Buffer Overflows Ian Kayne For School of Computer Science, University of Birmingham 16 th February 2009

02/20/092 Welcome  Introduction  Topics to be covered  Useful areas of existing knowledge

02/20/093 Security Flaws  User input? Buffer overflow!  One of the most common coding flaws int main() { char szName[10]; printf(“Please enter your name: ”); scanf(“%s”, szName); printf(“Hello, %s!”, szName); return 0; }

02/20/094 Buffer Overflows  What is a buffer overflow?  How does it work?  “The stack”  Last In First Out “buffer”/area of memory  Stack addressing: largest first  Stores data, parameters and return addresses

02/20/095 The Stack  Section of the stack (representative) data data data data data data data data data buffer data data data prev ebpreturn address 0x00004C00 0x00004C4F 0x00004C0F 0x00004C10 0x00004C20 0x00004C30 0x00004C40 0x00004C1F 0x00004C2F 0x00004C3F data data data data data data data 0x00004C50 0x00004C5F free free free free free free free 0x00004BFF0x00004BF0 ebp points here

02/20/096 The Stack  How does this relate to code? data data data data data data data databuffer data ebpreturn addr. int main() { char szName[10]; printf(“Please enter your name: ”); scanf(“%s”, szName); printf(“Hello, %s!”, szName); return 0; }

02/20/097 Buffer Overflow  Short names work: they fit in the buffer: data data Ian Kayne\0  Long names will break the code: data data A return address AAAAAAAAAAAA

02/20/098 Buffer Overflow  Interesting error, look closely!  Big security warning!

02/20/099 Buffer Overflow  Look at our stack representation again: data data buffer data data data frame pointerreturn address First we filled the buffer… then we overflowed to the return address A A A A A

02/20/0910 Buffer Overflow  0x is “ ” in memory, the ASCII code for “AAAA”

02/20/0911 Buffer Overflow  Why do we want a buffer overflow?  Code execution  Victim process’s security context  How do we get from crash to code?

02/20/0912 Buffer Overflow - Review  Recap:  “Grow downwards” – largest address first  Stack stores data  Every function call has a return address pushed to the stack (pointed to by x86 ebp)  Unchecked data lengths can overflow buffers  Overflow and overwrite the return address  So how do we get from crash to code?

02/20/0913 Buffer Overflow  Executable stack  Provide shellcode/payload as buffer input  Overwrite return address with buffer addr.  What is shellcode?  Difference between asm, machine code, shellcode  NULLs, high ASCII etc…

02/20/0914 Buffer Overflow  First, write our shellcode: Pseudocode: GetUsername(); ElevatePrivilege(); Pseudo-shellcode: \x6a\x35\x59\xe8\xff \xc1\x5e\x30\x4c\x0e  Metasploit and other tools make this easy!  Append address pointing to start of buffer Pseudo-shellcode: \x6a\x35\x59\xe8\xff \xc1\x5e\x30\x4c\x0e \x2C\x4C\x00\x00

02/20/0915 Buffer Overflow  Our shellcode maps to the stack layout: data return address \x6a\x35\x59\xe8\xff\xc1\x5e\x30\x4c\x0e\x2C\x4C\x00\x00 int main() { char szName[10]; printf(“Please enter your name: ”); scanf(“%s”, szName); printf(“Hello, %s!”, szName); return 0; }

02/20/0916 Buffer Overflow  One mystery left!  What is \x2C\x4C\x00\x00 ? data data data data data data data data data buffer data data data 0x00004C10 0x00004C20 0x00004C30 0x00004C1F 0x00004C2F 0x00004C3F  Endian-ness – 0x00004c2c

02/20/0917 Buffer Overflow  Buffer Overflow Demonstration

02/20/0918 Metasploit

02/20/0919 Metasploit

02/20/0920 Metasploit

02/20/0921 Buffer Overflow  Direct jump is unreliable  Rebasing (especially DLLs)  “NOP sleds”  NOP sled, then…  Shellcode, then…  Relative jump to shellcode somewhere in NOP sled  Better method is jump using register

02/20/0922 Buffer Overflow  Jump using register  Any register can point at the start of the buffer  Inject shellcode to buffer as normal  Overwrite return address with address of instructions that jump using the register  Near-guaranteed success! data shellcodereturn address EAX test ecx, ecx jmp eax push

02/20/0923 Prevention  Non-executable stack (“NX bit”)  Address randomisation  Canary bytes data return address

02/20/0924 Buffer Overflow  Recap and review  There is a lot more to buffer overflows, some detail has been cut out for clarity.  Stack diagrams are representation only and are not technically accurate  Metasploit (  “Smashing the stack for fun and profit” 

02/20/0925 Buffer Overflows  Basic principles  Flaw possible with any buffer operations  User input  Data load from disk  Data from network

02/20/0926 Review  Thank you!  Questions  Comments  Items to review  Further study