22C3 - 2.2
22nd Chaos Communication Congress
Private Investigations
| Speakers | |
|---|---|
|
Izik |
| Schedule | |
|---|---|
| Day | 4 |
| Room | Saal 2 |
| Start time | 18:00 |
| Duration | 01:00 |
| Info | |
| ID | 491 |
| Event type | Lecture |
| Track | Hacking |
| Language | English |
| Feedback | |
|---|---|
|
Did you attend this event? Give Feedback |
Advanced Buffer Overflow Methods [or] Smack the Stack
Cracking the VA-Patch
A quick review of the standard buffer overflow exploit structure VA Patch, What it is and what it does to prevent buffer overflows.
The Concept of Stack Juggling The RET2RET Method The RET2POP Method The RET2EAX Method The RET2ESP Method The Stack Stethoscope Method
VA Patch released in the purpose of raise the bar on buffer overflow exploits. It does a very small thing but it's effect is much bigger. To the moment this patch been integrated to the mainstream Linux kernel tree approximately from 2.6.11rc2 and it's activated by default. It is not optional during Kernel Compile but does have a /proc trigger.
Stack Juggling concept. Using assembly that already exists within the code in order to travel inside the stack and find a way back to the shellcode. That's includes RETs / POPs / CALLs and etc.
RET2RET Method is designed to refactor the upper frame stack for potential return address. It does by constructing a chain of RET's to bridge the gap and the side effect of NULL byte that exists inside C strings to perform a byte-alignment.
RET2POP Method is reassembles to RET2RET only focus on buffer overflow within a function. It also based on chain of RET's only to avoid the impact of the NULL byte-alignment it uses POP followed by RET
RET2EAX Method shows that when function is kind enough to return back a string pointer (the buffer) back to the program. it's passed through EAX register and the CRT (C Runtime) includes a CALL to EAX and by that provides the perfect solution.
RET2ESP Method shows the double meaning. The output of INT A = 58623 can be abused. To due hex value of the number 58623 is 'FFE4' (JMP %ESP) through offset jump into the MOV instruction it's possible to create a perfect start jump.
The Stack Stethoscope Method shows that exploit that's locally attacks a daemon can predict the exact return address. This thanks to the /proc entry of the process that exports the 'stack start address' and by calculating the distance between buffer and the stack start address. Makes it possible for the exploit prior to the attack, to calculate the return address.
- I will be showing proof of concepts actual code for each method, that includes 'vuln.c' and 'exploit.c'