Pure In-Memory (Shell)Code Injection In Linux Userland DeepSec18, - - PowerPoint PPT Presentation

▶
pure in memory shell code injection in linux userland
SMART_READER_LITE
LIVE PREVIEW

Pure In-Memory (Shell)Code Injection In Linux Userland DeepSec18, - - PowerPoint PPT Presentation

Dec 04, 2023 149 likes •511 views

Pure In-Memory (Shell)Code Injection In Linux Userland DeepSec18, Vienna, Austria Disclaimer The views and opinions expressed in this presentation are those of the author and do not necessarily represent offjcial policy or position of my

slide-1
SLIDE 1

Pure In-Memory (Shell)Code Injection In Linux Userland

DeepSec’18, Vienna, Austria

slide-2
SLIDE 2

Disclaimer The views and opinions expressed in this presentation are those of the author and do not necessarily represent

  • ffjcial policy or position of my employer or of its clients.
slide-3
SLIDE 3

$ fjnger -l $USER Login name: reenz0h In real life: reenz0h Directory: /home/sweeTHome Shell: /usr/bin/ipython Last login Fri Jun 29 22:21 on rawttyS0 from ::1 Unread mail since T ue Feb 14 23:40:24 2017 Plan: * Senior Security Researcher / Red T eamer @ Big Company * Former (sys|net) engineer * Speaker/Trainer * Organizer of x33fcon security conference, Gdynia, Poland * Founder/CEO of Sektor7 research company

about(me);

slide-4
SLIDE 4

* Problem Description * Common Code Execution w/ Artifacts * Communication Channels (IB/OOB) w/ compromised system * In-Memory-Only Methods

  • Live Demos

* OPSEC considerations * References

agenda(DeepSec);

slide-5
SLIDE 5

#defjne PROBLEM;

* Scenario:

  • breached into a Linux system;
  • access to interactive shell w/ or w/o allocated PTY;
  • post-exploitation activities w/ additional tools;

* Objective:

  • run extra tools w/o touching disk;
  • use only what is available on compromised system;
  • optionally bypass noexec fmag set on partitions;
slide-6
SLIDE 6

#redefjne PROBLEM;

Living ofg the land…

MacGyver style

slide-7
SLIDE 7

send_payload(victim);

Communication channels (methods to deliver payloads): * “Out-Of-Band”: network protocols/sockets (uni|multi|broad|any-cast), internal/extrenal devices * “In-Band”: TTY as a data link

slide-8
SLIDE 8

In-Memory-Only Methods

slide-9
SLIDE 9

shellcode(DEMO);

The following shellcode will be used during DEMO sessions.

slide-10
SLIDE 10

mount(tmpfs);

NAME tmpfs - a virtual memory fjlesystem DESCRIPTION The tmpfs facility allows the creation of fjlesystems whose contents reside in virtual memory. Since the fjles on such fjlesystems typically reside in RAM, fjle access is extremely fast.

slide-11
SLIDE 11

mount(tmpfs);

slide-12
SLIDE 12

execve(gdb);

DESCRIPTION [...] GDB can do four main kinds of things (plus other things in support of these) to help you catch bugs in the act: · Start your program, specifying anything that might afgect its behavior. · Make your program stop on specifjed conditions. · Examine what has happened, when your program has stopped. · Change things in your program, so you can experiment with correcting the efgects of one bug and go on to learn about another.

slide-13
SLIDE 13

execve(gdb);

DEMO

slide-14
SLIDE 14

gdb(POC);

slide-15
SLIDE 15

execve(python);

Use CTYPES to run your shellcode in memory: * load libc; * mmap() new W+X memory region for shellcode * copy shellcode into mmap’ed bufger * make the bufger ‘callable’ * make the call * profjt...

slide-16
SLIDE 16

execve(python);

DEMO

slide-17
SLIDE 17

python(POC);

slide-18
SLIDE 18

NAME dd - convert and copy a fjle DESCRIPTION Copy a fjle, converting and formatting according to the operands.

  • NAME

proc - process information pseudo-fjlesystem DESCRIPTION The proc fjlesystem is a pseudo-fjlesystem which provides an interface to kernel data structures.

dd(procfs);

slide-19
SLIDE 19

dd(procfs);

This translates to:

“Make dd modify itself on the fmy”

But… 2 problems: stdin and stdout; ASLR

slide-20
SLIDE 20

dd(procfs);

Problem #1: dd closes stdin and stdout Solution: dup()

slide-21
SLIDE 21

dd(procfs);

Problem #2: ASLR

slide-22
SLIDE 22

dd(procfs);

Solution: change execution domain (aka personality) DESCRIPTION Linux supports difgerent execution domains, or personalities, for each process. Among other things, execution domains tell Linux how to map signal numbers into signal actions. The execution domain system allows Linux to provide limited support for binaries compiled under other UNIX-like operating systems. […] ADDR_NO_RANDOMIZE (since Linux 2.6.12) With this fmag set, disable address-space-layout randomization.

slide-23
SLIDE 23

dd(procfs);

T urning ASLR ofg at runtime (from userland):

slide-24
SLIDE 24

dd(procfs);

Write-What(Shellcode)-Where? PLT? Risky ...

slide-25
SLIDE 25

dd(procfs);

DEMO

slide-26
SLIDE 26

dd(POC);

slide-27
SLIDE 27

call(MOAR_POWER);

Shellcode is kinda cool, but coding complicated stufgs in asm is a PITA.

We want to run an executable (ELF object).

So…

slide-28
SLIDE 28

mkfjfo();

Fails… mmap() cannot fjnd target fjle to load.

slide-29
SLIDE 29

memfd_create();

SYNOPSIS

#include <sys/memfd.h> int memfd_create(const char *name, unsigned int flags); DESCRIPTION memfd_create() creates an anonymous fjle and returns a fjle descriptor that refers to it. The fjle behaves like a regular fjle, and so can be modifjed, truncated, memory-mapped, and so on. However, unlike a regular fjle, it lives in RAM and has a volatile backing storage. Once all references to the fjle are dropped, it is automatically released. [...] The memfd_create() system call fjrst appeared in Linux 3.17; glibc support was added in version 2.27.

slide-30
SLIDE 30

memfd_create();

Shellcode:

slide-31
SLIDE 31

memfd_create();

DEMO

slide-32
SLIDE 32

memfd_create(POC);

slide-33
SLIDE 33
  • psec();

* Logs * Process list * Swappiness

  • mlock(), mlockall(), mmap() - CAP_IPC_LOCK || root

+ ulimits

  • sysctl vm.swappiness / /proc/sys/vm/swappiness - root
  • cgroups (memory

.swappiness) - root || priviledge to modify cgroup + does not guarantee that under heavy load memory manager will not swap the process to disk anyway (ie. root cgroup allows swapping and needs memory)

slide-34
SLIDE 34

bottom_line(); Be like MacGyver

slide-35
SLIDE 35

Questions?

twitter: @x33fcon https://www.x33fcon.com https://www.sektor7.net

exit(“Thank you”);

slide-36
SLIDE 36

call(references);

* The Design and Implementation of Userland Exec by the grugq https://grugq.github.io/docs/ul_exec.txt * Advanced Antiforensics : SELF by Pluf & Ripe

http://phrack.org/issues/63/11.html

* Implementation of SELF in python by mak https://github.com/mak/pyself * Linux based inter-process code injection without ptrace(2) by Rory McNamara https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter-process-code-injection-without-

ptrace2.html