SlideShare a Scribd company logo

Sigreturn Oriented Programming

•
•
A
Angel Boy

Sigreturn Oriented Programming Angelboy @ bamboofox

Software
1 of 34
Download to read offline
Sigreturn Oriented Programming angelboy
Outline • Signal handler mechanism • Sigreturn Oriented Programing • Virtual Dynamic Shared Object • Return to vdso • Defcon 2015 fuckup
Signal handler mechanism • 當 kernel 決定將 signal dispatch 給 user mode 時，會將所有 register 及程式狀態全部 push 進 stack 中 • 進⼊入 singal handler • 執⾏行 sigreturn system call 將所有在 stack 中的資 訊 pop 回 register 中
Signal handler mechanism stack sp ip code User code signal handler sigreturn
Signal handler mechanism stack sp ip code User code signal handler Kernel dispatch singal sigreturn
Signal handler mechanism stack sp ip code User code signal handler 將所有資訊 push 進 stack 中 CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn
Signal handler mechanism stack sp ip code User code signal handler 將 sigreturn syscall 的位置 push 進 stack CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn
Signal handler mechanism stack sp ip code User code signal handler 程式流程跳轉⾄至 signal handler CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn
Signal handler mechanism stack sp ip code User code signal handler 從 signal handler return CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn
Signal handler mechanism stack sp ip code User code signal handler 程式流程跳轉⾄至 sigreturn code CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn x86 x64 mov eax,0x77 int 0x80 mov rax,0xf syscall
Signal handler mechanism stack sp ip code User code signal handler 執⾏行 sigreturn syscall CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn x86 x64 mov eax,0x77 int 0x80 mov rax,0xf syscall
Signal handler mechanism stack sp ip code User code signal handler stack 內容全部都會 pop 回 register 流程跳回 usercode CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn x86 x64 mov eax,0x77 int 0x80 mov rax,0xf syscall
Signal Frame • push 進 stack 的內容依照架構不同⽽而有不同的 struct • x86 • sigcontext
Signal Frame • x64 • ucontext • sigcontext
Sigreturn Oriented Programming • 利⽤用 sigreturn 的機制，做出⾃自⼰己所想要的 syscall • 全部的 register 都可控，也可改變 stack 位置 • 需要可控 ip 及 stack => such as ROP • 需要夠⼤大的空間塞下整個 signal frame
Sigreturn Oriented Programming • 直接偽造 sigcontext 結構，全部 push 進 stack 中 • 將 ret address 設在 sigretrun syscall 的 gadget • 將 signal frame 中的 rip(eip) 設在 syscall (int 0x80) • 當 sigreturn 回來後，就會執⾏行你所設定的 syscall • ex : execve , read , write ….etc
Sigreturn Oriented Programming fake signal frame sigreturn addrsp stack eax = 0x0 ebx = 0x0 ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = 0xbffffa00 ebp = 0xbfffb00 eip = user code addr . . . . . registercode ip ret mov eax,0x77 int 0x80
Sigreturn Oriented Programming fake signal frame sigreturn addr sp stack eax = 0x0 ebx = 0x0 ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = 0xbffffa04 ebp = 0xbfffb00 eip = sigreturn addr . . . . . registercode ip ret mov eax,0x77 int 0x80
Sigreturn Oriented Programming fake signal frame sigreturn addr sp stack eax = 0x77 ebx = 0x0 ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = 0xbffffa04 ebp = 0xbfffb00 eip = int 0x80 addr . . . . . registercode ip ret mov eax,0x77 int 0x80
Sigreturn Oriented Programming sp bss eax = 0xb ebx = /bin/sh addr ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = bss addr ebp = bss addr eip = int 0x80 addr . . . . . registercode ip ret mov eax,0x77 int 0x80
Sigreturn Oriented Programming sp bss eax = 0xb ebx = /bin/sh addr ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = bss addr ebp = bss addr eip = int 0x80 addr . . . . . registercode ip ret mov eax,0x77 int 0x80 execve(“/bin/sh”,NULL,NULL)
Sigreturn Oriented Programming • 需注意的地⽅方 • cs,gs,es…等 segment selector register 盡量照 原本的填，不然會噴掉 • esp,ebp 不可為 0 不然⼀一樣會噴
Sigreturn Oriented Programming • Sigreturn gadget • x86 • vdso <= 正常的 syscall handler 也會使⽤用這邊 • x64 • kernel < 3.3 • vsyscall (0xffffffffff600000) <= 位置⼀一直都固定喔 > < • kernel >= 3.3 • libc <= 正常的 syscall handler 也會使⽤用這邊 • 利⽤用 ROP 製造
Virtual Dynamic Shared Object • x86 的傳統 system call : int 0x80 效能不佳，因此 在 intel 在新型的 cpu 開始提供新的 syscall 指令 • sysenter • sysexit • Linux kernel >= 2.6 之後便開始⽀支援新型的 syscall 機制
Virtual Dynamic Shared Object • VDSO • Linux ⽤用於⽀支援新型系統呼叫的 virtual shared library • 提供 __kernel_vsyscall 來負責新型的 syscall • 主要⽤用來降低使⽤用傳統 int 0x80 的 overhead • 提供 sigreturn ⽅方便在 signal handler 結束後返回 user code • 因 kernel 版本不同⽽而有差異
Virtual Dynamic Shared Object • sysenter • 參數傳遞⽅方式與 int 0x80 ⼀一樣 • 但需要⾃自⼰己先做好 function prolog • push ebp ; mov ebp,esp • A good gadget for stack pivot • 因為如果不做 function prolog 就可以利⽤用 ebp 去 改變 stack 位置
Virtual Dynamic Shared Object
Return to vDSO • 直接利⽤用 vdso 來做 ROP • Some useful gadget in vdso • x86 • sigreturn • sysenter • x64 • 有些版本的 kernel 可單靠 vdso 的 gadget 組成 execve
Return to vDSO • Weakness of ASLR in vdso • x86 • 只有⼀一個 byte 是 random 的，所以有 1/256 之⼀一的機率猜 中 • x64 • 在有 pie 的情況下，只有 11 bit 是 random 的 • CVE-2014-9585 • linux kernel 3.18.2 後已修正到 18 bit
Return to vDSO • How to find the address of vdso • Brute force • Information leak • 使⽤用 ld.so 中 __libc_stack_end 這個位置找到 stack 起始位置，在計算 ELF Auxiliary vector offset 並從中取出 AT_SYSINFO_EHDR 欄位 • 使⽤用 ld.so 中 _rtld_global_ro 的某個 offset 也會存 有 vdso 的位置
Defcon 2015 fuckup vdso + srop 解法
fuckup • Code 段會不斷變動 • 但在 32 位元下 vdso 位置只有 1 byte 是 ramdom ，所以可以 brute force 然後利⽤用那邊的 gadget • 0xf7700000 ~ 0xf7800000 • 可以直接 overflow return address 但最多只能給 100 byte • 先利⽤用 vdso 的 gadget 做出 read sys call 並加⼤大可 input 的⼤大⼩小 • read 讀⼊入的內容放到 tls • tls 位置在 vdso 前⼀一個 page • 使⽤用 sysenter 將 stack 換到 tls 段
fuckup • 第⼆二次 input 時 • 將 /bin/sh 塞⼊入 tls (⺫⽬目前的 stack) 中 • 將 sigreturn gadget 及 fake signal frame 也⼀一併塞⼊入 • 原本 binja 的做法是做 mprotect 然後塞 shellcode 不過實際上可以直接 execve 執⾏行 /bin/sh • 接著放 while 迴圈讓他⼀一直跑，停下來時基本上就拿到 shell 了
Reference • Playing with signals : An overview on Sigreturn Oriented Programming • Framing Signals—A Return to Portable Shellcode • Linux systemcall int0x80⽅方式、sysenter/sysexit difference comparation • Return to VDSO using ELF Auxiliary Vector • binja-DEF CON CTF 2015-fuckup writeup

Recommended

Linux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowLinux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowAngel Boy
 
Heap exploitation
Heap exploitationHeap exploitation
Heap exploitationAngel Boy
 
Linux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingLinux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingAngel Boy
 
Return to dlresolve
Return to dlresolveReturn to dlresolve
Return to dlresolveAngel Boy
 
Tcache Exploitation
Tcache ExploitationTcache Exploitation
Tcache ExploitationAngel Boy
 
Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Angel Boy
 
Pwning in c++ (basic)
Pwning in c++ (basic)Pwning in c++ (basic)
Pwning in c++ (basic)Angel Boy
 
Advanced heap exploitaion
Advanced heap exploitaionAdvanced heap exploitaion
Advanced heap exploitaionAngel Boy
 

Recommended

Linux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowLinux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowAngel Boy
 
Heap exploitation
Heap exploitationHeap exploitation
Heap exploitationAngel Boy
 
Linux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingLinux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingAngel Boy
 
Return to dlresolve
Return to dlresolveReturn to dlresolve
Return to dlresolveAngel Boy
 
Tcache Exploitation
Tcache ExploitationTcache Exploitation
Tcache ExploitationAngel Boy
 
Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Angel Boy
 
Pwning in c++ (basic)
Pwning in c++ (basic)Pwning in c++ (basic)
Pwning in c++ (basic)Angel Boy
 
Advanced heap exploitaion
Advanced heap exploitaionAdvanced heap exploitaion
Advanced heap exploitaionAngel Boy
 
Binary exploitation - AIS3
Binary exploitation - AIS3Binary exploitation - AIS3
Binary exploitation - AIS3Angel Boy
 
Execution
ExecutionExecution
ExecutionAngel Boy
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniquePlay with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniqueAngel Boy
 
twlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsotwlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsoViller Hsiao
 
Linux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledgeLinux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledgeAngel Boy
 
ROP 輕鬆談
ROP 輕鬆談ROP 輕鬆談
ROP 輕鬆談hackstuff
 
台科逆向簡報
台科逆向簡報台科逆向簡報
台科逆向簡報耀德 蔡
 
Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)Angel Boy
 
Design and Implementation of GCC Register Allocation
Design and Implementation of GCC Register AllocationDesign and Implementation of GCC Register Allocation
Design and Implementation of GCC Register AllocationKito Cheng
 
Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Angel Boy
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27Sheng-Hao Ma
 
TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程Weber Tsai
 
Network Programming: Data Plane Development Kit (DPDK)
Network Programming: Data Plane Development Kit (DPDK)Network Programming: Data Plane Development Kit (DPDK)
Network Programming: Data Plane Development Kit (DPDK)Andriy Berestovskyy
 
Modern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesModern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesMichael Scovetta
 
AVX-512（フォーマット）詳解
AVX-512（フォーマット）詳解AVX-512（フォーマット）詳解
AVX-512（フォーマット）詳解MITSUNARI Shigeo
 
Integrated Register Allocation introduction
Integrated Register Allocation introductionIntegrated Register Allocation introduction
Integrated Register Allocation introductionShiva Chen
 
Performance Profiling in Rust
Performance Profiling in RustPerformance Profiling in Rust
Performance Profiling in RustInfluxData
 
BPF Internals (eBPF)
BPF Internals (eBPF)BPF Internals (eBPF)
BPF Internals (eBPF)Brendan Gregg
 
逆向工程入門
逆向工程入門逆向工程入門
逆向工程入門耀德 蔡
 
icecream / icecc:分散式編譯系統簡介
icecream / icecc:分散式編譯系統簡介icecream / icecc:分散式編譯系統簡介
icecream / icecc:分散式編譯系統簡介Kito Cheng
 
2016.9.10 hackfoldr課
2016.9.10 hackfoldr課2016.9.10 hackfoldr課
2016.9.10 hackfoldr課佩琪 羅
 
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)Sehan Lee
 

More Related Content

What's hot

Binary exploitation - AIS3
Binary exploitation - AIS3Binary exploitation - AIS3
Binary exploitation - AIS3Angel Boy
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniquePlay with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniqueAngel Boy
 
twlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsotwlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsoViller Hsiao
 
Linux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledgeLinux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledgeAngel Boy
 
ROP 輕鬆談
ROP 輕鬆談ROP 輕鬆談
ROP 輕鬆談hackstuff
 
台科逆向簡報
台科逆向簡報台科逆向簡報
台科逆向簡報耀德 蔡
 
Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)Angel Boy
 
Design and Implementation of GCC Register Allocation
Design and Implementation of GCC Register AllocationDesign and Implementation of GCC Register Allocation
Design and Implementation of GCC Register AllocationKito Cheng
 
Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Angel Boy
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27Sheng-Hao Ma
 
TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程Weber Tsai
 
Network Programming: Data Plane Development Kit (DPDK)
Network Programming: Data Plane Development Kit (DPDK)Network Programming: Data Plane Development Kit (DPDK)
Network Programming: Data Plane Development Kit (DPDK)Andriy Berestovskyy
 
Modern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesModern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesMichael Scovetta
 
AVX-512（フォーマット）詳解
AVX-512（フォーマット）詳解AVX-512（フォーマット）詳解
AVX-512（フォーマット）詳解MITSUNARI Shigeo
 
Integrated Register Allocation introduction
Integrated Register Allocation introductionIntegrated Register Allocation introduction
Integrated Register Allocation introductionShiva Chen
 
Performance Profiling in Rust
Performance Profiling in RustPerformance Profiling in Rust
Performance Profiling in RustInfluxData
 
BPF Internals (eBPF)
BPF Internals (eBPF)BPF Internals (eBPF)
BPF Internals (eBPF)Brendan Gregg
 
逆向工程入門
逆向工程入門逆向工程入門
逆向工程入門耀德 蔡
 
icecream / icecc:分散式編譯系統簡介
icecream / icecc:分散式編譯系統簡介icecream / icecc:分散式編譯系統簡介
icecream / icecc:分散式編譯系統簡介Kito Cheng
 

What's hot (20)

Binary exploitation - AIS3
Binary exploitation - AIS3Binary exploitation - AIS3
Binary exploitation - AIS3
 
Execution
ExecutionExecution
Execution
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniquePlay with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit Technique
 
twlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsotwlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdso
 
Linux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledgeLinux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledge
 
ROP 輕鬆談
ROP 輕鬆談ROP 輕鬆談
ROP 輕鬆談
 
台科逆向簡報
台科逆向簡報台科逆向簡報
台科逆向簡報
 
Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)
 
Design and Implementation of GCC Register Allocation
Design and Implementation of GCC Register AllocationDesign and Implementation of GCC Register Allocation
Design and Implementation of GCC Register Allocation
 
Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27
 
TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程
 
Network Programming: Data Plane Development Kit (DPDK)
Network Programming: Data Plane Development Kit (DPDK)Network Programming: Data Plane Development Kit (DPDK)
Network Programming: Data Plane Development Kit (DPDK)
 
Modern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesModern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and Techniques
 
AVX-512（フォーマット）詳解
AVX-512（フォーマット）詳解AVX-512（フォーマット）詳解
AVX-512（フォーマット）詳解
 
Integrated Register Allocation introduction
Integrated Register Allocation introductionIntegrated Register Allocation introduction
Integrated Register Allocation introduction
 
Performance Profiling in Rust
Performance Profiling in RustPerformance Profiling in Rust
Performance Profiling in Rust
 
BPF Internals (eBPF)
BPF Internals (eBPF)BPF Internals (eBPF)
BPF Internals (eBPF)
 
逆向工程入門
逆向工程入門逆向工程入門
逆向工程入門
 
icecream / icecc:分散式編譯系統簡介
icecream / icecc:分散式編譯系統簡介icecream / icecc:分散式編譯系統簡介
icecream / icecc:分散式編譯系統簡介
 

Viewers also liked

2016.9.10 hackfoldr課
2016.9.10 hackfoldr課2016.9.10 hackfoldr課
2016.9.10 hackfoldr課佩琪 羅
 
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)Sehan Lee
 
Bug hunting through_reverse_engineering
Bug hunting through_reverse_engineeringBug hunting through_reverse_engineering
Bug hunting through_reverse_engineeringarif
 
Introduction to Reverse Engineering
Introduction to Reverse EngineeringIntroduction to Reverse Engineering
Introduction to Reverse EngineeringGopinath Chintala
 
Reverse engineering
Reverse engineeringReverse engineering
Reverse engineeringYuffie Valen
 
Introduction to Reverse Engineering
Introduction to Reverse EngineeringIntroduction to Reverse Engineering
Introduction to Reverse EngineeringDobromir Enchev
 
Reverse Engineering
Reverse EngineeringReverse Engineering
Reverse Engineeringdswanson
 
Reverse engineering & its application
Reverse engineering & its applicationReverse engineering & its application
Reverse engineering & its applicationmapqrs
 
Reverse engineering
Reverse engineeringReverse engineering
Reverse engineeringananya0122
 
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017Carol Smith
 

Viewers also liked (12)

2016.9.10 hackfoldr課
2016.9.10 hackfoldr課2016.9.10 hackfoldr課
2016.9.10 hackfoldr課
 
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)
SECCON 2016 Online CTF [Memory Analysis] Write-Up (ver.korean)
 
Bug hunting through_reverse_engineering
Bug hunting through_reverse_engineeringBug hunting through_reverse_engineering
Bug hunting through_reverse_engineering
 
Glibc malloc internal
Glibc malloc internalGlibc malloc internal
Glibc malloc internal
 
Introduction to Reverse Engineering
Introduction to Reverse EngineeringIntroduction to Reverse Engineering
Introduction to Reverse Engineering
 
Reverse engineering
Reverse engineeringReverse engineering
Reverse engineering
 
Reverse engineering
Reverse engineeringReverse engineering
Reverse engineering
 
Introduction to Reverse Engineering
Introduction to Reverse EngineeringIntroduction to Reverse Engineering
Introduction to Reverse Engineering
 
Reverse Engineering
Reverse EngineeringReverse Engineering
Reverse Engineering
 
Reverse engineering & its application
Reverse engineering & its applicationReverse engineering & its application
Reverse engineering & its application
 
Reverse engineering
Reverse engineeringReverse engineering
Reverse engineering
 
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
 

Similar to Sigreturn Oriented Programming

Arduino 底層原始碼解析心得
Arduino 底層原始碼解析心得Arduino 底層原始碼解析心得
Arduino 底層原始碼解析心得roboard
 
Linux Tracing System 浅析 & eBPF框架开发经验分享
Linux Tracing System 浅析 & eBPF框架开发经验分享Linux Tracing System 浅析 & eBPF框架开发经验分享
Linux Tracing System 浅析 & eBPF框架开发经验分享happyagan
 
Avm2虚拟机浅析与as3性能优化（陈士凯）
Avm2虚拟机浅析与as3性能优化（陈士凯）Avm2虚拟机浅析与as3性能优化（陈士凯）
Avm2虚拟机浅析与as3性能优化（陈士凯）FLASH开发者交流会
 
[Flash开发者交流][2010.05.30]avm2虚拟机浅析与as3性能优化（陈士凯）
[Flash开发者交流][2010.05.30]avm2虚拟机浅析与as3性能优化（陈士凯）[Flash开发者交流][2010.05.30]avm2虚拟机浅析与as3性能优化（陈士凯）
[Flash开发者交流][2010.05.30]avm2虚拟机浅析与as3性能优化（陈士凯）Shanda innovation institute
 
探索 ISTIO 新型 DATA PLANE 架構 AMBIENT MESH - GOLANG TAIWAN GATHERING #77 X CNTUG
探索 ISTIO 新型 DATA PLANE 架構 AMBIENT MESH - GOLANG TAIWAN GATHERING #77 X CNTUG探索 ISTIO 新型 DATA PLANE 架構 AMBIENT MESH - GOLANG TAIWAN GATHERING #77 X CNTUG
探索 ISTIO 新型 DATA PLANE 架構 AMBIENT MESH - GOLANG TAIWAN GATHERING #77 X CNTUGYingSiang Geng
 
110824 knoss-windows系统机制浅析
110824 knoss-windows系统机制浅析110824 knoss-windows系统机制浅析
110824 knoss-windows系统机制浅析Zoom Quiet
 
Arduino L2
Arduino L2Arduino L2
Arduino L2mmiwwcom
 
ch13-pv1-system-calls
ch13-pv1-system-callsch13-pv1-system-calls
ch13-pv1-system-callsyushiang fu
 
COSCUP 2014 : open source compiler 戰國時代的軍備競賽
COSCUP 2014 : open source compiler 戰國時代的軍備競賽COSCUP 2014 : open source compiler 戰國時代的軍備競賽
COSCUP 2014 : open source compiler 戰國時代的軍備競賽Kito Cheng
 
嵌入式inux應用專題文件-智慧家庭系統
嵌入式inux應用專題文件-智慧家庭系統嵌入式inux應用專題文件-智慧家庭系統
嵌入式inux應用專題文件-智慧家庭系統艾鍗科技
 
Arduino應用系統設計 - Arduino程式快速入門
Arduino應用系統設計 - Arduino程式快速入門Arduino應用系統設計 - Arduino程式快速入門
Arduino應用系統設計 - Arduino程式快速入門吳錫修 (ShyiShiou Wu)
 
构建ActionScript游戏服务器，支持超过15000并发连接
构建ActionScript游戏服务器，支持超过15000并发连接 构建ActionScript游戏服务器，支持超过15000并发连接
构建ActionScript游戏服务器，支持超过15000并发连接 Renaun Erickson
 
程式設計師的自我修養 Chapter 10 記憶體
程式設計師的自我修養 Chapter 10 記憶體程式設計師的自我修養 Chapter 10 記憶體
程式設計師的自我修養 Chapter 10 記憶體Shu-Yu Fu
 
为啥别读HotSpot VM的源码（2012-03-03）
为啥别读HotSpot VM的源码（2012-03-03）为啥别读HotSpot VM的源码（2012-03-03）
为啥别读HotSpot VM的源码（2012-03-03）Kris Mok
 
快快樂樂SIMD
快快樂樂SIMD快快樂樂SIMD
快快樂樂SIMDWei-Ta Wang
 
181201_CoAP_coding365
181201_CoAP_coding365181201_CoAP_coding365
181201_CoAP_coding365Peter Yi
 
Arduino Basic
Arduino BasicArduino Basic
Arduino Basicmmiwwcom
 
Talking about exploit writing
Talking about exploit writingTalking about exploit writing
Talking about exploit writingsbha0909
 

Similar to Sigreturn Oriented Programming (20)

Arduino 底層原始碼解析心得
Arduino 底層原始碼解析心得Arduino 底層原始碼解析心得
Arduino 底層原始碼解析心得
 
Linux Tracing System 浅析 & eBPF框架开发经验分享
Linux Tracing System 浅析 & eBPF框架开发经验分享Linux Tracing System 浅析 & eBPF框架开发经验分享
Linux Tracing System 浅析 & eBPF框架开发经验分享
 
Avm2虚拟机浅析与as3性能优化（陈士凯）
Avm2虚拟机浅析与as3性能优化（陈士凯）Avm2虚拟机浅析与as3性能优化（陈士凯）
Avm2虚拟机浅析与as3性能优化（陈士凯）
 
[Flash开发者交流][2010.05.30]avm2虚拟机浅析与as3性能优化（陈士凯）
[Flash开发者交流][2010.05.30]avm2虚拟机浅析与as3性能优化（陈士凯）[Flash开发者交流][2010.05.30]avm2虚拟机浅析与as3性能优化（陈士凯）
[Flash开发者交流][2010.05.30]avm2虚拟机浅析与as3性能优化（陈士凯）
 
探索 ISTIO 新型 DATA PLANE 架構 AMBIENT MESH - GOLANG TAIWAN GATHERING #77 X CNTUG
探索 ISTIO 新型 DATA PLANE 架構 AMBIENT MESH - GOLANG TAIWAN GATHERING #77 X CNTUG探索 ISTIO 新型 DATA PLANE 架構 AMBIENT MESH - GOLANG TAIWAN GATHERING #77 X CNTUG
探索 ISTIO 新型 DATA PLANE 架構 AMBIENT MESH - GOLANG TAIWAN GATHERING #77 X CNTUG
 
110824 knoss-windows系统机制浅析
110824 knoss-windows系统机制浅析110824 knoss-windows系统机制浅析
110824 knoss-windows系统机制浅析
 
Arduino L2
Arduino L2Arduino L2
Arduino L2
 
ch13-pv1-system-calls
ch13-pv1-system-callsch13-pv1-system-calls
ch13-pv1-system-calls
 
COSCUP 2014 : open source compiler 戰國時代的軍備競賽
COSCUP 2014 : open source compiler 戰國時代的軍備競賽COSCUP 2014 : open source compiler 戰國時代的軍備競賽
COSCUP 2014 : open source compiler 戰國時代的軍備競賽
 
嵌入式inux應用專題文件-智慧家庭系統
嵌入式inux應用專題文件-智慧家庭系統嵌入式inux應用專題文件-智慧家庭系統
嵌入式inux應用專題文件-智慧家庭系統
 
Arduino應用系統設計 - Arduino程式快速入門
Arduino應用系統設計 - Arduino程式快速入門Arduino應用系統設計 - Arduino程式快速入門
Arduino應用系統設計 - Arduino程式快速入門
 
构建ActionScript游戏服务器，支持超过15000并发连接
构建ActionScript游戏服务器，支持超过15000并发连接 构建ActionScript游戏服务器，支持超过15000并发连接
构建ActionScript游戏服务器，支持超过15000并发连接
 
程式設計師的自我修養 Chapter 10 記憶體
程式設計師的自我修養 Chapter 10 記憶體程式設計師的自我修養 Chapter 10 記憶體
程式設計師的自我修養 Chapter 10 記憶體
 
为啥别读HotSpot VM的源码（2012-03-03）
为啥别读HotSpot VM的源码（2012-03-03）为啥别读HotSpot VM的源码（2012-03-03）
为啥别读HotSpot VM的源码（2012-03-03）
 
Godson x86
Godson x86Godson x86
Godson x86
 
Ipaq with linux
Ipaq with linuxIpaq with linux
Ipaq with linux
 
快快樂樂SIMD
快快樂樂SIMD快快樂樂SIMD
快快樂樂SIMD
 
181201_CoAP_coding365
181201_CoAP_coding365181201_CoAP_coding365
181201_CoAP_coding365
 
Arduino Basic
Arduino BasicArduino Basic
Arduino Basic
 
Talking about exploit writing
Talking about exploit writingTalking about exploit writing
Talking about exploit writing
 

Sigreturn Oriented Programming

  • 2. Outline • Signal handler mechanism • Sigreturn Oriented Programing • Virtual Dynamic Shared Object • Return to vdso • Defcon 2015 fuckup
  • 3. Signal handler mechanism • 當 kernel 決定將 signal dispatch 給 user mode 時，會將所有 register 及程式狀態全部 push 進 stack 中 • 進⼊入 singal handler • 執⾏行 sigreturn system call 將所有在 stack 中的資 訊 pop 回 register 中
  • 4. Signal handler mechanism stack sp ip code User code signal handler sigreturn
  • 5. Signal handler mechanism stack sp ip code User code signal handler Kernel dispatch singal sigreturn
  • 6. Signal handler mechanism stack sp ip code User code signal handler 將所有資訊 push 進 stack 中 CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn
  • 7. Signal handler mechanism stack sp ip code User code signal handler 將 sigreturn syscall 的位置 push 進 stack CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn
  • 8. Signal handler mechanism stack sp ip code User code signal handler 程式流程跳轉⾄至 signal handler CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn
  • 9. Signal handler mechanism stack sp ip code User code signal handler 從 signal handler return CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn
  • 10. Signal handler mechanism stack sp ip code User code signal handler 程式流程跳轉⾄至 sigreturn code CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn x86 x64 mov eax,0x77 int 0x80 mov rax,0xf syscall
  • 11. Signal handler mechanism stack sp ip code User code signal handler 執⾏行 sigreturn syscall CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn x86 x64 mov eax,0x77 int 0x80 mov rax,0xf syscall
  • 12. Signal handler mechanism stack sp ip code User code signal handler stack 內容全部都會 pop 回 register 流程跳回 usercode CR2 . . . cs /gs / fs eflag RIP RSP … UC_FLAGS sigreturn addr sigreturn x86 x64 mov eax,0x77 int 0x80 mov rax,0xf syscall
  • 13. Signal Frame • push 進 stack 的內容依照架構不同⽽而有不同的 struct • x86 • sigcontext
  • 14. Signal Frame • x64 • ucontext • sigcontext
  • 15. Sigreturn Oriented Programming • 利⽤用 sigreturn 的機制，做出⾃自⼰己所想要的 syscall • 全部的 register 都可控，也可改變 stack 位置 • 需要可控 ip 及 stack => such as ROP • 需要夠⼤大的空間塞下整個 signal frame
  • 16. Sigreturn Oriented Programming • 直接偽造 sigcontext 結構，全部 push 進 stack 中 • 將 ret address 設在 sigretrun syscall 的 gadget • 將 signal frame 中的 rip(eip) 設在 syscall (int 0x80) • 當 sigreturn 回來後，就會執⾏行你所設定的 syscall • ex : execve , read , write ….etc
  • 17. Sigreturn Oriented Programming fake signal frame sigreturn addrsp stack eax = 0x0 ebx = 0x0 ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = 0xbffffa00 ebp = 0xbfffb00 eip = user code addr . . . . . registercode ip ret mov eax,0x77 int 0x80
  • 18. Sigreturn Oriented Programming fake signal frame sigreturn addr sp stack eax = 0x0 ebx = 0x0 ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = 0xbffffa04 ebp = 0xbfffb00 eip = sigreturn addr . . . . . registercode ip ret mov eax,0x77 int 0x80
  • 19. Sigreturn Oriented Programming fake signal frame sigreturn addr sp stack eax = 0x77 ebx = 0x0 ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = 0xbffffa04 ebp = 0xbfffb00 eip = int 0x80 addr . . . . . registercode ip ret mov eax,0x77 int 0x80
  • 20. Sigreturn Oriented Programming sp bss eax = 0xb ebx = /bin/sh addr ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = bss addr ebp = bss addr eip = int 0x80 addr . . . . . registercode ip ret mov eax,0x77 int 0x80
  • 21. Sigreturn Oriented Programming sp bss eax = 0xb ebx = /bin/sh addr ecx = 0x0 edx = 0x0 esi = 0x0 edi = 0x0 esp = bss addr ebp = bss addr eip = int 0x80 addr . . . . . registercode ip ret mov eax,0x77 int 0x80 execve(“/bin/sh”,NULL,NULL)
  • 22. Sigreturn Oriented Programming • 需注意的地⽅方 • cs,gs,es…等 segment selector register 盡量照 原本的填，不然會噴掉 • esp,ebp 不可為 0 不然⼀一樣會噴
  • 23. Sigreturn Oriented Programming • Sigreturn gadget • x86 • vdso <= 正常的 syscall handler 也會使⽤用這邊 • x64 • kernel < 3.3 • vsyscall (0xffffffffff600000) <= 位置⼀一直都固定喔 > < • kernel >= 3.3 • libc <= 正常的 syscall handler 也會使⽤用這邊 • 利⽤用 ROP 製造
  • 24. Virtual Dynamic Shared Object • x86 的傳統 system call : int 0x80 效能不佳，因此 在 intel 在新型的 cpu 開始提供新的 syscall 指令 • sysenter • sysexit • Linux kernel >= 2.6 之後便開始⽀支援新型的 syscall 機制
  • 25. Virtual Dynamic Shared Object • VDSO • Linux ⽤用於⽀支援新型系統呼叫的 virtual shared library • 提供 __kernel_vsyscall 來負責新型的 syscall • 主要⽤用來降低使⽤用傳統 int 0x80 的 overhead • 提供 sigreturn ⽅方便在 signal handler 結束後返回 user code • 因 kernel 版本不同⽽而有差異
  • 26. Virtual Dynamic Shared Object • sysenter • 參數傳遞⽅方式與 int 0x80 ⼀一樣 • 但需要⾃自⼰己先做好 function prolog • push ebp ; mov ebp,esp • A good gadget for stack pivot • 因為如果不做 function prolog 就可以利⽤用 ebp 去 改變 stack 位置
  • 28. Return to vDSO • 直接利⽤用 vdso 來做 ROP • Some useful gadget in vdso • x86 • sigreturn • sysenter • x64 • 有些版本的 kernel 可單靠 vdso 的 gadget 組成 execve
  • 29. Return to vDSO • Weakness of ASLR in vdso • x86 • 只有⼀一個 byte 是 random 的，所以有 1/256 之⼀一的機率猜 中 • x64 • 在有 pie 的情況下，只有 11 bit 是 random 的 • CVE-2014-9585 • linux kernel 3.18.2 後已修正到 18 bit
  • 30. Return to vDSO • How to find the address of vdso • Brute force • Information leak • 使⽤用 ld.so 中 __libc_stack_end 這個位置找到 stack 起始位置，在計算 ELF Auxiliary vector offset 並從中取出 AT_SYSINFO_EHDR 欄位 • 使⽤用 ld.so 中 _rtld_global_ro 的某個 offset 也會存 有 vdso 的位置
  • 32. fuckup • Code 段會不斷變動 • 但在 32 位元下 vdso 位置只有 1 byte 是 ramdom ，所以可以 brute force 然後利⽤用那邊的 gadget • 0xf7700000 ~ 0xf7800000 • 可以直接 overflow return address 但最多只能給 100 byte • 先利⽤用 vdso 的 gadget 做出 read sys call 並加⼤大可 input 的⼤大⼩小 • read 讀⼊入的內容放到 tls • tls 位置在 vdso 前⼀一個 page • 使⽤用 sysenter 將 stack 換到 tls 段
  • 33. fuckup • 第⼆二次 input 時 • 將 /bin/sh 塞⼊入 tls (⺫⽬目前的 stack) 中 • 將 sigreturn gadget 及 fake signal frame 也⼀一併塞⼊入 • 原本 binja 的做法是做 mprotect 然後塞 shellcode 不過實際上可以直接 execve 執⾏行 /bin/sh • 接著放 while 迴圈讓他⼀一直跑，停下來時基本上就拿到 shell 了
  • 34. Reference • Playing with signals : An overview on Sigreturn Oriented Programming • Framing Signals—A Return to Portable Shellcode • Linux systemcall int0x80⽅方式、sysenter/sysexit difference comparation • Return to VDSO using ELF Auxiliary Vector • binja-DEF CON CTF 2015-fuckup writeup