Memory Corruption The (almost) Complete History... haroon meer - - - PowerPoint PPT Presentation

▶

memory corruption

Memory Corruption The (almost) Complete History... haroon meer - - - PowerPoint PPT Presentation

Feb 05, 2024 39 likes •959 views

Memory Corruption The (almost) Complete History... haroon meer - 2010 @haroonmeer | haroon@thinkst.com Who ? haroon meer thinkst ? some papers, some books, some talks academic wannabe Why? Why? Why? Why? Why? twitter made me do it!

slide-1

SLIDE 1

Memory Corruption

The (almost) Complete History...

haroon meer - 2010 @haroonmeer | haroon@thinkst.com

slide-2

SLIDE 2

Who ?

haroon meer thinkst ? some papers, some books, some talks academic wannabe

slide-3

SLIDE 3

Why?

slide-4

SLIDE 4

Why?

slide-5

SLIDE 5

Why?

slide-6

SLIDE 6

Why?

slide-7

SLIDE 7

Why? twitter made me do it!

slide-8

SLIDE 8

Why?

de-mystify some of the otherwise mystical convince you that Solar Designer was skynet

slide-9

SLIDE 9

Why?

(Some silly Stats) Stack : 140 Heap : 74

!" #" $!" $#" %!" %#" &!" &#" '!" $(((" %!!!" %!!$" %!!%" %!!&" %!!'" %!!#" %!!)" %!!*" %!!+" %!!(" !" #" $!" $#" %!" %#" &!" $'''" %!!!" %!!$" %!!%" %!!&" %!!(" %!!#" %!!)" %!!*" %!!+" %!!'"

slide-10

SLIDE 10

Why?

(Some silly Stats) Stack : 140 Heap : 74

!" #" $!" $#" %!" %#" &!" &#" '!" $(((" %!!!" %!!$" %!!%" %!!&" %!!'" %!!#" %!!)" %!!*" %!!+" %!!(" !" #" $!" $#" %!" %#" &!" $'''" %!!!" %!!$" %!!%" %!!&" %!!(" %!!#" %!!)" %!!*" %!!+" %!!'"

slide-11

SLIDE 11

Caveats - Limits

slide-12

SLIDE 12

Caveats - Limits

slide-13

SLIDE 13

Caveats - Myopia

slide-14

SLIDE 14

Caveats - Myopia

slide-15

SLIDE 15

332880 : 1

Caveats -Compression Ratio

slide-16

SLIDE 16

Disclosure, Bugs and Counts

VS.

slide-17

SLIDE 17

Disclosed Bugs

slide-18

SLIDE 18

Our Approach

Clearly naive initially

slide-19

SLIDE 19

http://ilm.thinkst.com/folklore/

slide-20

SLIDE 20

http://ilm.thinkst.com/folklore/

slide-21

SLIDE 21

http://ilm.thinkst.com/folklore/

slide-22

SLIDE 22

the paper

(read it)

slide-23

SLIDE 23

So at the end of this..

You wont be able to suddenly use free() to obtain a 4-byte write anything anywhere primitive. You will understand what that means. You will be able to see: When that was first used; What prevents it’s use/abuse today;

slide-24

SLIDE 24

Where did it start?

slide-25

SLIDE 25

slide-26

SLIDE 26

Memory Basics

slide-27

SLIDE 27

Memory Basics

slide-28

SLIDE 28

0x00000000

Memory Basics

User

PageTable

{

4 gig

Kernel

slide-29

SLIDE 29

0x00000000

Memory Basics

User

PageTable

{

4 gig

Kernel

slide-30

SLIDE 30

0x00000000 User Kernel

{

3 gig

0x00000000 User Kernel 0x00000000 User Kernel

Multiple Processes

slide-31

SLIDE 31

0x00000000 User Kernel

{

3 gig

0x00000000 User Kernel 0x00000000 User Kernel

Multiple Processes

Kernel

slide-32

SLIDE 32

0x00000000 User

PageTable

{

4 gig

Kernel

Segments

slide-33

SLIDE 33

0x00000000 User

{

4 gig

Kernel

Segments

slide-34

SLIDE 34

0x00000000 User

{

4 gig

Kernel

0x00000000

Segments

slide-35

SLIDE 35

0x00000000 User

{

4 gig

Kernel

0x00000000 Text

Segments

slide-36

SLIDE 36

0x00000000 User

{

4 gig

Kernel

0x00000000 Text Data

Segments

slide-37

SLIDE 37

0x00000000 User

{

4 gig

Kernel

0x00000000 Text Data ...

Segments

slide-38

SLIDE 38

0x00000000 User

{

4 gig

Kernel

0x00000000 Text Data ... Heap Grows Upwards

Segments

slide-39

SLIDE 39

0x00000000 User

{

4 gig

Kernel

0x00000000 Text Data ... Heap Grows Upwards mmap (Shared Memory)

Segments

slide-40

SLIDE 40

0x00000000 User

{

4 gig

Kernel

0x00000000 Text Data ... Heap Grows Upwards mmap (Shared Memory) Stack Grows Downwards

Segments

slide-41

SLIDE 41

So what is code?

slide-42

SLIDE 42

So what is code?

slide-43

SLIDE 43

So what is code?

slide-44

SLIDE 44

So what is code?

slide-45

SLIDE 45

Is this code?

slide-46

SLIDE 46

Is this code?

slide-47

SLIDE 47

Is this code?

slide-48

SLIDE 48

Is this code?

slide-49

SLIDE 49

Is this code?

slide-50

SLIDE 50

slide-51

SLIDE 51

0x00000000 User

{

4 gig

Kernel

0x00000000 Text Data ... Heap Grows Upwards mmap (Shared Memory) Stack Grows Downwards

slide-52

SLIDE 52

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Upwards Grows Downwards 0x00000000 Stack mmap (Shared Memory) Heap Text Data ...

Stack Basics

slide-53

SLIDE 53

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Upwards Grows Downwards 0x00000000 Stack mmap (Shared Memory) Heap Text Data ...

Stack Basics

slide-54

SLIDE 54

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 int argc char **envp char **argv

Stack Basics

slide-55

SLIDE 55

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 Saved EIP Saved EBP int argc char **envp char **argv

Stack Basics

slide-56

SLIDE 56

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 Saved EIP Saved EBP int argc char **envp char **argv

Stack Basics

slide-57

SLIDE 57

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 int i Saved EIP Saved EBP int argc char **envp char **argv

Stack Basics

slide-58

SLIDE 58

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 int i Saved EIP Saved EBP int argc char **envp char **argv

Stack Basics

slide-59

SLIDE 59

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 int i Saved EIP function_1 argument_2 (b) function_1 argument_1 (a) Saved EBP int argc char **envp char **argv

Stack Basics

slide-60

SLIDE 60

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 int i Saved EIP function_1 argument_2 (b) function_1 argument_1 (a) Saved EBP int argc char **envp char **argv

Stack Basics

slide-61

SLIDE 61

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 int i Saved EIP function_1 argument_2 (b) function_1 argument_1 (a) Saved EBP Saved EIP Saved EBP int argc char **envp char **argv

Stack Basics

slide-62

SLIDE 62

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 int i Saved EIP function_1 argument_2 (b) function_1 argument_1 (a) Saved EBP Saved EIP Saved EBP int argc char **envp char **argv

Stack Basics

slide-63

SLIDE 63

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Grows Downwards 0x00000000 int i Saved EIP function_1 argument_2 (b) function_1 argument_1 (a) Saved EBP int j Saved EIP Saved EBP int argc char **envp char **argv

Stack Basics

slide-64

SLIDE 64

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Stack Basics

Grows Downwards 0x00000000 int i Saved EIP function_1 argument_2 (b) function_1 argument_1 (a) Saved EBP Saved EIP Saved EBP int argc char **envp char **argv

slide-65

SLIDE 65

int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; }

Stack Basics

Grows Downwards 0x00000000 int i Saved EIP function_1 argument_2 (b) function_1 argument_1 (a) Saved EBP int argc char **envp char **argv

slide-66

SLIDE 66

Classic Overflow

Stack Grows Downwards Saved EIP function_1 argument_1 (a) Saved EBP int j Saved EIP Saved EBP int argc char **envp char **argv buff

Overflow Direction

Where to go

slide-67

SLIDE 67

non-terminated strings

strcpy(buf1, buf2);

slide-68

SLIDE 68

non-terminated strings

strcpy(buf1, buf2);

slide-69

SLIDE 69

non-terminated strings

strcpy(buf1, buf2); char buf1[4]; strncpy(buf1, buf2, 4);

slide-70

SLIDE 70

non-terminated strings

strcpy(buf1, buf2); char buf1[4]; strncpy(buf1, buf2, 4);

slide-71

SLIDE 71

non-terminated strings

strcpy(buf1, buf2); char buf1[4]; strncpy(buf1, buf2, 4);

T E S T I N G \0

char buf1[4] char buf2[] = “TESTING”

slide-72

SLIDE 72

non-terminated strings

strcpy(buf1, buf2); char buf1[4]; strncpy(buf1, buf2, 4);

T E S T I N G \0

char buf1[4] char buf2[] = “TESTING”

T E S T

slide-73

SLIDE 73

non-terminated strings

strcpy(buf1, buf2); char buf1[4]; strncpy(buf1, buf2, 4);

T E S T I N G \0

char buf1[4] char buf2[] = “TESTING”

T E S T

printf(“buf1 is [%s]\n”,buf1);

slide-74

SLIDE 74

non-terminated strings

strcpy(buf1, buf2); char buf1[4]; strncpy(buf1, buf2, 4);

T E S T I N G \0

char buf1[4] char buf2[] = “TESTING”

T E S T

printf(“buf1 is [%s]\n”,buf1); $ buf1 is [TESTTESTING]

slide-75

SLIDE 75

heap-unlink()

bk fd bk fd bk fd 7 8 9

slide-76

SLIDE 76

heap-unlink()

bk fd bk fd bk fd 7 8 9 [x] [8] [7] [9] [8] [x] 7 8 9 back forward back forward

slide-77

SLIDE 77

heap-unlink()

[x] [8] [7] [9] [8] [x] 7 8 9 back forward back forward

slide-78

SLIDE 78

heap-unlink()

[x] [8] [7] [9] [8] [x] 7 8 9 back forward back forward [x] [8] [7] [9] [8] [x] 7 8 9 back forward back forward

slide-79

SLIDE 79

heap-unlink()

[x] [9] [7] [9] [8] [x] 7 8 9 back forward back

slide-80

SLIDE 80

heap-unlink()

[x] [9] [7] [9] [7] [x] 7 8 9 forward back

slide-81

SLIDE 81

heap-unlink()

[x] [9] [7] [9] [7] [x] 7 8 9 forward back WHERE WHAT

slide-82

SLIDE 82

slapper

* Peter Szor - analysis of the slapper worm

slide-83

SLIDE 83

gs vs params

Stack Growth Saved EBP int j Saved EIP buff

Overflow Direction

Pointers Arguments

int func(char *a, char *b) { char buf[12]; strcpy(buf, a); strcpy(b, buf); return 1; }

slide-84

SLIDE 84

gs vs params

Stack Growth Saved EBP int j Saved EIP buff

Overflow Direction

Pointers Arguments

int func(char *a, char *b) { char buf[12]; strcpy(buf, a); strcpy(b, buf); return 1; }

Stack Growth Saved EBP int j Saved EIP buff

Overflow Direction

Pointers Arguments (shadow copy) Arguments

slide-85

SLIDE 85

so..

Everything executable --> DEP DEP vs ret-2-libc (ROP)

slide-86

SLIDE 86

so..

ASLR to beat ret-2-libc / ROP Single leaked / static address beats ASLR Partial Overwrites App specific..

slide-87

SLIDE 87

so..

ASLR to beat ret-2-libc / ROP Single leaked / static address beats ASLR Partial Overwrites App specific..

Stack Growth int x int j function pointer b buff LSB's MSB's function pointer a

Overflow Direction

slide-88

SLIDE 88

slide-89

SLIDE 89

So..

DEP without ASLR ASLR without DEP without

slide-90

SLIDE 90

Conclusions?

What the ASLR/DEP taketh.. The rich client side applications giveth back.

Info. leakage attacks are an area of

much research http://ilm.thinkst.com/folklore/

slide-91

SLIDE 91

Thanks!

Marco Slaviero
Brad Spengler (spender)
PaX Team
Halvar Flake
icesurfer
Nate Lawson
Chris Wysopal
Saumil Shah
Matt Miller
Ollie Whitehouse
Dennis Groves
Ivan Arce
Mario Vilas
Tyler Shields
Dion Blazakis
georgie
Ben Nagy
the Grugq.
Bradley Cowie
Barry Irwin

slide-92

SLIDE 92

Questions ?

http://ilm.thinkst.com/folklore

@haroonmeer haroon@thinkst.com http://blog.thinkst.com