Payload Already Inside: Data re-use for ROP Exploits Black Hat
[Pages:49]Payload Already Inside: Data re-use for ROP Exploits
Long Le
longld@
Thanh Nguyen
rd@
1
HITB2010KUL
Agenda
Introduction
Recap on stack overflow & mitigations Multistage ROP technique
Stage-0 (stage-1 loader) Stage-1 (actual payload)
Payload strategy Resolve run-time libc addresses
Putting all together, ROPEME!
Practical ROP payloads
A complete stage-0 loader Practical ROP gadgets catalog ROP automation
ROPEME Tool & DEMO
Countermeasures
Summary
2
BB..AA..DD..
Why this talk?
Buffer overflow exploit on modern Linux (x86) distribution is difficult Non Executable (NX/XD) Address Space Layout Randomization (ASLR) ASCII-Armor Address Mapping
High entropy ASLR and ASCII-Armor Address Mapping make Return-to-Libc / Return-Oriented-Programming (ROP) exploitation techniques become very difficult
3
BB..AA..DD..
What to be presented?
A practical and reliable technique to bypass NX, ASLR and ASCII-Armor protections to exploit memory/stack corruption vulnerabilities Multistage ROP exploitation technique
Focus on latest Linux x86 Our ROPEME tool
Practical ROP gadgets catalog Automation scripts
4
BB..AA..DD..
What not?
Not a return-oriented programming 101 talk We do not talk about
ASLR implementation flaws / information leaks Compilation protections
Stack Protector / ProPolice FORTIFY_SOURCE Mandatory Access Control SELinux AppArmor RBAC/Grsecurity
5
BB..AA..DD..
Agenda
Introduction
Recap on stack overflow & mitigations Multistage ROP technique
Stage-0 (stage-1 loader) Stage-1 (actual payload)
Payload strategy Resolve run-time libc addresses
Putting all together, ROPEME!
Practical ROP payloads
A complete stage-0 loader Practical ROP gadgets catalog ROP automation
ROPEME Tool & DEMO
Countermeasures
Summary
6
BB..AA..DD..
Sample vulnerable program
#include #include
int main (int argc, char **argv) {
char buf[256]; int i; seteuid (getuid()); if (argc < 2) {
puts ("Need an argument\n"); exit (1); }
Overflow!
// vulnerable code strcpy (buf, argv[1]);
printf ("%s\nLen:%d\n", buf, (int)strlen(buf)); return (0); }
7
BB..AA..DD..
Stack overflow
AA...AA
AAAA
AAAA
Saved EBP Saved EIP
Attacker controlled Execution flow: EIP Stack: ESP
AAAA
Stack growth AAAA
8
BB..AA..DD..
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- payload already inside data re use for rop exploits black hat
- battery specification chart printed on 3 31 2014
- mv induction motors ge power conversion
- record sheets design by david l mcculloch
- military symbols graphics oc
- inspiration from sculpture generator 1 a custom design
- gas generators kohler co
- freeman indus prods l l c v armor metal group
- power systems kohler co
- unearthed arcana downtime
Related searches
- words to use for an essay
- medical use for baking soda
- data analysis techniques for research
- we re here for you quotes
- another word to use for but
- microsoft home use for federal employees
- use for old baking powder
- tens unit use for ed
- other words to use for great
- signs you re falling for someone
- words to use for essay
- terms of use for website