Exploit Development
Stack based Buffer Overflows
To Brag
● Adithyan AK - Head of OWASP Coimbatore
● 6+ Years into infosec
● Expertise in web app security, reverse engineering, exploit dev, malware
analysis
● Author of several exploits & cves
● Speaker at various conferences, workshops (IITM Research Park, Defcon
Trivandrum etc)
● Hall of fame in Microsoft, Apple, Intel, Avira, Oppo, etc
● Passion for making and breaking stuffs
Exploit Development - What & Why
● Must have used dozens of exploits
● Download, Compile, Run -> B0000M!!!
● What if it’s a backdoor?
● Buffer Overflow
● Storage space
● Stack based -> local variables & return addresses
● Heap based -> dynamic data
Von Neumann Architecture
Memory
Data Instructions
Program Execution in CPU
● Program -> Sequence of Instructions || IR -> Holds current Ins || IP -> Holds next instruction
First Instruction CPU sends Memory reads
address is copied address in IP to the data from the
into IP Memory Address & sends
back to CPU
IP is incremented to
CPU executes point next
instruction in IR CPU copies the
instruction in data into IR
memory
CPU General Purpose Registers
● EAX : accumulator : used for performing calculations, and used to store return values from function
calls. Basic operations such as add, subtract, compare use this general-purpose register
● EBX : base (does not have anything to do with base pointer). It has no general purpose and can be used
to store data.
● ECX : counter : used for iterations. ECX counts downward.
● EDX : data : extension of the EAX register. Allows for more complex calculations (multiply, divide)
● ESP : stack pointer
● EBP : base pointer
● ESI : source index : holds location of input data
● EDI : destination index : points to location of where result of data operation is stored
● EIP : instruction pointer
Anatomy of Program in Memory
connects h/w with s/w Kernel Top
0x0000
LIFO structure used to pass
data/arguments to functions, and Stack
is used as space for variables
0xFFFF
dynamic memory allocation Heap
variables, dynamic buffers Data
instructions that the processor executes Text Base
Anatomy of the Stack
ESP (Extended Stack Pointer) Top
A
x41 Buffer Space
EBP (Extended Base Pointer) Base
Address of EIP (Extended Instruction Pointer) / Return Address
Malicious code
int main(){
char realPassword[20];
char givenPassword[20];
strncpy(realPassword, "ddddddddddddddd", 20);
realPassword givenPassword
gets(givenPassword);
ddddddddddd input
if (0 == strncmp(givenPassword, realPassword, 20)){
printf("SUCCESS!\n");
}else{
printf("FAILURE!\n");
}
printf("givenPassword: %s\n", givenPassword);
printf("realPassword: %s\n", realPassword);
return 0;
}
Generic BOF Approach
Locate the Overwrite the Overwrite Buffer
neighbouring neighbouring with malicious
buffer buffer instructions
Malicious
Point to the mal. Overwrite the
Instruction
Buffer Return Address
executes
Broad Overview of BOF Exploitation
Target system Local program
running vulnerable Privilege Remote Program
Program escalation
Attain a reverse Rewrite the EIP Overflow the
shell from the with address of buffer with
target system the [Link] shellcode
Stack Frame
000000000000000000000000000000000000000000000000000000000000000
Function
ESP Local Variables ESP EIP
000000000000000000000000000000000000000000000000000000000000000
Arguments
[ Buffer ]
00000000000000000000000000000000000000000
NOPS + Shellcode Addr. of
Buffer
Fuzzing
● To identify the buffer length & capacity
● Stream of chars are sent
● Until the program breaks
● A = x41
● B = x42
● Find how many bytes break the buffer
● MSF Pattern create and offset
● Generate random string
● locate the position of the string reflected in EIP
● Overwrite EIP
Finding the Badchars
● unwanted characters that can break the shell codes.
● no universal set of bad characters
● different set of bad characters for every program
○ 00 for NULL
○ 0A for Line Feed \n
● Send the full list of the characters from 0x00 to 0xFF
● Check using debugger if input breaks
● If so, find the character that breaks it
● Remove the character from the list
● If input no longer breaks, use the rest of the characters to generate shellcode
Mona - by Corelan
Generate Shellcode & PWN
Contact
adithyan-ak adithyan_ak
akinfosec akinfosec