Buffer Overflow Attacks

67
Buffer Overflow Attacks 1 ic Idea Sample Attacks Protection ic Idea Sample Attacks Protection 6.857 6.857 6.857, Computer & Network Security

TAGS:

description

Buffer Overflow Attacks. 6.857, Computer & Network Security. Basic Idea Sample Attacks Protection. 1. 6.857. History. 6.857, Computer & Network Security. Basic Idea Sample Attacks Protection. 1960s. 1970s. 1980s. 1990s. Today. - PowerPoint PPT Presentation

Transcript of Buffer Overflow Attacks

Page 1: Buffer Overflow Attacks

Buffer Overflow Attacks

1

Basic Idea Sample Attacks Protection Basic Idea Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Page 2: Buffer Overflow Attacks

History

2

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

1960s 1970s 1990s Today1980s

Vulnerability exploited on time-share machines

Attacks on early networkedmachines

Morris Worm usesbuffer overflow in

taking down significantportion of the Internet

Buffer overflow attacks become(arguably) the most pressing

security concerns facing the web(e..g., in 1998, 2/3 of CERT advisories

were buffer overflow related)

The problem persists(e.g., IE VML advisory from

two months ago).

Page 3: Buffer Overflow Attacks

Memory Layout

3

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addresses

Page 4: Buffer Overflow Attacks

Memory Layout

4

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

Page 5: Buffer Overflow Attacks

Memory Layout

5

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

Page 6: Buffer Overflow Attacks

Memory Layout

6

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

sp

fp

Page 7: Buffer Overflow Attacks

Memory Layout

7

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

sp

fp2

Page 8: Buffer Overflow Attacks

Memory Layout

8

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

sp

fp2

1

Page 9: Buffer Overflow Attacks

Memory Layout

9

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

sp

fp2

1

ret

Page 10: Buffer Overflow Attacks

Memory Layout

10

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

sp

fp2

1

ret

sfp

Page 11: Buffer Overflow Attacks

Memory Layout

11

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

sp

fp2

1

ret

sfp

Page 12: Buffer Overflow Attacks

Memory Layout

12

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

sp

fp2

1

ret

sfp

Page 13: Buffer Overflow Attacks

Memory Layout

13

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10];}void main() {

func(1,2);}

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

pushl $2pushl $1call func…pushl %ebpmovl %esp, %ebpsubl $24, %esp

sp

fp2

1

ret

sfp

buffer

Page 14: Buffer Overflow Attacks

Memory Layout

14

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10]; strcpy(buffer, bigstr);}

sp

fp2

1

ret

sfp

buffer

Page 15: Buffer Overflow Attacks

Memory Layout

15

Basic IdeaBasic Idea Sample Attacks Protection Sample Attacks Protection

6.8576.857

6.857, Computer & Network Security

Text

Data

Heap

Stack

High Addresses

Low Addressesvoid func(int a, int b) {

char buffer[10]; strcpy(buffer, bigstr);}

sp

fp2

1

ret

sfp

bigstr

Page 16: Buffer Overflow Attacks

Sample Attacks

16

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

Modify local variables

Modify return address to skip/repeat code

Modify return address to run evil code

Page 17: Buffer Overflow Attacks

Modify Local Variables

17

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

Modify local variables

Modify return address to skip/repeat code

Modify return address to run evil code

Page 18: Buffer Overflow Attacks

Modify Local Variables

18

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

Page 19: Buffer Overflow Attacks

Modify Local Variables

19

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

ret

sfp

query

subject[]

recp[]

Page 20: Buffer Overflow Attacks

Modify Local Variables

20

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

ret

sfp

query

subject[]

recp[]

Page 21: Buffer Overflow Attacks

Modify Local Variables

21

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

ret

sfp

subject[]

recp[]

query

Page 22: Buffer Overflow Attacks

Modify Local Variables

22

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

void handleRequest() { int code; char subject[] = "[[[SECRET]]] user request"; char recp[] = "[email protected]"; char query[8]; strcpy(query, getenv("QUERY_STRING"));

//send top secret e-mail to recp …}

ret

sfp

subject[]

recp[]

query

Demo…

Page 23: Buffer Overflow Attacks

Repeat Code…

23

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

Modify local variables

Modify return address to skip/repeat code

Modify return address to run evil code

Page 24: Buffer Overflow Attacks

Repeat Code…

24

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

b

a

ret

sfp

buffer

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

Page 25: Buffer Overflow Attacks

Repeat Code…

25

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

b

a

ret

sfp

buffer

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

Page 26: Buffer Overflow Attacks

Repeat Code…

26

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

b

a

ret

sfp

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

addr

Page 27: Buffer Overflow Attacks

Repeat Code…

27

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

b

a

ret

sfp

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

buffer

Page 28: Buffer Overflow Attacks

Repeat Code…

28

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

b

a

ret

sfp

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

addr

Page 29: Buffer Overflow Attacks

Repeat Code…

29

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

b

a

ret

sfp

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

void func(int a, int b){ printf("Inside func loop.\n"); char buffer[4]; gets(buffer);}

main(){ printf("about to call func.\n"); func(5,6); printf("done.\n");}

addr

Demo…

Page 30: Buffer Overflow Attacks

Sample Attacks

30

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

Modify local variables

Modify return address to skip/repeat code

Modify return address to run evil code

Page 31: Buffer Overflow Attacks

Running Evil Code…

31

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

2

1

ret

sfp

buffer

void func(int a, int b) {char buffer[32];

gets(buffer); …}

void func(int a, int b) {char buffer[32];

gets(buffer); …}

Page 32: Buffer Overflow Attacks

Running Evil Code…

32

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

2

1

void func(int a, int b) {char buffer[32];

gets(buffer); …}

void func(int a, int b) {char buffer[32];

gets(buffer); …}

evil codeevil codeevil codeevil codenopnopnopnopnopnopnopnopnopnopnop0x80483eb

Page 33: Buffer Overflow Attacks

Running Evil Code…

33

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

2

1

void func(int a, int b) {char buffer[32];

gets(buffer); …}

void func(int a, int b) {char buffer[32];

gets(buffer); …}

evil codeevil codeevil codeevil codenopnopnopnopnopnopnopnopnopnopnop0x80483eb

Page 34: Buffer Overflow Attacks

Running Evil Code…

34

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

2

1

void func(int a, int b) {char buffer[32];

gets(buffer); …}

void func(int a, int b) {char buffer[32];

gets(buffer); …}

evil codeevil codeevil codeevil codenopnopnopnopnopnopnopnopnopnopnop0x80483eb

Page 35: Buffer Overflow Attacks

Running Evil Code…

35

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

2

1

void func(int a, int b) {char buffer[32];

gets(buffer); …}

void func(int a, int b) {char buffer[32];

gets(buffer); …}

evil codeevil codeevil codeevil codenopnopnopnopnopnopnopnopnopnopnop0x80483eb

Page 36: Buffer Overflow Attacks

Running Evil Code…

36

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

2

1

void func(int a, int b) {char buffer[32];

gets(buffer); …}

void func(int a, int b) {char buffer[32];

gets(buffer); …}

evil codeevil codeevil codeevil codenopnopnopnopnopnopnopnopnopnopnop0x80483eb

????

Page 37: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

37

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

Page 38: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

38

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

Page 39: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

39

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

0xffffffff

Page 40: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

40

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

0xffffffff

0x80884a80xfffffff8

“/bin/sh”

Page 41: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

41

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

Page 42: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

42

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

name

Page 43: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

43

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

movl $0x80884a8,0xfffffff8(%ebp)movl $0x0,0xfffffffc(%ebp)push $0x0lea 0xfffffff8(%ebp),%eaxpush %eaxpushl 0xfffffff8(%ebp)call 0x804d880 <execve>

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

NULL

0xfffffff8

0x80884a8

Page 44: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

44

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

NULL

0x80884a8

0xfffffff8

ret

sfpfp (ebp)

Page 45: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

45

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

NULL

ret

sfpfp (ebp)

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

ebx0x80884a8

0xfffffff8

Page 46: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

46

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

NULL

ret

sfpfp (ebp)

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

ebx

ecx0x80884a8

0xfffffff8

Page 47: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

47

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

NULL

ret

sfpfp (ebp)

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

ebx

ecx

edx

0x80884a8

0xfffffff8

Page 48: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

48

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

NULL

ret

sfpfp (ebp)

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

ebx

ecx

edx

0x80884a8

0xfffffff8

Page 49: Buffer Overflow Attacks

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

void main() { char *name[2]; name[0] = "/bin/sh"; name[1] = NULL; execve(name[0], name, NULL);}

Running Evil Code…

49

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

0xffffffff

0x80884a80xfffffff8

NULL0xfffffffc

NULL

ret

sfpfp (ebp)

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

mov 0x8(%ebp),%ebxmov 0xc(%ebp),%ecxmov 0x10(%ebp),%edxmov $0xb,%eaxint $0x80

ebx

ecx

edx

0x80884a8

0xfffffff8

Page 50: Buffer Overflow Attacks

Running Evil Code…

50

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfpfp (ebp)

movl string_addr,0x8 movl $0x0,0xc movl $0xb,%eax movl string_addr,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80

movl string_addr,0x8 movl $0x0,0xc movl $0xb,%eax movl string_addr,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80

Page 51: Buffer Overflow Attacks

Running Evil Code…

51

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfpfp (ebp)

movl string_addr,0x8 movl $0x0,0xc movl $0xb,%eax movl string_addr,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80

movl string_addr,0x8 movl $0x0,0xc movl $0xb,%eax movl string_addr,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80

string_addr

NULLecxebx

edx

0x8

Page 52: Buffer Overflow Attacks

Running Evil Code…

52

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

movl string_addr,0x8 movl $0x0,0xc movl $0xb,%eax movl string_addr,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80

movl string_addr,0x8 movl $0x0,0xc movl $0xb,%eax movl string_addr,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80

string_addr

NULL

??????

Page 53: Buffer Overflow Attacks

Running Evil Code…

53

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Page 54: Buffer Overflow Attacks

Running Evil Code…

54

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

“bin/sh”

code

Page 55: Buffer Overflow Attacks

Running Evil Code…

55

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

“bin/sh”

code

Page 56: Buffer Overflow Attacks

Running Evil Code…

56

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

“bin/sh”

code

addr of “bin/sh”

Page 57: Buffer Overflow Attacks

Running Evil Code…

57

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

“bin/sh”

code

addr of “bin/sh” esi

Page 58: Buffer Overflow Attacks

Running Evil Code…

58

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

“bin/sh”

code

Page 59: Buffer Overflow Attacks

Running Evil Code…

59

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #1: Zero Bytes

Page 60: Buffer Overflow Attacks

Running Evil Code…

60

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #1: Zero BytesSolution: Generate on the fly(e.g., push $0x0 = xor %eax, %eax push %eax)

Page 61: Buffer Overflow Attacks

Running Evil Code…

61

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #2: Guessing the Return Address

code

ret’ret’ret’ret’ret’ret’

Page 62: Buffer Overflow Attacks

Running Evil Code…

62

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #2: Guessing the Return Address

code

ret’ret’ret’ret’ret’ret’

Page 63: Buffer Overflow Attacks

Running Evil Code…

63

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #2: Guessing the Return Address

code

ret’ret’ret’ret’ret’ret’

Page 64: Buffer Overflow Attacks

Running Evil Code…

64

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #2: Guessing the Return AddressSolution: Add a NOP landing pad to increase the chance that your guess is right.

code

ret’ret’ret’ret’ret’ret’

nopnopnop

Page 65: Buffer Overflow Attacks

Running Evil Code…

65

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #2: Guessing the Return AddressSolution: Add a NOP landing pad to increase the chance that your guess is right.

code

ret’ret’ret’ret’ret’ret’

nopnopnop

Page 66: Buffer Overflow Attacks

Running Evil Code…

66

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #2: Guessing the Return AddressSolution: Add a NOP landing pad to increase the chance that your guess is right.

code

ret’ret’ret’ret’ret’ret’

nopnopnop

Page 67: Buffer Overflow Attacks

Running Evil Code…

67

Basic Idea Basic Idea Sample AttacksSample Attacks Protection Protection

6.8576.857

6.857, Computer & Network Security

ret

sfp

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

jmp offset-to-call popl %esi movl %esi,0x8 movl $0x0,0xc movl $0xb,%eax movl %esi,%ebx leal 0x8,%ecx movl 0xc,%edx int $0x80 call offset-to-popl /bin/sh string

Obstacle #2: Guessing the Return AddressSolution: Add a NOP landing pad to increase the chance that your guess is right.

code

ret’ret’ret’ret’ret’ret’

nopnopnop


Buffer Overflow Attacks - Donald Bren School of ...stasio/ics8-w12/Week4 - Buffer Overflow Attacks.pdf · Smashing The Stack For Fun And Profit. e-zine #49, 1996 •The attacker exploits

Buffer Overflow Attacks - Donald Bren School of ...stasio/ics8-w12/Week4 - Buffer Overflow Attacks.pdf · Smashing The Stack For Fun And Profit. e-zine #49, 1996 •The attacker exploits

Module 5: Buffer Overflow Attacks - Jackson State University

Module 5: Buffer Overflow Attacks - Jackson State University

1 Buffer Overflow Attacks and Format String bugs.

1 Buffer Overflow Attacks and Format String bugs.

1 Part 2: Attacks and Countermeasures u Vulnerabilities u System Attacks Virus, Trojan, Worm Buffer overflow Rootkit Zombies Web based attacks.

1 Part 2: Attacks and Countermeasures u Vulnerabilities u System Attacks Virus, Trojan, Worm Buffer overflow Rootkit Zombies Web based attacks.

Application Layer Attacksathena.ecs.csus.edu/~cookd/115/notes/CSC 115 - Summer... · 2018. 6. 30. · • Web application attacks • Client-side attacks • Buffer overflow attacks

Application Layer Attacksathena.ecs.csus.edu/~cookd/115/notes/CSC 115 - Summer... · 2018. 6. 30. · • Web application attacks • Client-side attacks • Buffer overflow attacks

BLENDED ATTACKS EXPLOITS, VULNERABILITIES AND BUFFER-OVERFLOW TECHNIQUES IN COMPUTER VIRUSES

BLENDED ATTACKS EXPLOITS, VULNERABILITIES AND BUFFER-OVERFLOW TECHNIQUES IN COMPUTER VIRUSES

Buffer Overflow Exploits

Buffer Overflow Exploits

Software attacks Lorenzo Dematté Software attacks Advanced buffer overflow: heap smashing.

Software attacks Lorenzo Dematté Software attacks Advanced buffer overflow: heap smashing.

The OWASP Top 10 and Buffer Overflow Attacks Tom Chothia Computer Security, Lecture 14.

The OWASP Top 10 and Buffer Overflow Attacks Tom Chothia Computer Security, Lecture 14.

Buffer Overflow

Buffer Overflow

Blended Attacks Exploits, Vulnerabilities and Buffer-Overflow ...

Blended Attacks Exploits, Vulnerabilities and Buffer-Overflow ...

Security services, Attacks, Session Hijacking, Buffer Overflow, Man-in-the-middle attacks

Security services, Attacks, Session Hijacking, Buffer Overflow, Man-in-the-middle attacks

6/22/2015 C. Edward Chow CS591 Page 1. History of Buffer Overflow Attacks Buffer Overflow Attack and related Background Knowledge Linux VirtualMemory.

6/22/2015 C. Edward Chow CS591 Page 1. History of Buffer Overflow Attacks Buffer Overflow Attack and related Background Knowledge Linux VirtualMemory.

A buffer overflow study attacks and defenses (2002)

A buffer overflow study attacks and defenses (2002)

Energy-Security Tradeoff in a Secure Cache Architecture Against Buffer Overflow Attacks

Energy-Security Tradeoff in a Secure Cache Architecture Against Buffer Overflow Attacks

Buffer Overflow Attacks - University of Delawarecshen/367/notes/Buffer...exploiting a local buffer variable overflow vulnerability to override values of one or both of these key function

Buffer Overflow Attacks - University of Delawarecshen/367/notes/Buffer...exploiting a local buffer variable overflow vulnerability to override values of one or both of these key function

Module04 Buffer Overflow

Module04 Buffer Overflow

A Binary Rewriting Defense Against Buffer Overflow Attacks

A Binary Rewriting Defense Against Buffer Overflow Attacks

Chapter 3.4: Buffer Overflow Attacks

Chapter 3.4: Buffer Overflow Attacks

Buffer Overflow Attack

Buffer Overflow Attack