EzServer adalah video server yang dapat melakukan stream dengan kualitas full HD ke berbagai mesin. Buffer overflow ditemukan pada aplikasi EzServer yang berjalan pada port 8000. Attacker dapat mengirimkan sejumlah kode berbahaya ke port 8000 dan mendapatkan akses setara dengan hak akses aplikasi EzServer. Pada kesempatan ini, penulis akan memaparkan proses pembuatan exploit terhadap aplikasi EzServer menggunakan Python.
Tom Gregory: Security consultant at Spentera, Metasploit exploit developer/contributor.
http://www.python.or.id/2013/04/kopi-darat-komunitas-python-indonesia.html
2. AGENDA
Memory
Stack/Buffer Overflow
Structured Exception Handler (SEH)
Escape from small space
Egghunter
Demo
3. Args./Environment
Stack
Unused Memory
Heap (dynamic data)
Static Data .data
Program Code .text
PROCESS MEMORY LAYOUT
High addresses
Top of memory
0xFFFFFFFF
Low addresses
0x00000000
Stack grows down by
procedures call
Heap grows up e.g. by
malloc and new
4. STACK BUFFER OVERFLOW
#include <string.h>
void foo (char *bar)
{
char c[12];
strcpy(c, bar); // no bounds checking...
}
int main (int argc, char **argv)
{
foo(argv[1]);
}
6. STACK BUFFER OVERFLOW
Unallocated stack
char c[12]
char *bar
Saved frame
pointer
(EBP)
Return Address
(EIP)
Parent routine‟s
stack
Memory addressStack growth
h e l l
0o
7. STACK BUFFER OVERFLOW
Unallocated stack
Memory addressStack growth
A A A A
A A A A
A A A A
A A A A
A A A A
A A A A
A A A A
x08 x35 xc0 x80
Fill the stack with „A‟
Overwritten return address
at 0x80c03508
Parent routine‟s
stack
Little
Endian
0x80c03508
8. WHAT IS SEH?
This structure ( also called a SEH record) is 8 bytes and has 2 (4
bytes each) elements :
a pointer to the next exception_registration structure (in
essence, to the next SEH record, in case the current handler is
unable the handle the exception)
a pointer, the address of the actual code of the exception handler.
(SE Handler)
9. WHAT IS SEH?
Image was taken without permission from http://images.google.com
10. LOOK AT THE SEH STRUCTURE
Beginning of SEH chain
SEH chain will be placed at the top of the main data block
It also called FS:[0] chain as well (on intel: mov [reg], dword ptr
fs:[0])
End of seh chain
Is indicated by 0xFFFFFFFF
Will trigger improper termination to the program
11. HOW SEH WORKS?
Stack
TEB
FS[0]: 0012FF40 0012FF40
0012FF44
0012FFB0 : next SEH record
7C839AD8 : SE Handler
0012FFB0
0012FFB4
0012FFE0 : next SEH record
0040109A : SE Handler
0012FFE0
0012FFE4
FFFFFFFF : next SEH record
7C839AD8 : SE Handler
12. PROTECTIONS AGAINST SEH
XOR
before the exception handler is called, all registers are XORed
with each other, so it will make them all point to 0x00000000
DEP & Stack Cookies
Stack Cookies or Canary is setup via C++ compiler options
DEP will mark the memory stack to no execute.
It was introduced since Windows XP SP2 and Windows 2003,
enabled by default on Windows Vista and 7
Those two protections can make it harder to build exploits.
13. PROTECTIONS AGAINST SEH
SafeSEH
additional protection was added to compilers, helping to stop the
abuse of SEH overwrites.
It will check the original value of SEH, if it overwritten, SafeSEH
will try to bring it back to the original value.
14. ABUSING SEH
On direct RET technique:
Simply find an instruction to jump to the stack, done.
While on SEH Based:
You cannot simply jump to the stack, because the registers are
XORed.
We can take advantage this exception handling condition by
overwrite the SE Handler address.
The OS will know the exception handling routine, and pass it to next
SEH record.
Pointer to next SEH will bring us to the shellcode.
Game over!
15. ABUSING SEH
In other words, the payload must do the following things:
Cause an exception. Without an exception, the SEH handler (the
one you have overwritten/control) won‟t kick in.
Overwrite the pointer to the next SEH record with some jumpcode
(so it can jump to the shellcode)
Overwrite the SE handler with a pointer to an instruction that will
bring you back to next SEH and execute the jumpcode.
The shellcode should be directly after the overwritten SE Handler.
Some small jumpcode contained in the overwritten “pointer to
next SEH record” will jump to it).
16. ABUSING SEH
When the exception occurred, the position on the stack will going like
this:
Possible value to overwrite SE Handler are POP something, POP
something and RETN to the stack.
It will POP address that sit at the top of the stack, POP it again to take
the second address, and RETN to execute the third address (which is
now at the top of the stack)
Top of stack
Our pointer to next SEH
address
17. ABUSING SEH
Image was taken from http://corelan.be
with permission from Peter van Eeckhoutte (Corelan)
18. ESCAPE FROM SMALL SPACE
Use Egghunter
“Staged shellcode”
Use small amount of custom shellcode to find the actual “bigger”
shellcode (the egg), by searching entire memory for the final
shellcode
19. EGGHUNTER
There are 3 conditions that are important in order for this
technique to work
We must be able to jump to (jmp, call, push/ret) & execute “some” shellcode,
the egghunter.
The final shellcode must be available somewhere in memory (stack/heap/…).
You must “tag” or prepend the final shellcode with a unique string/marker/tag.
This means that we will have to define the marker in the egg hunter code, and
also write it just in front of the actual shellcode.
Stack is used for function callsThere are 2 Registers on the CPU associated with stack, EBP and ESP.ESP points to the top of the stack, whereas EBP points to the beginning of the current frameWhen a function is called, arguments, EIP and EBP pushed onto stackEBP is set to ESP, and ESP is decremented to make space for the functions local variable