1. Everybody be cool, this is a roppery! Vincenzo Iozzo (vincenzo.iozzo@zynamics.com) zynamics GmbH Tim Kornau (tim.kornau@zynamics.com) zynamics GmbH Ralf-Philipp Weinmann (ralf-philipp.weinmann@uni.lu) Université du Luxembourg BlackHat Vegas 2010

2. Overview Introduction Gentle overview Finding gadgets Compile gadgets Some fancy demos Further work

3. Introduction Exploitation with non-executable pages is not much fun

4. But we have funny ideas Exploitation with non-executable pages is not much fun.. Unless you use “return-oriented programming”

5. Gentle introduction

6. But life is hard Code signing Sandboxing ROP We were lucky!

8. No executable pages on the heap

10. ROP - Workflow Find the gadgets Chain them to form a payload Test the payload on your target

11. Finding Gadgets Overview Goal definition Motivation Strategy Algorithms Results Further improvement

12. Goal definition Build an algorithm which is capable of locating gadgets within a given binary automatically without major side effects.

13. Motivation I Little spirits need access to a wide range of devices. Because what is a device without a spirit?

15. when code signing of binaries is enabled.

17. These parts are named gadgets

18. A gadget is a sequence of (useable) instructions

19. Gadgets must be combinable

20. end in a “free-branch”

21. Gadgets must provide a useful operation

23. Only the “simplest” gadget for an operation should be used

24. Side effects of gadgets must be near to zero to avoid destroying results of previous executed code sequences.

26. Arithmetic instructions (ADD, SUB, MUL, DIV, MOD, BSH)

27. Bitwise instructions (AND, OR, XOR)

28. Logical instructions (BISZ, JCC)

29. Data transfer instructions (LDM, STM, STR)

30. Other instructions (NOP, UNDEF, UNKN)

31. register machine

32. unlimited number of temp registers

33. side effect free

35. Stage II -> Merge the collected data

41. Simplify the result:Z FLAG MUST BE FALSE 0x00000001 SOME INSTRUCTION 0x00000002 BEQ 0xADDRESS 0x00000003 SOME INSTRUCTION 0x00000004 SOME INSTRUCTION Generate condition tree R0 = ((((((R2+4)+4)+4)+4) OR 0) AND 0xFFFFFFFF) R0 = R2+16

43. Use a tree match handler for each operation.

44. Select the simplest gadget for each operation

48. The described algorithms automatically find the necessary parts to build the return-oriented program.

50. Bring more platforms to REIL

53. With very ugly blocks

54. Each gadget set defines custom ISA

56. Chaining gadgets Hence we have decided to bring in some help...

58. Very basic language

60. allowcorrupt: expendable memory ranges

61. [corruption may occur here]

62. protect: registers must stay invariant

64. Conditional goto statement

65. Call statement (calling lib functions)

66. Data definitions

69. conditional jump

70. label(clear_loop)

71. r1 = 256

72. (mem[r0], r2, r1) <<_| (0, (3*r1) & 255, r1-1)

73. r0 = r0+4

75. In this case STP

77. Open-source, written by Vijay Ganesh

78. Used for model-checking, theorem proving, EXE, etc.

80. x0 : BITVECTOR(4);

81. ...

82. x9 : BITVECTOR(4);

83. ASSERT (BVPLUS(4,BVMULT(4,x0, 0hex6), 0hex0, 0hex0,

84. BVMULT(4,x3, 0hex7), BVMULT(4,x4, 0hex4),

85. BVMULT(4,x5, 0hex6), BVMULT(4,x6, 0hex4),

88. Multi-assignments give us freedom

90. Automatic chaining of gadgets with side effects is possible and feasible.

92. No code signing for instance

94. Depending on the application you’re targeting the sandbox policy is different

96. Fill the buffer with the shellcode

97. Point the stack pointer to the beginning of the stack

98. Execute the payload

100. Abstract language to describe gadgets

101. Try to avoid “un-decidable” constraints