Syscall Proxying Simulating Remote Execution Maximiliano Cceres - - PowerPoint PPT Presentation

▶
syscall proxying
SMART_READER_LITE
LIVE PREVIEW

Syscall Proxying Simulating Remote Execution Maximiliano Cceres - - PowerPoint PPT Presentation

Jan 07, 2024 348 likes •784 views

Syscall Proxying Simulating Remote Execution Syscall Proxying Simulating Remote Execution Maximiliano Cceres maximiliano.caceres@corest.com Caesars Palace, Las Vegas, NV, USA July 31st, 2002 Syscall Proxying Simulating Remote Execution

slide-1
SLIDE 1

Syscall Proxying Simulating Remote Execution

Syscall Proxying

Simulating Remote Execution

Maximiliano Cáceres

maximiliano.caceres@corest.com

Caesars Palace, Las Vegas, NV, USA · July 31st, 2002

slide-2
SLIDE 2

Syscall Proxying Simulating Remote Execution

Agenda

 General Concepts

Agenda

 Syscall Proxying  A first implementation  Optimizing for size  The real world: applications

slide-3
SLIDE 3

Syscall Proxying Simulating Remote Execution

General Concepts

slide-4
SLIDE 4

Syscall Proxying Simulating Remote Execution

A Process Interacts with Resources

Process Operating System A file in disk The screen A networking card

slide-5
SLIDE 5

Syscall Proxying Simulating Remote Execution

Syscalls

System calls (aka “syscalls”)

  • Operating system services
  • Lowest layer of communication between a user mode

process and the kernel

slide-6
SLIDE 6

Syscall Proxying Simulating Remote Execution 

The UNIX Way

  • Homogeneous

mechanism for calling any syscall by number

  • Arguments passed

through the stack or registers

  • Minimum number of

system services

  • Direct mapping between

syscall and libc wrapper

The System Services Layer

The Windows Way

  • Native API

undocumented and unsupported

  • High number of system

level services (about 1000)

  • Win32 API calls

implement a lot of functionality around these services

slide-7
SLIDE 7

Syscall Proxying Simulating Remote Execution

Our Windows “Syscalls”

Keep things simple

  • ANY function in ANY dynamic library available to a

user mode process

slide-8
SLIDE 8

Syscall Proxying Simulating Remote Execution

Syscall Proxying

slide-9
SLIDE 9

Syscall Proxying Simulating Remote Execution

The Process “Context”

A process uses resources to accomplish a goal

These resources define a “context” on which the process runs

  • The specific resource instances
  • The kind of access to these resources
slide-10
SLIDE 10

Syscall Proxying Simulating Remote Execution

A process reading data from a file

slide-11
SLIDE 11

Syscall Proxying Simulating Remote Execution 

Syscall stub / client

  • Nexus between process

and system services

  • Converts syscall

argument to a common format (marshaling)

  • Sends requests to the

syscall server

  • Marshals return values

Two Layers

Syscall server

  • Handles requests from

the syscall client

  • Converts arguments in

request to native convention

  • Calls the specified

syscall

  • Sends back a response

to the client

slide-12
SLIDE 12

Syscall Proxying Simulating Remote Execution

A process reading data from a file, using these two layers

slide-13
SLIDE 13

Syscall Proxying Simulating Remote Execution

Separating Client from Server

Reader Process Remote system services Syscall stub Syscall server Network layer Network link Network layer

slide-14
SLIDE 14

Syscall Proxying Simulating Remote Execution

Syscall Proxying in Action

slide-15
SLIDE 15

Syscall Proxying Simulating Remote Execution 

Separating client from server

  • The process accesses remote resources (a file)
  • The process uses the privileges of the remote server
  • The process doesn’t now anything about remote

execution

No modifications on the original program

  • Same inner logic

Changing Context

slide-16
SLIDE 16

Syscall Proxying Simulating Remote Execution

A first implementation

slide-17
SLIDE 17

Syscall Proxying Simulating Remote Execution

Implementing Syscall Proxying

The RPC Model

  • Client / server
  • Remote calls are handled by both a client stub and a

server stub

Perfect match!

slide-18
SLIDE 18

Syscall Proxying Simulating Remote Execution

The RPC Model

slide-19
SLIDE 19

Syscall Proxying Simulating Remote Execution

Benefits and Shortcomings

  • f the RPC

Model

Benefits

  • Interoperability between different platforms
  • Almost any procedure call can be converted to RPC

Shortcomings

  • Both client and server symmetrically duplicate data

conversion to a common data interchange format

slide-20
SLIDE 20

Syscall Proxying Simulating Remote Execution

Optimizing for size

slide-21
SLIDE 21

Syscall Proxying Simulating Remote Execution

The UNIX Syscall Mechanism

Homogeneous way of passing arguments

  • Integers
  • Pointers to integers
  • Pointers to buffers
  • Pointers to structs

Simple calling mechanism

  • Software interrupt
  • Trap
  • Far call
slide-22
SLIDE 22

Syscall Proxying Simulating Remote Execution

Fat Client, Thin Server

Client code directly converts from the client system’s calling convention to the server’s (no intermediate common format)

The server takes advantage of the generic mechanism for calling syscalls

The client is completely dependent on the server’s platform

slide-23
SLIDE 23

Syscall Proxying Simulating Remote Execution

Marshaling Arguments

Client code creates a request representing the stack state in the server just before invoking the syscall

  • Integers are trivially packed
  • Pointers to buffers or structures are relocated inside

the same request buffer using the server’s stack pointer

slide-24
SLIDE 24

Syscall Proxying Simulating Remote Execution

Marshaling arguments for

  • pen()
slide-25
SLIDE 25

Syscall Proxying Simulating Remote Execution

Linux syscalls

Invoking a syscall in Linux

  • Load EAX with syscall number
  • Load arguments in EBX, ECX, EDX, ESI and EDI

(syscalls with more than 5 arguments push the rest

  • n the stack)
  • Call software interrupt 0x80 (int $0x80)
  • Return value in EAX
slide-26
SLIDE 26

Syscall Proxying Simulating Remote Execution

Debugging

  • pen()

Breakpoint 1, 0x08050f60 in __libc_open () (gdb) x/20i $eip <__libc_open>: push %ebx 0x8050f61 <__libc_open+1>: mov 0x10(%esp,1),%edx 0x8050f65 <__libc_open+5>: mov 0xc(%esp,1),%ecx 0x8050f69 <__libc_open+9>: mov 0x8(%esp,1),%ebx 0x8050f6d <__libc_open+13>: mov $0x5,%eax 0x8050f72 <__libc_open+18>: int $0x80 0x8050f74 <__libc_open+20>: pop %ebx 0x8050f75 <__libc_open+21>: cmp $0xfffff001,%eax 0x8050f7a <__libc_open+26>: jae 0x8056f50 <__syscall_error> 0x8050f80 <__libc_open+32>: ret

slide-27
SLIDE 27

Syscall Proxying Simulating Remote Execution

A simple Linux server

Pseudocode for a simple linux server

channel = set_up_communication() channel.send(ESP) while channel.has_data() do request = channel.read() copy request in stack pop registers int 0x80 push eax channel.send(stack)

slide-28
SLIDE 28

Syscall Proxying Simulating Remote Execution

A simple syscall server in Linux (1)

Read request straight into the stack

read_request: mov fd, %ebx mov buflen, %edx movl $3,%eax # __NR_read mov %esp,%ecx # buff int $0x80

slide-29
SLIDE 29

Syscall Proxying Simulating Remote Execution

A simple syscall server in Linux (2)

Invoke the desired syscall

do_request: pop %eax pop %ebx pop %ecx pop %edx pop %esi pop %edi int $0x80

  • The request previously stored in ESP is the stack

needed by the syscall PLUS buffers

slide-30
SLIDE 30

Syscall Proxying Simulating Remote Execution

A simple syscall server in Linux (3)

Coding a simple syscall server for Linux can be done

It takes about a hundred bytes long (without

  • ptimizing)
slide-31
SLIDE 31

Syscall Proxying Simulating Remote Execution

What about Windows?

Windows “syscalls”

  • “… any function in any dynamic library available to a

user mode process.”

  • Common mechanism
slide-32
SLIDE 32

Syscall Proxying Simulating Remote Execution

The Windows Syscall Server (1)

Windows server

  • Call any function in its process address space

(already loaded)

In particular

  • Call LoadLibrary to load a new DLL
  • Call GetProcAddress to obtain the address of a

specific function

slide-33
SLIDE 33

Syscall Proxying Simulating Remote Execution

The Windows Syscall Server (2)

Pseudocode for a sample Windows server

channel = set_up_communication() channel.send(ESP) channel.send(address of LoadLibrary) channel.send(address of GetProcAddress) while channel.has_data() do request = channel.read() copy request in stack pop ebx call [ebx] push eax channel.send(stack)

slide-34
SLIDE 34

Syscall Proxying Simulating Remote Execution

The Real World: applications

slide-35
SLIDE 35

Syscall Proxying Simulating Remote Execution

Exploiting Code Injection Vulnerabilities

Allow an attacker to execute arbitrary code in the target system

  • Buffer overflows
  • User supplied format strings

Attack method

  • Injection: attack specific
  • Payload: what to execute once control is gained
  • Shell code: code that spawns a shell
slide-36
SLIDE 36

Syscall Proxying Simulating Remote Execution

The Privilege Escalation Phase

Successful attack against a host.

Use the compromised host as vantage point (“pivoting”)

  • Attacker profile switch: from external to internal
  • Exploit webs of trust
  • Possibly more privileged position in the target

system’s network

To be able to “pivot”, the auditor needs his tools available at the vantage point

slide-37
SLIDE 37

Syscall Proxying Simulating Remote Execution

Redefining the word “shellcode”

Supply “thin” syscall server as attack payload

Benefits

  • Transparent pivoting
  • “Local” privilege escalation
  • No shell? Who cares!
slide-38
SLIDE 38

Syscall Proxying Simulating Remote Execution

Conclusions

slide-39
SLIDE 39

Syscall Proxying Simulating Remote Execution

Conclusions

Powerful technique when staging attacks against code injection vulnerabilities

  • Turns the compromised host into a new attack

vantage point

  • Useful when shell code customization is needed

Framework for developing new penetration testing tools

  • Raises the value of the tools
slide-40
SLIDE 40

Syscall Proxying Simulating Remote Execution

Questions? Questions?

slide-41
SLIDE 41

Syscall Proxying Simulating Remote Execution

Thank You! Thank You!

  • Maximiliano Cáceres

maximiliano.caceres@corest.com

slide-42
SLIDE 42

Syscall Proxying Simulating Remote Execution CORE SECURITY TECHNOLOGIES · Offices Worldwide

Rua do Rócio 288 | 7º andar Vila Olímpia | São Paulo | SP CEP 04552-000 | Brazil Tel: (55 11) 3054-2535 Fax: (55 11) 3054-2534 info.brazil@corest.com Florida 141 | 2º cuerpo | 7º piso (C1005AAC) Buenos Aires Tel/Fax: (54 11) 4878-CORE (2673) info.argentina@corest.com Headquarters 44 Wall Street | 12th Floor New York, NY 10005 | USA Ph: (212) 461-2345 Fax: (212) 461-2346 info.usa@corest.com

www.corest.com