Old skool stack smashing

commit 55dd6701c64dcaf46416dc0ab87dbb53e7e7d6de Author: Ward Wouts Date: Thu Jan 16 08:42:45 2020 +0100 Import diff --git a/Stack_Overflow_2.png b/Stack_Overflow_2.png new file mode 100644 index 0000000..b9ec508 Binary files /dev/null and b/Stack_Overflow_2.png differ diff --git a/Stack_Overflow_3.png b/Stack_Overflow_3.png new file mode 100644 index 0000000..98bf0b9 Binary files /dev/null and b/Stack_Overflow_3.png differ diff --git a/Stack_Overflow_4.png b/Stack_Overflow_4.png new file mode 100644 index 0000000..b1c8c27 Binary files /dev/null and b/Stack_Overflow_4.png differ diff --git a/code/Makefile b/code/Makefile new file mode 100644 index 0000000..8087812 --- /dev/null +++ b/code/Makefile @@ -0,0 +1,9 @@ +.PHONY: all + +demo: + gcc -ggdb -fno-stack-protector -z execstack -z norelro -m32 -no-pie -mpreferred-stack-boundary=2 demo.c -o demo + +diy: + gcc -ggdb -fno-stack-protector -z execstack -z norelro -m32 -no-pie -mpreferred-stack-boundary=2 diy.c -o diy + +all: demo diy diff --git a/code/demo b/code/demo new file mode 100755 index 0000000..dbfe40a Binary files /dev/null and b/code/demo differ diff --git a/code/demo.c b/code/demo.c new file mode 100644 index 0000000..00f730d --- /dev/null +++ b/code/demo.c @@ -0,0 +1,16 @@ +#include +#include +#include + +int main(int argc, char * argv[]){ + char buf[128]; + + if(argc == 1){ + printf("Usage: %s argument\n", argv[0]); + exit(1); + } + strcpy(buf,argv[1]); + printf("%s", buf); + + return 0; +} diff --git a/code/diy b/code/diy new file mode 100755 index 0000000..43db7f7 Binary files /dev/null and b/code/diy differ diff --git a/code/diy.c b/code/diy.c new file mode 100644 index 0000000..0880db3 --- /dev/null +++ b/code/diy.c @@ -0,0 +1,22 @@ +#include +#include + +void winner() +{ + printf("You win\n"); +} + +void whoareyou() +{ + char name[250]; + + printf("What's your name? "); + gets(name); + printf("\nHello, %s\n", name); +} + +int main() +{ + whoareyou(); + printf("You lose\n"); +} diff --git a/code/narnia2 b/code/narnia2 new file mode 100755 index 0000000..c9fb593 Binary files /dev/null and b/code/narnia2 differ diff --git a/index.html b/index.html new file mode 100644 index 0000000..5418b18 --- /dev/null +++ b/index.html @@ -0,0 +1,438 @@ + + + + Old skool stack smashing + + + + +

+
+name: inverse
+layout: true
+class: center, middle, inverse
+---
+# Old skool stack smashing
+Ward Wouts 
+https://wizeazz.nl/smash/
+---
+# Agenda
+
+1. Introduction
+1. What is a stack?
+1. How does this work?
+1. Vulnerable fuctions
+1. Now what can we do with this?
+1. Shellcode?
+1. Endianness?
+1. Demo
+1. DIY
+1. Quick Radare2 reference
+---
+# Introduction
+---
+layout: false
+.left-column[
+## Introduction
+]
+.right-column[
+- C is full of holes, let's get to know one.
+
+- Old skool, so no OS or hardware protections.
+]
+---
+template: inverse
+# What is a stack?
+---
+.left-column[
+## What is a stack?
+]
+.right-column[
+
+
+Stacks in computing architectures are regions of memory where data is added or removed in a last-in-first-out (LIFO) manner.
+
+The stack is used to pass arguments between functions, to allocate space for fixed variables, and to remember how to get back out of the current function.
+
+For x86 systems the stack grows from the largest memory address up.
+
+.footnote[Borrowed from [wikipedia](https://en.wikipedia.org/wiki/Stack-based_memory_allocation)]
+]
+---
+template: inverse
+# How does this work?
+---
+.left-column[
+## How does this work?
+]
+.right-column[
+## Start with some code:
+
+``` C
+#include <string.h>
+
+void foo (char *bar)
+{
+ char c[12];
+
+ strcpy(c, bar); // no bounds checking
+}
+
+int main (int argc, char **argv)
+{
+ foo(argv[1]);
+
+ return 0;
+}
+```
+
+.footnote[Borrowed from [wikipedia](https://en.wikipedia.org/wiki/Stack_buffer_overflow)]
+]
+---
+
+.left-column[
+## How does this work?
+]
+.right-column.center.middle[
+<img src="Stack_Overflow_2.png" width="70%" />
+
+.footnote[Borrowed from [wikipedia](https://en.wikipedia.org/wiki/Stack_buffer_overflow)]
+]
+---
+
+.left-column[
+## How does this work?
+]
+.right-column.center.middle[
+<img src="Stack_Overflow_3.png" width="70%" />
+
+.footnote[Borrowed from [wikipedia](https://en.wikipedia.org/wiki/Stack_buffer_overflow)]
+]
+---
+
+.left-column[
+## How does this work?
+]
+.right-column.center.middle[
+<img src="Stack_Overflow_4.png" width="85%" />
+
+.footnote[Borrowed from [wikipedia](https://en.wikipedia.org/wiki/Stack_buffer_overflow)]
+]
+---
+template: inverse
+# Vulnerable functions
+---
+.left-column[
+## Vulnerable functions
+]
+.right-column[
+Anything that doesn't take buffer sizes into account. The big ones being:
+
+- gets
+- strcpy
+- sprintf
+]
+---
+template: inverse
+# Now what can we do with this?
+---
+.left-column[
+## Now what can we do with this?
+]
+.right-column[
+We can change the flow through the program:
+- Jump to a different function in a known spot in memory
+- Jump to our own shellcode somewhere in the buffer (can also write past the return address)
+- Jump to our own shellcode in the environment
+
+*Full nerd: By overwriting the return address we can change to which instructions the Instruction Pointer (`EIP` in 32-bit x86, `RIP` in 64-bit x86) points. `EIP` and `RIP` are so called registers. There are more, like `EBP`/`RBP` which is used for pointing at the stack frame pointer. The other registers are used like variables.*
+
+.footnote[Lots of shellcode [here](http://shell-storm.org/shellcode/)]
+]
+---
+template: inverse
+# Shellcode?
+---
+.left-column[
+## Shellcode?
+]
+.right-column[
+In hacking, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode. [1]
+
+Here's a bit of shellcode to open `/bin/sh` on 32-bit x86 (48 bytes) [2]:
+```
+\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01
+\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30
+\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1
+\x0c\xce\x81
+```
+
+As strings in C are NULL terminated, shellcode should not have `\x00` in it.
+
+`\x90` is a NOP (No Operand) in x86. You can use a bunch of those in front of shellcode to increase the chances of ending up in your shellcode. This is called a NOP-sled.
+
+Sometimes swapping out some shellcode for some other shellcode is the trick.
+
+.footnote[[1] Borrowed from [wikipedia](https://en.wikipedia.org/wiki/Shellcode) [2] Shellcode from [shell-storm](http://shell-storm.org/shellcode/files/shellcode-491.php)]
+]
+---
+template: inverse
+# Endianness?
+---
+.left-column[
+## Endianness?
+]
+.right-column[
+In computing, endianness refers to the order of bytes (or sometimes bits) within a binary representation of a number. It can also be used more generally to refer to the internal ordering of any representation, such as the digits in a numeral system or the sections of a date.
+
+In its most common usage, endianness indicates the ordering of bytes within a multi-byte number. A **big-endian** ordering places the most significant byte first and the least significant byte last, while a **little-endian** ordering does the opposite. For example, consider the unsigned hexadecimal number 0x1234, which requires at least two bytes to represent. In a big-endian ordering they would be `[ 0x12, 0x34 ]`, while in a little-endian ordering, the bytes would be arranged `[ 0x34, 0x12 ]`.
+
+x86 is a **little-endian** architecture
+]
+---
+template: inverse
+# Demo
+---
+.left-column[
+## Demo
+]
+.right-column[
+This is the code for the binary:
+
+``` C
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+int main(int argc, char * argv[]){
+ char buf[128];
+
+ if(argc == 1){
+ printf("Usage: %s argument\n", argv[0]);
+ exit(1);
+ }
+ strcpy(buf,argv[1]);
+ printf("%s", buf);
+
+ return 0;
+}
+```
+Binary here: https://wizeazz.nl/smash/code/demo
+
+.footnote[Borrowed from [Overthewire.org](https://overthewire.org/wargames/narnia/)]
+]
+---
+template: inverse
+# DIY
+---
+.left-column[
+## DIY
+]
+.right-column[
+Now it's your turn.
+
+Use google cloudshell https://console.cloud.google.com/cloudshell/ to run ssh to
+log into `XX.XX.XX.XX` (not available now) with ssh using user `hulkX` password `smashX`. Binary and shellcode are in `/smash`
+
+**Alternative** If you want to use your own system, Do this as preparation:
+- Install radare2: `$ sudo apt-get install -y radare2` **OR** `$ git clone https://github.com/radareorg/radare2.git && cd radare2 && sys/user.sh` for a persistent installation.
+- Turn off ASLR: `$ sudo sh -c "echo 0 > /proc/sys/kernel/randomize_va_space"`
+- Check: `$ sysctl -a --pattern randomize`
+- Enable debugging: `sudo sh -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"`
+- Download binary: `$ curl -O https://wizeazz.nl/smash/code/diy`
+- Make executable: `$ chmod a+x diy`
+
+.footnote[Linux and ASLR settings [here](https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/)]
+]
+---
+.left-column[
+## DIY
+]
+.right-column[
+Assignment:
+- Make the binary print `You win`.
+
+This is the code for the binary:
+
+``` C
+#include <stdio.h>
+#include <strings.h>
+
+void winner()
+{
+ printf("You win\n");
+}
+
+void whoareyou()
+{
+ char name[250];
+
+ printf("What's your name? ");
+ gets(name);
+ printf("\nHello, %s\n", name);
+}
+
+int main()
+{
+ whoareyou();
+ printf("You lose\n");
+}
+```
+]
+---
+.left-column[
+## DIY
+]
+.right-column[
+Now, if you managed that:
+- Try to make it open a shell via shellcode. Especially fun if you make the binary SUID root: `$ sudo chown root.root diy && sudo chmod u+s diy`
+- Can be done both via shellcode in an environment variable (usually more reliable) and via shellcode in the buffer
+
+Tip: `gets()` behaves weirdly and will close your shell immediately. The trick is to do something like: 
+`$ (echo -e MYINPUT; cat)|./diy` 
+This won't give you a prompt!
+]
+---
+template: inverse
+# Quick Radare2 reference
+---
+.left-column[
+## Quick Radare2 reference
+]
+.right-column[
+- `r2 -Ad <program>` start radare2 in debugger mode and analyse program
+- `afl` list functions
+- `pdf@<function>` disassemble function (e.g. `pdf@main`)
+- `pxw @<location>` print memory (e.g. `pxw @ebp`)
+- `db <address>` Set breakpoint
+- `dc` continue to breakpoint
+- `ds` step into
+- `V` go to visual mode
+ - `q` leave visual mode
+ - `p` next view (2x for debugger view)
+ - `s` step into
+ - `S` step over
+- `?v HEX` build in calculator (e.g. `?v 0xdead0000+0xbeef`)
+- `?vi HEX` hex to integer (e.g. `?vi 0x400`)
+]
+
+

+ + + +