Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 NSA Codebreaker - - PowerPoint PPT Presentation

▶
lec08 remote exploit
SMART_READER_LITE
LIVE PREVIEW

Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 NSA Codebreaker - - PowerPoint PPT Presentation

Sep 12, 2023 309 likes •535 views

1 Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 NSA Codebreaker Challenges 4 Administrivia No class on Oct 28 If you are interested in, check out EKOPARTY CTF 2016 Due: Lab08 is out and its due on Nov 3 (two weeks!)

slide-1
SLIDE 1

Lec08: Remote Exploit

Taesoo Kim

1

slide-2
SLIDE 2

Scoreboard

2

slide-3
SLIDE 3

NSA Codebreaker Challenges

3

slide-4
SLIDE 4

Administrivia

  • No class on Oct 28
  • If you are interested in, check out EKOPARTY CTF 2016
  • Due: Lab08 is out and its due on Nov 3 (two weeks!)
  • NSA Codebreaker Challenge → Due: Dec 1

4

slide-5
SLIDE 5

Lab06: ROP

5

slide-6
SLIDE 6

Discussion: Lab07

  • What's the most "annoying" bug or challenge?
  • What's the most "interesting" bug or challenge?
  • So, ROP is too powerful?

6

slide-7
SLIDE 7

Discussion: pop

  • What was the problem?
  • How did you solve?

7

slide-8
SLIDE 8

Discussion: pop

8

slide-9
SLIDE 9

Discussion: puzzle

  • What was the problem?
  • How did you solve?

9

slide-10
SLIDE 10

Discussion: upto-retaddr

  • How much did you try?
  • Where did you stuck?

10

slide-11
SLIDE 11

Discussion: find-gadget

  • What was the problem?
  • How did you solve?

11

slide-12
SLIDE 12

Discussion: sprintf

  • How much did you try?
  • Where did you stuck?

12

slide-13
SLIDE 13

Discussion: rop-sorting

  • How much did you try?
  • Where did you stuck?

13

slide-14
SLIDE 14

Discussion: inc1

  • How much did you try?
  • Where did you stuck?

14

slide-15
SLIDE 15

Discussion: fmtstr-relro

  • How much did you try?
  • Where did you stuck?

15

slide-16
SLIDE 16

Take-outs from ROP

  • DEP/ASLR are not perfect solutions
  • DEP: ret-to-lib, ROP
  • ASLR: code leakage
  • What about stack canary? (what if we placed it together?)
  • Lots of known defenses (did you attend today's talk?)

16

slide-17
SLIDE 17

Today's Tutorial

  • In-class tutorial:
  • Socket programming in Python
  • Your first remote exploit!

17

slide-18
SLIDE 18

Remote Challenges

  • Use techniques learned from Lab01-Lab07
  • But targeting the remote server (e.g., online services)

18

slide-19
SLIDE 19

DEMO: about how remote challenges work

  • nc
  • exploit.py

19

slide-20
SLIDE 20

In-class Tutorial

  • Step1: nc
  • Step2: brute force attack
  • Step3: guessing attack

$ git git@clone tc.gtisc.gatech.edu:seclab-pub cs6265

  • r

$ git pull $ cd cs6265/lab08 $ ./init.sh $ cd tut $ cat README 20

slide-21
SLIDE 21

Lec08: Remote Exploit Taesoo Kim