Presentation is loading. Please wait.

Presentation is loading. Please wait.

Automatic Generation of Data-Oriented Exploits

Published byLynne Dean Modified over 9 years ago

Similar presentations

Presentation on theme: "Automatic Generation of Data-Oriented Exploits"— Presentation transcript:

1 Automatic Generation of Data-Oriented Exploits
Hong Hu, Zheng Leong Chua, Sendroiu Adrian, Prateek Saxena, Zhenkai Liang National University of Singapore USENIX Security Symposium 2015, Washington, D.C., USA

2 Control Flow Attacks Are Getting Harder
State-of-the-art exploits Code injection heap spray / JIT spray Code reuse ret2libc, ROP control-flow bending Defenses Data Execution Prevention Control Flow Integrity

3 DATA plane Control plane
Stat-of-the-art exploits from memory errors Code injection (e.g., heap spray / JIT spray) Code reuse (e.g., ret2libc, ROP) Defenses DEP, CFI, ASLR Block control flow hijacking in principle Control plane

4 Data-Oriented Exploits
State-of-the-art: Corrupt security-critical data leave control flow as the same Exhibit “significant” damage // set root privilege seteuid(0); ...... // set normal user privilege seteuid(pw->pw_uid); // execute user’s command //0x1D4, 0x1E4 or 0x1F4 in JScript 9, //0x188 or 0x184 in JScript 5.8, safemode = *(DWORD *)(jsobj + 0x188); if( safemode & 0xB == 0 ) { Turn_on_God_Mode(); } Wu-ftpd setuid operation* IE SafeMode Bypass+ * Shuo Chen, Jun Xu, Emre C. Sezer, Prachi Gauriar, and Ravishankar K. Iyer. Non-Control-Data Attacks Are Realistic Threats. In USENIX + Yang Yu. Write Once, Pwn Anywhere. In Black Hat USA 2014

5 Contributions Data Flow Stitching New class of Data-Oriented Exploits
Systematic search for data-oriented exploits Works on binary directly Results Concrete exploits on real web/file servers 19 exploits (16 new) from 8 vulnerabilities New class of Data-Oriented Exploits Reuses existing data flows in normal execution Agnostic to CFI, DEP and often ASLR

6 Motivating Example SSL-enabled web server 1 int server() {
PsVNXi… 1 int server() { 2 char *userInput, *fileName; 3 char *privKey, *result, output[BUFSIZE]; 4 char fullPath[BUFSIZE]="/path/to/root/"; 5 6 privKey=loadPrivKey("/path/to/privKey"); 7 GetConnection(privKey, ...); 8 userInput = read_socket(); 9 if (checkInput(userInput)) { 10 fileName = getFileName(userInput); 11 strcat(fullPath, fileName); 12 result = retrieve(fullPath); 13 sprintf(output, “%s:%s”, fileName, result); 14 sendOut(output); 15 } 16 } privKey GET /index.html HTTP/1.1 PsVNXi… userInput /path/to/root index.html fullPath fileName /path/to/root/ index.html <html> …</html> output result index.html : <html> …</html> PsVNXi… : <html> …</html> PsVNXi… : <html> …</html

7 Data-Flow Stitching Manipulate data flows for exploits
Enables systematic way to search for exploits Input: binary & error-exhibiting input Output: data-oriented exploits Goal: Information Leakage (e.g., password, keys) Privilege Escalation (e.g., setuid, access priv. files) Constraints: Keep the control-flow same No knowledge of randomized values (CFI tags, ASLR addresses) Prevent abrupt termination

8 Challenges Time-consuming search Our solution:
The search-space: Cartesian product |SrcFlow| X |TgtFlow| Heavy analysis for each candidate Our solution: Filter out candidates with memory error influence Use an SMT solver to verify candidates v1 VS Target flow t0 execution Source flow v2 VT

9 Single-Edge Stitch Corrupt data vertex 100 100 100 100 100 address
1 struct passwd {uid_t pw_uid; ... } pw; 2 ... 3 int uid = getuid(); 4 pw->pw_uid = uid; 5 printf(...); //format string error 6 ... 7 seteuid(0); //set root uid 8 ... 9 seteuid(pw->pw_uid); //set normal uid 10 ... address time &arg a1 &uid 3 4 9 I Attack 100 100 100 100 100 5

10 Pointer Stitch Corrupt pointers to connect data flows
Pointers decide data movement direction address b2 I source flow b1 &pw a1 a1 a1 100 100 target flow &arg 100 2 4 5 9 time

11 Pointer Stitch Corrupt pointers to connect data flows
Pointers decide data movement direction address b2 I source flow b1 &pw a1 a1 b2 b2 a1 100 100 target flow Explain first before simplify &arg 100 2 4 5 9 time

12 Pointer Stitch Corrupt pointers to connect data flows
Pointers decide data movement direction Pointer Stitch corrupts pointer vp *(vp) ---> target / source vertex address b2 I b2 source flow b1 Attack &pw a1 b2 a1 100 target flow &arg 2 4 5 9 time

13 Pointer Stitch Pointer Stitch corrupts pointer vp
*(vp) ---> target / source vertex &arg a1 &pw address b2 &pw a1 b2 a1 100 target flow 100 2 4 5 9 time

14 More Ways of Stitches 2-level stitch corrupts pointer vp2
*(*(vp2)) ---> *(vp) ---> target / source vertex N-level stitch corrupts pointer vpN *(*(…(vpN)…)) ---> target / source vertex Recursively invoke pointer stitch N times Stitch Alignment vpN ---> vpN’ so that *(*(…(vpN’)…)) is the source / target vertex Multi-flow stitching Intermediate data flows Source flow -> flow 1 -> flow 2 -> … -> Target flow

15 Defeat ASLR --- Address Reuse
Partial resue: offset is fixed Complete reuse: randomized address in memory //attackers control %eax mov (%esi,%eax,4), %ebx mov %ecx, (%edi,%eax,4) time address 3 7 &ud.uid &arg 5 vsprintf … …. %X$n &ud.uid stack area I Attack 100 100 //attacker controls %eax mov (%esi, %eax, 4), %ebx mov %ecx, (%ebx) mov (%ebx), %ecx

16 Stitch with ASLR Target deterministic addresses
non-PIE binaries on Linux msvcr71.dll, hxds.dll on Windows Size of fixed space (KB) # of programs Animation gives axis first

17 FlowStitch error-exhibiting benign SMT Solver Data-Flow Stitching
trace constraints, influence candidate exploits SMT Solver benign trace imp. data, data flows DOE

18 Evaluation --- Generated Exploits
ID Vul. bin Vulnerability Data-Oriented Exploits ASLR CVE nginx Stack bof L0 : private key M0: http root dir CVE sudo Format string M0: user id CVE httpdx L0: admin’s passwd M0: admin;s passwd M1: anon.’s permission M2: anon.’s root dir M3: CGI root dir bugtraq ID: 41956 orzhttpd L0: randomized addr CVE * nullhttpd Heap overflow M1: CGI root dir CVE * ghttpd M0: CGI root dir CVE * SSHD integer overflow L0: root passwd hash M1: authenticated flag CVE * wu-ftpd L0: env variables M0: user id (single-edge) M1: user id (pointer stitch) 19 exploits 16 prev. unknown 7 advanced stitch 2-level stitch 10 bypass ASLR 8 fixed addresses 2 address reuse * CVEs discussed in Shuo Chen’s work [1]

19 Evaluation --- Performance
6.5 min/exploit Slice takes long faster version is available (binary version)

20 Case Study – 2-Level Stitch
ghttpd web server: stack buffer overflow Previous exploit[1] Corrupt pointer ptr: *(ptr) -> url We build a 2-level stitch Corrupt pointer saved ebp: *(*(saved ebp)) -> *ptr -> url //serveconnection(): char *ptr; //URL pointer //esi is allocated for it 1: if(strstr(ptr,”/..”)) reject the request; 2: log(...); 3: exec(ptr); Assembly of log(...) push %ebp push %esi // stack overflow pop %esi pop %ebp ret Assembly of line 3: push %esi … call mov -0xc(%ebp), %esi does not work any more

21 Case Study – Sensitive Data Lifespan
SSHD hashed key info leak getspnam() in glibc gets hashed key (heap copy) endspent() in glibc releases memory, not clears it! Still alive for stitching SSHD copies hashed key to local stack (stack copy) Overwritten by later usage Challenging to make lifespan correct!

22 Conclusion Rich Category: Data-Oriented Exploits Data Flow Stitching
Single-edge stitch, Pointer stitch N-level stitch, Multi-flow stitch Data Flow Stitching Systematic way to generate data-oriented exploits Agnostic to CFI, DEP and often ASLR Automatic construction is feasible

23 Hong Hu Thanks! huhong@comp.nus.edu.sg

Download ppt "Automatic Generation of Data-Oriented Exploits"

Similar presentations

USENIX Security Symposium, Baltimore, MD, 2005 1 Non-Control-Data Attacks Are Realistic Threats Shuo Chen *, Jun Xu, Emre Sezer, Prachi Gauriar, Ravi Iyer.

USENIX Security Symposium, Baltimore, MD, Non-Control-Data Attacks Are Realistic Threats Shuo Chen *, Jun Xu, Emre Sezer, Prachi Gauriar, Ravi Iyer.
ROP is Still Dangerous: Breaking Modern Defenses Nicholas Carlini et. al University of California, Berkeley USENIX Security 2014 Presenter: Yue Li Part.

ROP is Still Dangerous: Breaking Modern Defenses Nicholas Carlini et. al University of California, Berkeley USENIX Security 2014 Presenter: Yue Li Part.
Smashing the Stack for Fun and Profit

Smashing the Stack for Fun and Profit
Hacking: The Art of Exploitation

Hacking: The Art of Exploitation
Defenses. Preventing hijacking attacks 1. Fix bugs: – Audit software Automated tools: Coverity, Prefast/Prefix. – Rewrite software in a type safe languange.

Defenses. Preventing hijacking attacks 1. Fix bugs: – Audit software Automated tools: Coverity, Prefast/Prefix. – Rewrite software in a type safe languange.
David Brumley Carnegie Mellon University Credit: Some slides from Ed Schwartz.

David Brumley Carnegie Mellon University Credit: Some slides from Ed Schwartz.
CS457 – Introduction to Information Systems Security Software 3 Elias Athanasopoulos

CS457 – Introduction to Information Systems Security Software 3 Elias Athanasopoulos
Introduction to Information Security ROP – Recitation 5 nirkrako at post.tau.ac.il itamarg at post.tau.ac.il.

Introduction to Information Security ROP – Recitation 5 nirkrako at post.tau.ac.il itamarg at post.tau.ac.il.
Part III Counter measures The best defense is proper bounds checking but there are many C/C++ programmers and some are bound to forget  Are there any.

Part III Counter measures The best defense is proper bounds checking but there are many C/C++ programmers and some are bound to forget  Are there any.
DIEHARDER: SECURING THE HEAP. Previously in DieHard…  Increase Reliability by random positioning of data  Replicated Execution detects invalid memory.

DIEHARDER: SECURING THE HEAP. Previously in DieHard…  Increase Reliability by random positioning of data  Replicated Execution detects invalid memory.
Review: Software Security David Brumley Carnegie Mellon University.

Review: Software Security David Brumley Carnegie Mellon University.
1 CHAPTER 8 BUFFER OVERFLOW. 2 Introduction One of the more advanced attack techniques is the buffer overflow attack Buffer Overflows occurs when software.

1 CHAPTER 8 BUFFER OVERFLOW. 2 Introduction One of the more advanced attack techniques is the buffer overflow attack Buffer Overflows occurs when software.
Securing software by enforcing data-flow integrity Manuel Costa Joint work with: Miguel Castro, Tim Harris Microsoft Research Cambridge University of Cambridge.

Securing software by enforcing data-flow integrity Manuel Costa Joint work with: Miguel Castro, Tim Harris Microsoft Research Cambridge University of Cambridge.
1 Achieving Trusted Systems by Providing Security and Reliability (Research Project #22) Project Members: Ravishankar K. Iyer, Zbigniew Kalbarczyk, Jun.

1 Achieving Trusted Systems by Providing Security and Reliability (Research Project #22) Project Members: Ravishankar K. Iyer, Zbigniew Kalbarczyk, Jun.
Non-Control-Data Attacks and Securing software by enforcing data- flow integrity Zhiqiang Lin Mar 28, 2007 CS590 paper presentation.

Non-Control-Data Attacks and Securing software by enforcing data- flow integrity Zhiqiang Lin Mar 28, 2007 CS590 paper presentation.
Achieving Trusted Systems by Providing Security and Reliability Ravishankar K. Iyer, Zbigniew Kalbarczyk, Jun Xu, Shuo Chen, Nithin Nakka and Karthik Pattabiraman.

Achieving Trusted Systems by Providing Security and Reliability Ravishankar K. Iyer, Zbigniew Kalbarczyk, Jun Xu, Shuo Chen, Nithin Nakka and Karthik Pattabiraman.
Assembly תרגול 8 פונקציות והתקפת buffer.. Procedures (Functions) A procedure call involves passing both data and control from one part of the code to.

Assembly תרגול 8 פונקציות והתקפת buffer.. Procedures (Functions) A procedure call involves passing both data and control from one part of the code to.
1 Loop-Extended Symbolic Execution on Binary Programs Pongsin Poosankam ‡* Prateek Saxena * Stephen McCamant * Dawn Song * ‡ Carnegie Mellon University.

1 Loop-Extended Symbolic Execution on Binary Programs Pongsin Poosankam ‡* Prateek Saxena * Stephen McCamant * Dawn Song * ‡ Carnegie Mellon University.
Branch Regulation: Low-Overhead Protection from Code Reuse Attacks Mehmet Kayaalp, Meltem Ozsoy, Nael Abu-Ghazaleh and Dmitry Ponomarev Department of Computer.

Branch Regulation: Low-Overhead Protection from Code Reuse Attacks Mehmet Kayaalp, Meltem Ozsoy, Nael Abu-Ghazaleh and Dmitry Ponomarev Department of Computer.
Control hijacking attacks Attacker’s goal: – Take over target machine (e.g. web server) Execute arbitrary code on target by hijacking application control.

Control hijacking attacks Attacker’s goal: – Take over target machine (e.g. web server) Execute arbitrary code on target by hijacking application control.

Similar presentations

Ads by Google