Deok9_Exploit Technique

Size: px

Start display at page:

Download "Deok9_Exploit Technique"

소현 남
6 years ago
Views:

1 Exploit Technique CodeEngn Co-Administrator!!! and Team Sur3x5F Member Nick : Deok9 DDeok9@gmail.com HomePage : Twitter :@DDeok9 << Contents >> 1. Shell Code 2. Security Cookie Overwriting 3. Trampoline Technique 4. SEH Overwriting 5. Heap Spray! 1! Copyright 2011 Deok9 All rights Reserved

dll, Entry Point : 0x0006250D, Kernel32.dll Base Address : 0x7C7D0000, 0x7C83250D. Visual Studio cmd Code.

2 1) Shell Code ( cmd.exe ) 1. Shell Code Window ShellCode WinExec. WinExec(LPCSTR lpcmdline,uint ucmdshow) Format. Linux /bin/sh. Assembly WinExec Depends Tool. [ ] Depends Tool WinExec WinExec Kernel32.dll, Entry Point : 0x D, Kernel32.dll Base Address : 0x7C7D0000, 0x7C83250D. Visual Studio cmd Code. [ ] cmd Code cmd[4] WinExec, cmd [4], SW_SHOWNORMAL Option. Code main Breakpoint, Debugging Mode Disassemble Shell Code.! 2! Copyright 2011 Deok9 All rights Reserved

3 [ ] Debugging Disassembly LEA edi, [ebp+ffffff34h] REP STOS dword ptr es:[edi] CMP esi, esp CALL '\0' Shell Code NULL xor. CALL dword ptr ds:[ ch] [004182B4h] Data, Shell Code. Depends Tool. [ ] Inline Assem Code Code Debugging Mode Disassemble Shell Code.! 3! Copyright 2011 Deok9 All rights Reserved

5 1) Security Cookie? 2. Security Cookie Overwriting Window Stack, SFP Buffer Hacker Buffer Overflow Security Cookie Stack Security Data Security Cookie BOF. [ ] IDA Security Cookie [ ] Security Cookie Stack! 5! Copyright 2011 Deok9 All rights Reserved

Security Cookie Check. [ 2-2 - 2 ] ECX Security Cookie 41414141,.

6 2) Security Cookie Overwrite BOF Shell Code, RET ( EIP ) Memory Security Cookie, SFP, RET 3. RET Security Cookie Debugging Security Cookie [ ] Security Cookie Save EAX B516410E, Security Cookie Check. [ ] ECX Security Cookie ,. [ ] Security Cookie EIP Error Security Cookie, Error EIP, RET Error.! 6! Copyright 2011 Deok9 All rights Reserved

7 3. Trampoline Technique 1) ASLR ( Address Space Layout Randomization )? Process Mapping Object & Random, BOF Object BOF. [ ] ASLR Visual Studio Alt + F7.. [ ] ASLR! 7! Copyright 2011 Deok9 All rights Reserved

Stack Random ASLR. ESP RET ( RET Memory ) ESP JMP ESP, CALL ESP [ 3-2 - 2 ].

8 2) Trampoline Technique Trampoline JMP. [ ] Trampoline Technique Memory RET Shell Code., ESP. ESP 00 NULL. Stack Random ASLR. ESP RET ( RET Memory ) ESP JMP ESP, CALL ESP [ ].text Section ( Code ) [ ] JMP ESP Code JMP ESP. ntdll 7CXXXXXX 00 NULL.! 8! Copyright 2011 Deok9 All rights Reserved

9 4. SEH Overwriting 1) SEH ( Structed Exception Handling )? Window, Program Hardware Exception, Handle Software Exception. Thread, Error Exception = Error. [ ] Exception Handler EstabilisherFrame EXCEPTION_REGISTRATION. _CONTEXT *ContextRecord Thread. Exception Register. Exception Handler Chain insert, Chain EXCEPTION_REGISTRATION. [ ] EXCEPTION_REGISTRATION EXCEPTION_REGISTRATION Pointer. Exception Handler Pointer. [ ] SEH Chain Layout! 9! Copyright 2011 Deok9 All rights Reserved

) [ 4-2 - 1 ] SEH Offset Backtrack patternoffset.pl SEH Handler.

10 2) SEH Overwriting Exception Stack SEH, ESP SEH Ret. Hacker SEH 2 ( Handler Next ) EIP. ESP Argument 2 POP POP RET, JMP [esp+8], CALL [esp+8], ADD esp,8 RET EIP. Handler Next. SEH Handler ( SEH Handler Code. ) [ ] SEH Offset Backtrack patternoffset.pl SEH Handler. Offset Exploit Code [ ] Exploit Code [ ] ESP SEH RET ADD ESP, 8 RETN Handler Next, Next Hacker Shell Code JMP,. EB SHORT JMP, Ollydbg.! 10! Copyright 2011 Deok9 All rights Reserved

Code [ 5-1 - 1 ] Heap Spray Memory %u0505 ( NOP code ) + ShellCode 0x80000 Size Heap

11 5. Heap Spray 1) Heap Spray? Heap Memory Data EIP Heap,. html javascript Heap Memory Program. Code [ ] Heap Spray Memory %u0505 ( NOP code ) + ShellCode 0x80000 Size Heap Memory. Hacker NOP EIP. Exploit Code Heap Memory [ ] Heap Memory Dump Memory ( MOV edi, edi ).! 11! Copyright 2011 Deok9 All rights Reserved

hlogin2

hlogin2 0x02. Stack Corruption off-limit Kernel Stack libc Heap BSS Data Code off-limit Kernel Kernel : OS Stack libc Heap BSS Data Code Stack : libc : Heap : BSS, Data : bss Code : off-limit Kernel Kernel : OS