Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Everybody be cool, this is a ROPpery
Ähnlich wie Everybody be cool, this is a ROPpery (20)
Mehr von Vincenzo Iozzo
Mehr von Vincenzo Iozzo (11)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Everybody be cool, this is a ROPpery
- 1. Everybody be cool, this is a roppery! Vincenzo Iozzo (vincenzo.iozzo@zynamics.com) zynamics GmbH Tim Kornau (tim.kornau@zynamics.com) zynamics GmbH Ralf-Philipp Weinmann (ralf-philipp.weinmann@uni.lu) Université du Luxembourg BlackHat Vegas 2010
- 2. Overview Introduction Gentle overview Finding gadgets Compile gadgets Some fancy demos Further work
- 3. Introduction Exploitation with non-executable pages is not much fun
- 4. But we have funny ideas Exploitation with non-executable pages is not much fun.. Unless you use “return-oriented programming”
- 6. But life is hard Code signing Sandboxing ROP We were lucky!
- 8. No executable pages on the heap
- 10. ROP - Workflow Find the gadgets Chain them to form a payload Test the payload on your target
- 11. Finding Gadgets Overview Goal definition Motivation Strategy Algorithms Results Further improvement
- 12. Goal definition Build an algorithm which is capable of locating gadgets within a given binary automatically without major side effects.
- 13. Motivation I Little spirits need access to a wide range of devices. Because what is a device without a spirit?
- 15. when code signing of binaries is enabled.
- 17. These parts are named gadgets
- 18. A gadget is a sequence of (useable) instructions
- 19. Gadgets must be combinable
- 20. end in a “free-branch”
- 21. Gadgets must provide a useful operation
- 23. Only the “simplest” gadget for an operation should be used
- 24. Side effects of gadgets must be near to zero to avoid destroying results of previous executed code sequences.
- 26. Arithmetic instructions (ADD, SUB, MUL, DIV, MOD, BSH)
- 27. Bitwise instructions (AND, OR, XOR)
- 28. Logical instructions (BISZ, JCC)
- 29. Data transfer instructions (LDM, STM, STR)
- 30. Other instructions (NOP, UNDEF, UNKN)
- 31. register machine
- 32. unlimited number of temp registers
- 33. side effect free
- 35. Stage II -> Merge the collected data
- 41. Simplify the result:Z FLAG MUST BE FALSE 0x00000001 SOME INSTRUCTION 0x00000002 BEQ 0xADDRESS 0x00000003 SOME INSTRUCTION 0x00000004 SOME INSTRUCTION Generate condition tree R0 = ((((((R2+4)+4)+4)+4) OR 0) AND 0xFFFFFFFF) R0 = R2+16
- 43. Use a tree match handler for each operation.
- 44. Select the simplest gadget for each operation
- 48. The described algorithms automatically find the necessary parts to build the return-oriented program.
- 50. Bring more platforms to REIL
- 53. With very ugly blocks
- 54. Each gadget set defines custom ISA
- 56. Chaining gadgets Hence we have decided to bring in some help...
- 58. Very basic language
- 60. allowcorrupt: expendable memory ranges
- 61. [corruption may occur here]
- 62. protect: registers must stay invariant
- 64. Conditional goto statement
- 65. Call statement (calling lib functions)
- 66. Data definitions
- 69. conditional jump
- 71. r1 = 256
- 72. (mem[r0], r2, r1) <<_| (0, (3*r1) & 255, r1-1)
- 73. r0 = r0+4
- 75. In this case STP
- 77. Open-source, written by Vijay Ganesh
- 78. Used for model-checking, theorem proving, EXE, etc.
- 80. x0 : BITVECTOR(4);
- 81. ...
- 82. x9 : BITVECTOR(4);
- 83. ASSERT (BVPLUS(4,BVMULT(4,x0, 0hex6), 0hex0, 0hex0,
- 88. Multi-assignments give us freedom
- 90. Automatic chaining of gadgets with side effects is possible and feasible.
- 92. No code signing for instance
- 94. Depending on the application you’re targeting the sandbox policy is different
- 96. Fill the buffer with the shellcode
- 97. Point the stack pointer to the beginning of the stack
- 98. Execute the payload
- 100. Abstract language to describe gadgets
- 101. Try to avoid “un-decidable” constraints
Hinweis der Redaktion
- Here go rants about how hard exploitation is
- Here goes the ode of ROP