BasicControlHijackingAttacks.docx

Control Hijacking Basic Control Hijacking Attacks Control hijacking attacks Attacker’s goal: Take over target machine (e.g. web server) Execute arbitrary code on target by hijacking application control flow Examples: Buffer overflow and integer overflow attacks Format string vulnerabilities Use after free First example: buffer overflows Extremely common bug in C/C++ programs. First major exploit: 1988 Internet Worm. fingerd. Source: web.nvd.nist.gov What is needed Understanding C functions, the stack, and the heap. Know how system calls are made The exec() system call Attacker needs to know which CPU and OS used on the target machine: Our examples are for x86 running Linux or Windows Details vary slightly between CPUs and OSs: Little endian vs. big endian (x86 vs. Motorola) Stack Frame structure (Unix vs. Windows) Linux process memory layout unused 0run time heap shared libraries user stack 00xC0000000 %esp brk Loaded from exec 0 exception handlers Stack Frame arguments return address stack frame pointer local variables SP Stack Growth high low callee saved registers What are buffer overflows? void func(char *str) { char buf[128]; strcpy(buf, str); do-something(buf);} Suppose a web server contains a function: When func() is called stack looks like: argument: str return address stack frame pointer char buf[128] SP What are buffer overflows? void func(char *str) { char buf[128]; strcpy(buf, str); do-something(buf);} What if *str is 136 bytes long? After strcpy: argument: str return address stack frame pointer char buf[128] SP Problem:  no length checking in strcpy() char buf[128] return address Basic stack exploit Suppose *str is such that  after strcpy stack looks like: Program P: exec(“/bin/sh”) When func() exits, the user gets shell ! Note: attack code P runs in stack. (exact shell code by Aleph One) Program P low high The NOP slide Problem: how does attacker