Title: Stack Overflow IRC Lecture Author/Lecturer: Aelphaeis Mangarae Website: http://blackhat-forums.com Email: adam_we1shaupt@hotmail.com IRC: IRC.BlueHell.Org #BHF ------------------------------------------------------------------------------------- Learn Stack Overflow Exploitation IRC Lecture Lecturer: Aelphaeis Mangarae Topic: Win32 Stack Based Buffer Overflow Exploitation Time: 10:17 PM, Perth, Western Australia So we begin the lecture as you should of already guessed, a stack based buffer overflow is something which occurs on the stack The stack is a data structure in memory that can be used for storing temporary and initialized data The stack works on a LIFO principal that is Last In, First Out The top of the stack is at a fixed address and grows downwards If something is added to the stack, that means something is PUSHED onto the stack when this happens something is placed on the stack, and the Stack Frame Pointer is decremented (because of stack growth's direction) that is, it will point to a lower address when something is removed from the stack it is POPPED at which point the stack frame is removed and the Stack Frame Pointer is incremented * dni_ (~dni@bluehell-8A5C4F46.hsd1.fl.comcast.net) Quit (Ping timeout ) So now you have a basic understanding of how the stack works * dni_ (~dni@bluehell-8A5C4F46.hsd1.fl.comcast.net) has joined #bhf Here is a diagram of a typical stack from wikipedia http://en.wikipedia.org/wiki/Image:ProgramCallStack2.png On the win32 stack there is basicall half a dozen registers these registers contain information some important ones are: The EBP, which is the Extended Base Pointer, this points to the current stack frame (sometimes it's named Stack DATA Pointer) The EIP, the Extended Instructional Pointer, which points to where a function will return to after it is called (generally it determines the next instruction's address) The ESP, the Extended Stack Pointer which points to the "top of the stack" (more accurately the bottom of stack on x86) in some books the essayists have told that it's used to point to the next stack operation which is true and the same somehow the two most important of these registers are the ESP and the EIP. These two we will come across when exploiting our application (vulnerable to a typical Stack Overflow). * Aelphaeis sets mode: -m Any questions? no any :) so far no non no nope no nope i iam nope. how long the esp ? as long as an address i suppose each register on a 32-bit OS is 4 bytes in length (32bits/8bits=4bytes), storing 32-bit address/data at maximum. If you need less space to use you can use 16-bit and/or 8-bit registers (sometimes we are forced to use a 8-bit register for example) esp its an address of a 4bytes register hence 32bit? the esp is 4 bytes ok` Aelph? thanks * popkorn (pop_korn@bluehell-7307429E.miki.eu.org) has joined #bhf w00t i can talk :D * mIcr0s0ft (user@ping.pong.np) has joined #bhf fuck up headYY, lecture is going on sorry :( Aelphaeis? ¬http://lardcave.net/~wzdd/hype/localimages/cs9244__ia32_integer_registers.png so no more questions really? look at this guys yes me hence 32bit? and this one: ¬http://www.unixwiz.net/images/stackframe-cdecl.gif * Aelphaeis sets mode: +m So now we move onto the next bit of the lecture What Is A Stack Based Buffer Overflow * mIcr0s0ft (user@ping.pong.np) has left #bhf A stack based buffer overflow occurs when more data is transferred into a (static) buffer than what the buffer was designed to hold, therefore the buffer overflows the contents of the buffer would be stored somewhere on the stack temporarily, what would happen is the excess data would overwrite other memory locations (stack frames, registers, func ptr, ...) The fact we can overwrite registers on the stack is the important part, because this is the key to exploitation In this lecture I will demonstrate the overwriting of the EIP and how to execute shellcode by hijacking flow of the program and landing it into a NOPSLED which of course will be followed by shellcode Why Do Stack Overflows Occur? * cesnjak (cesnjak@bluehell-D2958902.adsl.net.t-com.hr) has joined #bhf Stack Overflows occur because there are functions in C/C++ that do not do "bounds checking" and will copy the contents of one buffer or inputted data into a buffer without checking how much data the buffer can hold * insanity (_th3-x@F88F3A20.8CE6CB0B.F175557F.IP) has joined #bhf functions such as strcpy() do not do bounds checking and are therefore exploitable A small list of C functions that are vulnerable are: gets() sprintf() strcat() strcpy() streadd() strecpy() strtrns() index() fscanf() scanf() sscanf() vsprintf() realpath() getopt() getpass() If I remember correctly, dni found that list through googling * Aelphaeis sets mode: -m :) Any questions? nope strlen() thankz everything's fine.. no questions maybe more functions.. no questions well you guys can find that out for yourself im making list of them.. :D no questions not like you can't use Google, unlike my retard friend Ben who acts like he can't use Google gogo`` ok... if anyone has any list..it would be nice to share it so i want to tell if someone has any question just ask, do not be quiet yeah feel free to ask ok, seems no one has any questions why does my peenii smell? ... nic`, you need to wash your penis everyday lol =\ ok thanx =D ! haah otherwise it will become vulnerable to a stack based buffer overflow lol and you will be exploited by h4x0rz hahaha lol lol pwned sperm overflow then ill get posted on steak and cheese lol lol, ok that's enough about nic` pen0r vuln one :P * Typo (~you.suck@bluehell-156E3E87.lns1-c11.dsl.pol.co.uk) has joined #bhf So now we move onto: Fuzzing Our Vulnerable Application! now, I have already compiled our target application using LCC W32 it can be found here: http://blackhat-forums.com/Aelphaeis/vuln.exe everyone download it if you haven't got a vuln.exe suitable for exploitation brb, gotta piss classic the thrill of the ride Silentz ;D heh * Balgan (~pinokavat@bluehell-574D17AD.brig.cable.ntl.com) has joined #bhf 43 and counting... lol so you all downloaded vuln.exe? or got a copy yup yes yeah, just continue yes :D it crashes to me i have download it yes Now as I should of mentioned earlier this exploitation should be done on a Windows XP box and turn back the moderated mode back on:) * nic` sets mode: +m If for some reason you have DEP enabled on applications (other than windows system files) you can turn it off by going to Control Panel -> System -> Advanced -> Performance (Settings) -> Data Execution Prevention this technology will be discussed a bit more later on I believe most 64bit CPU's support Data Execution Prevention ok now it is time to fuzz our vulnerable application Aelhaeis: can DEP stay on if its just for windows progrms and serviceS? yes, I have found you can still exploit the application that way ok in fact I also discovered today that by default that's the way it seems to be indeed Now it's time to open up our vulnerable application in Ollydbg We will be fuzzing to see how many bytes we can slam in memory before overwriting the EIP. For those you will need my Fuzzing.txt (well you could just use Perl) http://blackhat-forums.com/Aelphaeis/Fuzzing.txt * popkorn (pop_korn@bluehell-7307429E.miki.eu.org) Quit (Quit: leaving ) * r0rkty (admin@securzone.org) Quit (Ping timeout ) You can open Ollydbg and pass the A's which we will be using to fuzz our application as an argument This program takes input as an argument (named a "command-line argument" program) http://img144.imageshack.us/img144/9519/ollydbg1lf0.png Ollydbg, File -> Open then paste 262 A's into the Arguments input box Press Open Now go to Debug -> Run You should possibly notice that some bytes (2) of your EIP have been overwritten * Aelphaeis sets mode: -m * cesnjak (cesnjak@bluehell-D2958902.adsl.net.t-com.hr) Quit (Quit: ) Any questions? 4 bytes overwritten why 262 A's ? meaning the whole thing right? EIP point to 00004141 yes sm, 262 to probe Syn4pse 2 me 4 not me the buffer length is 256 why 262 can overwrite 41 and 41 well it should vary on what compiler you use yep.. that's what i asked yes well there is space between the end of the buffer and the EIP on the stack my EIP -> 41414141 so that has to be overwritten let demonstrate it: [ buffer (256) ] [ SFP (4) ] [ RET (eip) (4) ] = 264 (data needed to overwrite the eip completely) 264 - 262 (our data) = 2 => two last bytes of EIP is not overwritten 00004141 me to my EIP -> 00004141 00004141 * r0rkty (admin@ircop.bluehell.org) has joined #bhf 262 's A * Aelphaeis sets mode: +o r0rkty 00401219 ? my eip is not overwritten at ll i put 262 A's in it have you gone Debug -> Run i have to pass by parameter 260 A's yes EBP is ->41414141 try more then dni and Seven to have 2 bytes overwritten of EIP did you use my vuln.exe ? now it's working dni && seven 00004141 ok good try 260 A's EIP: 00004141 EBP: 41414141 how about you dni, what is happening? the guys that have 41414141 just probe with 260 A's no, because 4 bytes is overwritten 41414141 - it's EBP if they slamed 262 bytes in there, that means they can place 258 bytes in memory before overwriting the EIP. hmm maybe its DEP fucking with my shit yeah i konw ael well DEP marks areas of memory as non-executable so shellcode can't be executed I wouldn't think it would effect the overwrite of the EIP. dni did you use my vuln.exe? have you Run->debug ? i got it working now dni? yeah i had to put more into the buffer ahh ok right so now you guys should all have worked out how many bytes you can place in memory before overwriting the EIP. so, is there anyone lost? this will be needed to align our new address over the old one. w8 a sec one more... you said: [15:45] well there is space between the end of the buffer and the EIP on the stack how do we know how big is the space? just one question u guyz are going to put this "lecture" in the forum when it ends ? since iwasnt here since the begginin in a normal stack based overflow process that space is 4 bytes. there's one segment sfp or stack frame pointer between 'em in usual so you need to put 4 more characters in order to reach the first byte of EIP or RET. yes Balgan thx Aelphaeis :) Ok.. everything's find. continue :] ok, so everyone now knows how they can align their new address over their old one? fine* what do you mean? i ad to put 264 **had to overwrite the eip what cpu do you have? amd ok 264 's A can overwirte all eip yes EIP->41414141 two questions: do we have to keep the bytes that overflow to a minimum, i mean, if the EIP is written at exactly 262 chars, why we use 264? D4rk, well it's not overwritten completely (2 bytes is still left). Generally we don't need to overwrite our eip with a junk data (A's). we just try to determine the number of characters needed to overflow the buffer. d4rk no then we are going to use the exactly num C:\>findjmp ntdll.dll esp you are going to see it later sm, you just need to work out how many bytes you can put into memory before overwriting the EIP. dcboy, please leave the explaining to me yeah aelph, it's ok I will discuss what you are going onto later on i got it.. thanks so you all now should have worked it out ok one thing Ael yes? you told me to leave then with 41414141 but you can leave with that you may search for at least 00414141 no, I didn't. You just needed to work out as I have said numerous times to know the bytes exactly < 01~Aelphaeis > ok, so everyone now knows how they can align their new address over their old o yes so i think there are guys with 41414141 now ant it can result an error later well then you need to work out how many bytes they can put into memory before overwriting the EIP. That's what they need to work out and what you should have all worked out by now :) That's the reason we are doing the fuzzing Now, what we are going to do is put the following into memory: [JUNK DATA] [NEW RETURN ADDRESS] [NOP SLED] [SHELLCODE] The JUNK DATA will be used to overflow our buffer because as I said before strcpy() does not do bounds checking, and in our application will just copy what is receives into our char buffer[256]; the junk data will be th same has the A's we use in fuzzing aye? yes, you can use what ever you want ty but in this case we will be using A's Now it is time for us to find a suitable address, to overwrite the EIP (RET) with. the RET in its simplest fashion is a simple CALL/JMP instruction. in generally we can use the call/jmp trick to locate our data on the stack and use it to exploit the program successfully and our data here is: NOP SLED and SHELLCODE What we need is an address with a JMP ESP or a CALL ESP. If we overwrite our EIP with an address that has JMP ESP we can jump into our NOPSLED. * KZ (~kanada@bluehell-5EBF2E1A.nc.res.rr.com) has joined #bhf In this case I am not sure if the NOPSLED is actually needed, but when doing more complicated exploitation you will find you probably will need to use it but the point is that you can't use the nop sled everywhere. Sometimes the target program (buffer) is very tiny and can't waste it by using of NOP instructions. So you need to find the exact address of the shellcode to avoid using nop sled. Anyway it's not the case here in our example. when we hit the NOPSLED, the Stack Frame Pointer will be incremented as it moves along each NOP. A NOP, is a No-Operation byte (with the hexadecimal represent of 0x90), it doesn't do anything. So now, let's find our address to overwrite the EIP with. First here is the "skeleton" if you will for the exploit we will be coding to exploit the vulnerable application http://blackhat-forums.com/Aelphaeis/exploit_b0f.c Everyone get it and whack it into their C Compilers * KSURi (~ksuri@9E51E34F.E8A52DC2.B891CCD7.IP) has joined #bhf re2all before, we go on. I would like to point out that obviously you will need to change the path in exploit[] to what is suitable for your application hello, KSURi, STFU while the lecture is going on So everyone please do that now Aelphaeis just one question which is the c compiler ur using in the movie of exploiting stack overf. ? LCC W32 thx so everyone ok with where we have come so far? yes yeah yes uep yes yep question tho in b0f. c * skvoznoy (~madrish@F7E2E0C1.E2D05FA0.4BFF86AB.IP) has joined #bhf yes, continue shoudnt it be 4 bytes ess than whatever the amount it took to overwrite the EIP ? that is i told welcome skvoznoy, the lecture is currently going on if you have eip 41414141 you have to put 4bytes less cuz, dont we need to send it garbage until right before the EIP starts getting overwritten yes correct ok as I said before! if you had 00004141 2bytes less correct Syn4ps3 good day to all, it is pleasent to be here now for me, in so wonderful company :) * r0rkty- (~h4x@ircop.bluehell.org) has joined #bhf so now, we get our JMP ESP/CALL ESP address so Aelphaeis the problem i was saying before is that you have EIP 41414141 you can be overwritting another registers too we need to find one, in Windows NT as I have probably mentioned before, the addresses are static (NO ASLR) so, no problems finding one correct, but that isn't important for this ok http://blackhat-forums.com/Aelphaeis/Findjmp2.exe Findjmp2 is a program written by Hat-Squad, for finding possibly locations to JMP to For those of you who remember a while back (when he was still releasing exploits) class101 was a member of Hat-Squad * r0rkty (admin@ircop.bluehell.org) Quit (Ping timeout ) find which dll? I believe he actually wrote the program of course not written the whole, but also he has optimized it the findjump tool mainly is developed by eEye and class101 has optimized it. dcboy I will get to that sorry~ for this example, we will use kernel32.dll everyone got findjmp2.exe ? yea * phetips (~phetips@bluehell-31B75992.upc-i.chello.nl) has joined #bhf yes yep lecture over? no no, phetips we are like half way through try turning the +m mode again... it was better that way... after you're done we can ask questions doesn't bother me sm atm, not too bad anyway okay i'll just sit and read than :) we will now use findjmp2 to find an address lol drag it into cmd and pass it the following arguments [+]0x77e7ae59 call esp is this? findjmp2.exe KERNEL32.DLL esp dcboy, for the last time don't go jumping ahead of us please sorry all of you should find an address 2 * SeventotheSeven nods Balgan what operating system and service pack do you have? 2 as well xp sp 2 Win xp SP2 same 0x7C81518B call esp 0x7C8369D8 call esp same as me 2 0x7C81518B call esp 0x7C8369D8 call esp 0x7C4FEDBB call esp ok, that seems to be different from mine, but anyway hmm how strange, i've got win xp sp2 and it only has one ok, I get the point now guys. For those of you who have different language Operating Systems I think the addresses will vary same with me D4rk ye mine is in PT the KERNEL32.DLL isn't the most reliable dll to look for addresses in. ou guys put 262 right ? yup you can use any windows system dll you want that is loaded in memory for example you can use ntdll.dll too, but of course it's not the case, so forget it for now. i put 264 0x7C81518B call esp 0x7C8369D8 call esp oh sorry that's exactly the same :)