Shellcode COSC 480 Presentation Alison Buben

What is it? Definitions vary, but most include executed code that can be used to often attack a system. “Frequently (though not always), attackers deliver a payload that simply launches a command shell.” Will be discussed mainly in respects to buffer overflows

Roadmap Importance and Relevance Definitions Introduction and History The Main Reason This Is Possible Five Explanation Steps Problems and Solutions Sources and Discussion

Importance and Relevance Why should one care about this problem? Way of infecting computers Often helps get more malware into the host When you have vulnerabilities, attackers can take control of your system. Buffer Overflows are a common problem still today

Definitions Buffer: “contiguous block of computer memory that holds multiple instances of the same data type” Static Variables: “[variables] allocated at load time on the data segment” *Dynamic Variables: “[variables] allocated at run time on the stack.” NOP: “Non-operation” Sled: NOP bytes that lead to Shellcode

History Stems from C language which often does not have buffer checkers Most used in buffer overflows: This happens when: Boundary of a buffer is unchecked Code injected to buffer by Attackers

Introduction To Perform a buffer overflow: Make a string larger then the buffer's size This should cause a overflow Objective is to overwrite other memory address Want to overwrite the stack pointer or return address If successful, then you can execute other code

Main Reason This Is Possible Several C string Functions do not check boundaries strcat() strcpy() sprintf() vsprintf() Using these functions can allow a buffer to have extra characters.

How to Achieve This: Part 1 Need knowledge of several concepts: How memory is organized Push and Pop A type of Assembly (some C too) Goal: to overwrite memory and gain control Most often the return address executes other code Usually spawn a shell, hence, “Shellcode”

Part 2: Overview Main Idea: Making a string larger then the buffer Some good tools are: GCC NASM Objdump “The typical end goal of the shellcode is to give the attacker full control of the victim system.”

Part 3: Main Structure Brief Outline: Write C code Compile to get Assembly Object dump to see disassembly Find bytes needed and make them into a string “char shellcode[] = “\btye\btye\byte”; Use that string in your C code

Part 4: Prevention Focusing on security, prevention is key Need to try and detect Shellcode However, obfuscation and polymorphism make this job difficult Few obfuscation techniques are: Indirect jumps self-modification

Part 5: Wrap Up Buffer overflows is not the only code injection method Other methods include: Heap Spraying Format Strings Heap Overflows Sleds or Jumps can also be used Obfuscation is used to prevent detection of Shellcode

Problems and Solutions Constraint: “Character sets restricted or forbidden by applications” Ways to get around this are: Take regular Shellcode and encode it Metasploit.com offers encoding engines

Problems and Solutions More Solutions to a Shellcode constraints Payloads transformed into letters and numbers This gives even more options such as: Storing Shellcode as a password Characters are smaller then Unicode encodings

What We Have Learned Buffer Overflows and Shellcode are dangerous and a definite security concern There are many different ways to implement Shellcode Often once you get the string of code, you can listed it in your initial C program as: In C code: char shellcode[]= “line(s)\of \shellcode;”

Sources http://www.phrack.org/issues.html?id=14&issue=49 http://portal.acm.org/citation.cfm?id=1920305 http://portal.acm.org/citation.cfm?id=1653725 http://portal.acm.org/citation.cfm?doid=1920261.19 20310 http://www.phrack.org/issues.html?issue=56&id=8# article

Onto Discussion