57

CVE-2012-5976 (asterisk)

stack sp stack sp alloca

slide-58
SLIDE 58

dispatch jmp dispatch load CODE jump cond jump P = P + c *P = *P + c *P=getchar() putchar(*P) store exit

slide-59
SLIDE 59

code = open("/proc/self/mem",O_RDWR); p = open("/proc/self/mem",O_RDWR); a = open("/proc/self/mem",O_RDWR);

slide-60
SLIDE 60

code = open("/proc/self/mem",O_RDWR); p = open("/proc/self/mem",O_RDWR); a = open("/proc/self/mem",O_RDWR); instruction dispatch: read(code, &ucontext.sp, sizeof(long));

slide-61
SLIDE 61

code = open("/proc/self/mem",O_RDWR); p = open("/proc/self/mem",O_RDWR); a = open("/proc/self/mem",O_RDWR); instruction dispatch: read(code, &ucontext.sp, sizeof(long)); pointer ops: p++ -> lseek(p, 1, SEEK_CUR);

slide-62
SLIDE 62

code = open("/proc/self/mem",O_RDWR); p = open("/proc/self/mem",O_RDWR); a = open("/proc/self/mem",O_RDWR); instruction dispatch: read(code, &ucontext.sp, sizeof(long)); pointer ops: p++ -> lseek(p, 1, SEEK_CUR); addition: lseek(a, &identity_table_x2, SEEK_SET); lseek(a, val1, SEEK_SET); lseek(a, val2, SEEK_SET); read(a, dest, 1);