aka Der Hacker und die 7 Geilein 27/03/2018 // Exploit Development - - PowerPoint PPT Presentation

▶
aka der hacker und die 7 gei lein 27 03 2018 exploit
SMART_READER_LITE
LIVE PREVIEW

aka Der Hacker und die 7 Geilein 27/03/2018 // Exploit Development - - PowerPoint PPT Presentation

Dec 28, 2022 123 likes •615 views

Ein Blick in die Hexenkche der Exploit Entwickler aka Der Hacker und die 7 Geilein 27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 2 27/03/2018 // Exploit Development for Dummies

slide-1
SLIDE 1

Ein Blick in die Hexenküche der Exploit Entwickler

aka “Der Hacker und die 7 Geißlein”

slide-2
SLIDE 2

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 2

slide-3
SLIDE 3

https://www.bee-itsecurity.at // Page 3 27/03/2018 // Exploit Development for Dummies

slide-4
SLIDE 4

#whoami

27/03/2018 // Exploit Development for Dummies

Florian Bogner

IT Security Expert aka “Professional Hacker” Speaker and Trainer Bug Bounty Hunter

https://www.bee-itsecurity.at // Page 4

More than 50 vulnerabilities reported to:

slide-5
SLIDE 5

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 5

slide-6
SLIDE 6

Who?

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 6

Nation states / APT Hacking other countries for “self defense” and “peace” e.g. NSA, Russia, … Money Creating exploits for APT Threat Actors Here’s the big money: Up to 1.5 million USD! e.g. Zerodium Fun / Learning You have to start somewhere, right? From simply buffer

  • verflows to really

complex tutorials available Advanced Pentests / Red Teaming Attacks e.g. to check the security of a self- developed application.

slide-7
SLIDE 7

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 7

Douche Bags Inc

We make bags!

slide-8
SLIDE 8

Information Gathering Identify Target Search for Vulnerabilities Win! Weaponize Vulnerability Attack

Our Plan

https://www.bee-itsecurity.at // Page 8 27/03/2018 // Exploit Development for Dummies

slide-9
SLIDE 9

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Page 9 27/03/2018 // Exploit Development for Dummies

slide-10
SLIDE 10

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 10

slide-11
SLIDE 11

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 11

slide-12
SLIDE 12

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 12

slide-13
SLIDE 13

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 13

slide-14
SLIDE 14

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 14

slide-15
SLIDE 15

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 15

slide-16
SLIDE 16

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 16 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Stack frame for Main Stack “grows” from higher to lower addresses 100 10 Program

void main() { /* Application logic */ }

slide-17
SLIDE 17

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 17 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Parameters for Load() Return address Load’s local variables Stack frame for Main Stack frame for Load Stack “grows” from higher to lower addresses 100 10 Program

void main(const char *the_file) { const char *bitmap = load_file(the_file); /* More application logic */ } const char* load_file(const char *the_file) { char tmp_buffer[10]; strcpy(tmp_buffer, load_from(the_file)); /* More application logic */ return; }

slide-18
SLIDE 18

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 18 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Parameters for Load() Return address Load’s local variables Stack frame for Main Stack frame for Load Stack “grows” from higher to lower addresses 100 10 Program

void main(const char *the_file) { const char *bitmap = load_file(the_file); /* More application logic */ } const char* load_file(const char *the_file) { char tmp_buffer[10]; strcpy(tmp_buffer, load_from(the_file)); /* More application logic */ return; }

What happens if load_from() returns more than 10 characters?

slide-19
SLIDE 19

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 19 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Parameters for Load() Return address Load’s local variables Stack frame for Main Stack frame for Load Stack “grows” from higher to lower addresses 100 10 Program

void main(const char *the_file) { const char *bitmap = load_file(the_file); /* More application logic */ } const char* load_file(const char *the_file) { char tmp_buffer[10]; strcpy(tmp_buffer, load_from(the_file)); /* More application logic */ return; }

What happens if load_from() returns more than 10 characters? A stack overflow

slide-20
SLIDE 20

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 20 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Parameters for Load() Return address Load’s local variables Stack frame for Main Stack frame for Load Stack “grows” from higher to lower addresses 100 10 Program

void main(const char *the_file) { const char *bitmap = load_file(the_file); /* More application logic */ } const char* load_file(const char *the_file) { char tmp_buffer[10]; strcpy(tmp_buffer, load_from(the_file)); /* More application logic */ return; }

The attacker now controls the execution flow! Return address

slide-21
SLIDE 21

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 21

slide-22
SLIDE 22

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Seite 22 27/03/2018 // Exploit Development for Dummies

slide-23
SLIDE 23

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Seite 23 27/03/2018 // Exploit Development for Dummies

slide-24
SLIDE 24

Fuzzing

https://www.bee-itsecurity.at // Page 24 27/03/2018 // Exploit Development for Dummies

Irfan View Image File Processing Display

Normal flow

Irfan View Image File Processing Error / Vulnerability

With Fuzzing

slide-25
SLIDE 25

Live Demo:

Fuzzing with BFF

slide-26
SLIDE 26

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Seite 26 27/03/2018 // Exploit Development for Dummies

slide-27
SLIDE 27

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Page 27 27/03/2018 // Exploit Development for Dummies

slide-28
SLIDE 28

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 28 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Parameters for Load() Return address Load’s local variables Stack “grows” from higher to lower addresses 100 10 Program

void main(const char *the_file) { const char *bitmap = load_file(the_file); /* More application logic */ } const char* load_file(const char *the_file) { char tmp_buffer[10]; strcpy(tmp_buffer, load_from(the_file)); /* More application logic */ return; }

The attacker now controls the execution flow! Return address

slide-29
SLIDE 29

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 29 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Parameters for Load() Return address Load’s local variables Stack “grows” from higher to lower addresses 100 10 Return address Image Image content Shellcode Continue execution with our Shellcode

slide-30
SLIDE 30

Live Demo:

Weaponize 1/2!

slide-31
SLIDE 31

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 31 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Parameters for Load() Return address Load’s local variables Stack “grows” from higher to lower addresses 100 10 Return address Image Image content Shellcode Continue execution with our Shellcode

slide-32
SLIDE 32

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 32 27/03/2018 // Exploit Development for Dummies

Stack Parameters for Main() Return address Main’s local variables Parameters for Load() Return address Load’s local variables Stack “grows” from higher to lower addresses 100 10 Return address Image Image content Shellcode Continue execution with our Shellcode

Magic

slide-33
SLIDE 33

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 33 27/03/2018 // Exploit Development for Dummies

Return address Image Image content Shellcode Doesn’t work! Image is a memory mapped file

slide-34
SLIDE 34

Return address Stack POP POP RET

What is a Stack Overflow?

https://www.bee-itsecurity.at // Page 34 27/03/2018 // Exploit Development for Dummies

Image Image content Shellcode 004D0BA9

slide-35
SLIDE 35

Live Demo:

Weaponize 2/2!

slide-36
SLIDE 36

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Seite 36 27/03/2018 // Exploit Development for Dummies

slide-37
SLIDE 37

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Page 37 27/03/2018 // Exploit Development for Dummies

slide-38
SLIDE 38

Final Demo:

The Victim’s PoV

slide-39
SLIDE 39

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Page 39 27/03/2018 // Exploit Development for Dummies

slide-40
SLIDE 40

Information Gathering Identify Target Search for Vulnerabilities Win! Attack Weaponize Vulnerability

Our Plan

https://www.bee-itsecurity.at // Page 40 27/03/2018 // Exploit Development for Dummies

slide-41
SLIDE 41

Mitigations

Learning from the Past

slide-42
SLIDE 42

Return address Stack POP POP RET

Mitigations

https://www.bee-itsecurity.at // Page 42 27/03/2018 // Exploit Development for Dummies

Image Image content Shellcode

slide-43
SLIDE 43

Return address

Mitigation: Secure Coding

https://www.bee-itsecurity.at // Page 43 27/03/2018 // Exploit Development for Dummies

Program

void main(const char *the_file) { const char *bitmap = load_file(the_file); /* More application logic */ } const char* load_file(const char *the_file) { char tmp_buffer[10]; strncpy(tmp_buffer, load_from(the_file), sizeof(tmp_buffer) ); /* More application logic */ return; }

slide-44
SLIDE 44

Return address POP POP RET

Mitigation: ASLR

https://www.bee-itsecurity.at // Page 44 27/03/2018 // Exploit Development for Dummies

slide-45
SLIDE 45

Return address Stack POP POP RET

Mitigations: DEP

https://www.bee-itsecurity.at // Page 45 27/03/2018 // Exploit Development for Dummies

Image Image content Shellcode

rwx

slide-46
SLIDE 46

27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 46

slide-47
SLIDE 47

https://www.bee-itsecurity.at // Seite 47 27/03/2018 // Exploit Development for Dummies

QUESTIONS?

slide-48
SLIDE 48

Bee IT Security Consulting e.U.

Nibelungenstraße 37, A-3123 Schweinern

Florian Bogner

Information Security Expert +43 660 123 9 454 florian@bee-itsecurity.at https://www.bee-itsecurity.at