Return Oriented Programming (ROP) Based Exploits - Part I

Exploit - ex·ploit

to use selfishly for one's own ends

Exploit Discovery

Big space in computer security

Exploits are discovered by Security Researchers and Hackers alike

Zero day attacks are a result of newly created exploits or un-patched vulnerabilities

Exploit Mitigation

Windows XP Sp2 was the first widespread OS to incorporate exploit mitigation

Protected stack metadata (Visual studio compiler/ GS flag)Protected heap metadata (RtlHeap Safe Unlinking)SafeSEH (Compile time execution handler registration)Software, Hardware enforced Data Execution Prevention (DEP)

Windows Vista implements Address Space Layout Randomization (ASLR)

Break the mitigation

BlackHat Presentations

Security Forums

Blogs

Whose responsibility is it to mitigate ?

Heap ProtectionSEH Chain validation

Stack CookiesSafe SEH

DEPASLR

OS

ApplicationCompiler

DEP - Data Execution Prevention

When an attempt is made to execute code from a DEP protected data page,an access violation (STATUS_ACCESS_VIOLATION (0xc0000005)) will occur.

In most cases, this will result in process termination (unhandled exception).

DEP - Data Execution Prevention

Without DEP On

With DEP On

Problem

With DEP on, code from the stack won’t work

Work-Around

We need to build a chain of instructions. We need to jump from one part of the chain to the other part of the chain without ever executing a single bit from our DEP protected region.

Or, to use a better term, we need to return from one instruction to the address of the next instruction

Each instruction (series of instructions) in our chain will be called a "gadget".

Each gadget will return to the next gadget ( = to the address of the next gadget, placed on the stack), or will call the next address directly.

We will need to use existing instructions (instructions in executable areas within the process)

and put them in such an order (and "chain" them together) so they would produce what we

need and put data in registers and/or on the stack

Letter

The chocolate bombs you sent, bombs they are in size . Received them, yesterday. Planted the rose plant, bomb was delicious … had to mention again. Set to go for shopping, 5 p.m. tomorrow.

The chocolate bombs you sent, bombs they are in size . Received them, yesterday. Planted the rose plant, bomb was delicious … had to mention again. Set to go for shopping, 5 p.m. tomorrow.

The bombs Received yesterday Planted bomb Set 5 p.m. tomorrow

Don’t sleep yet

Gadget

We need to take a value from the stack, put it in EAX, and increase it with 0×80

Gadget

WindowsFunction_1()

ADD EBX, 30TEST AL, AL

WindowsFunction_2()

INC EAX

-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - --

-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - --

-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - --

POP EAXRET

ADD EAX, 80POP EBXRET

We need to take a value from the stack, put it in EAX, and increase it with 0×80

POP EAXRET

ADD EAX, 80POP EBXRET

Gadget

  Stack address Stack value ESP points here -> 0010F730 10026D56 (pointer to POP EAX + RET)  

0010F734 50505050 (this will be popped into EAX)   0010F738 1002DC24 (pointer to ADD EAX,80  + POP

EBX + RET)   0010F73C DEADBEEF (this will be popped into EBX,

padding)

Windows Function Calls to bypass DEP

VirtualAlloc(MEM_COMMIT + PAGE_READWRITE_EXECUTE) + copy memory. This will allow you to create a new executable memory region, copy your shellcode to it, and execute it

HeapCreate(HEAP_CREATE_ENABLE_EXECUTE) + HeapAlloc() + copy memory.

SetProcessDEPPolicy()

NtSetInformationProcess()

VirtualProtect(PAGE_READ_WRITE_EXECUTE). This function will change the access protection level of a given memory page, allowing you to mark the location where your shellcode resides as executable.

WriteProcessMemory()

Windows Function Calls to bypass DEP

Each one of those functions requires the stack or registers to be set up in a specific way.when an API is called, it will assume that the parameters to the function are placed at the top of the stack (= at ESP)

How to chain

Demo

Finding ROP gadgets

There are 2 approaches to finding gadgets that will help you building the ROP chain :

You can specifically search for instructions and see if they are followed by a RET.  The instructions between the one you are looking for, and the RET instruction (which will end the gadget) should not break the gadget.

You can look for all RET instructions and then walk back, see if the previous instructions include the instruction you are looking for. pvefindaddr

First part of the Exploit

Testing ROP with a Windows APIVirtualProtect()

Demo

Now you can sleep

Thank You

Images

http://s280.photobucket.com/albums/kk176/sabbath_X/?action=view&current=Pumpkin_ Grin_lll_by_midnightINK.jpg&newest=1

http://www.indiamike.com/india/attachments/7595d1210760693-what-the-strange-questions-for-india-experts-chilli-and-lemon.jpg

http://www.animevice.com/profile/kao/all-images/84-142612/albert_wesker___reside nt_evil_by_megakay/83-203102/

http://la-vie-bohem.deviantart.com/art/Yawn-115528201?q=boost%3Apopular+yawn+baby&qo=32

http://SillyScreamingQueen.deviantart.com/art/Sleepy-54882830?q=boost%3Apopular+sleepy&qo=6