NYCU-LYX

10-buffer-overflow

https://youtu.be/NEtHcWE3Ki0?si=dFJ6BSPrhXRJ8fCU&t=6450

1995 A buffer overflow in NCSA httpd 1.3 was discovered and published on the Bugtraq mailing list by Thomas Lopatic.
1996 Aleph One published “Smashing the Stack for Fun and Profit” in Phrack magazine, giving a step by step introduction to exploiting stack-based buffer overflow vulnerabilities.
2001 The Code Red worm exploits a buffer overflow in Microsoft IIS 5.0
2003 The Slammer worm exploits a buffer overflow in Microsoft SQL Server 2000.
2004 The Sasser worm exploits a buffer overflow in Microsoft Windows 2000/XP Local Security Authority Subsystem Service (LSASS).
1998 The Morris Internet Worm uses a buffer overflow exploit in “fingerd” as one of its attack mechanisms.
1988 The Morris Internet Worm uses a buffer overflow exploit in “fingerd” as one of its attack mechanisms.
1995 A buffer overflow in NCSA httpd 1.3 was discovered and published on the Bugtraq mailing list by Thomas Lopatic.
1996 Aleph One published “Smashing the Stack for Fun and Profit” in Phrack magazine, giving a step by step introduction to exploiting stack-based buffer overflow vulnerabilities.
2001 The Code Red worm exploits a buffer overflow in Microsoft IIS 5.0.
2003 The Slammer worm exploits a buffer overflow in Microsoft SQL Server 2000.
2004 The Sasser worm exploits a buffer overflow in Microsoft Windows 2000/XP Local Security Authority Subsystem Service (LSASS).

10.1  Stack Overflows

Buffer Overflow Basics

A condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information. Attackers exploit such a condition to crash a system or to insert specially crafted code that allows them to gain control of the system.

Consequences

Basic Buffer Overflow Example

int main(int argc, char *argv[]) { int valid = FALSE;
  char str1[8];
  char str2[8];
  next_tag(str1);
  gets(str2);
  if (strncmp(str1, str2, 8) == 0)
    valid = TRUE;
  printf("buffer1: str1(%s), str2(%s), valid(%d)\n", str1, str2, valid);
}

$ cc -g -o buffer1 buffer1.c
$ ./buffer1
START
buffer1: str1(START), str2(START), valid(1)
$ ./buffer1
EVILINPUTVALUE
buffer1: str1(TVALUE), str2(EVILINPUTVALUE), valid(0)
$ ./buffer1
BADINPUTBADINPUT
buffer1: str1(BADINPUT), str2(BADINPUTBADINPUT), valid(1)

Result: corruption of the variable str1

What if str1 is a password?

Needs for the Attacker: Exploiting a Buffer Overflow

How to Identify Vulnerable Programs?

Why Programs are not Necessarily Protected?

Stack Buffer Overflows

Function call Mechanims

function P calling another function Q can be summarized as follows. The calling function P:

  1. Pushes the parameters for the called function onto the stack (typically in reverse order of declaration). (將要傳遞給被調用函數的参数壓入Stack (通常按照聲明順序的逆序排列)
  2. Executes the call instruction to call the target function, which pushes the return address onto the stack. (執行 call 指令，調用目標函數，並將返回地址壓入堆棧)

The called function Q:

  1. Pushes the current frame pointer value (which points to the calling routine’s stack frame) onto the stack. (將當前的幀指標值 (指向調用例程的堆棧幀esp) 壓入堆棧)
  2. Sets the frame pointer to be the current stack pointer value (i.e., the address of the old frame pointer), which now identifies the new stack frame location for the called function. (將frame pointer設置為當前的stack pointer的值 (即舊幀指標的地址old ebp)，現在它標示了被調用函數的新堆棧幀stack frame location(ebp))
  3. Allocates space for local variables by moving the stack pointer down to leave sufficient room for them. (通過將stack pointer向下移動以留出足夠空間(esp)，為局部變量（esi,edi,ebx)分配空间。)
  4. Runs the body of the called function. (運行被調用函數的程式主體)
  5. As it exits, it first sets the stack pointer back to the value of the frame pointer (effectively discarding the space used by local variables). (在退出時，首先將stack pointer(esp)設置frame pointer(ebp)的值 (實際上是丟棄了局部變量使用的空間)
  6. Pops the old frame pointer(ebp) value (restoring the link to the calling routine’s stack frame). (彈出舊幀指標值 (恢復到調用例程的stack frame的鏈接))
  7. Executes the return instruction which pops the saved address off the stack and returns control to the calling function. (執行 return 指令，將保存的地址從堆棧中彈出，並將控制權返回给調用函數)

Lastly, the calling function:

10. Pops the parameters for the called function off the stack. (將被調用函數的参数從stack中彈出)

11. Continues execution with the instruction following the function call. (繼續執行函數調用後面的指令)

https://youtu.be/5iQkR69H_1M?feature=sharedhttps://youtu.be/7ukTs4Bi7hI?feature=sharedhttps://youtu.be/seo5Es4pycs?feature=shared

Stack Overflow Example

  1. Local buffer overflow vulnerability: An exploit can overwrite the saved frame pointer and return address, leading to a stack overflow attack.
  2. Layout of local variables: Local variables are allocated in the stack frame in order of declaration, growing downward in memory.
  3. Process address space: A program has its own virtual address space with specific sections for code, data, heap, and stack.
  4. Stack growth: The stack grows downward in memory, with stack frames placed one below another.

Stack Overflow Example

Stack Overflow Stack Values

Return address: 0x080483f0

Frame pointer value: 0xbffffbe8

More Stack Overflow Vulnerabilities

Example for the Unsafe Copy between Functions

Some Common Unsafe C Standard Library Routines

Shellcode

Example: Launching Shell on an Intel Linux System

Example of a Stack Overflow Attack

Much More than this Attack Example

10.2  Defending Against Buffer Overflows

Compile-Time Defenses

Choice of programming languages

Safe coding techniques

Figure 10.10a shows an example of an unsafe byte copy function. This code copies len bytes out of the from array into the to array starting at position pos and returning the end position. Unfortunately, this function is given no information about the actual size of the destination buffer to and hence is unable to ensure an overflow does not occur

to可能 pos 過大導致 buffer overflow，呼叫程式碼應確保size+len的值不大於to數組的大小

Figure 10.10b shows an example of an unsafe byte input function. It reads the length of binary data expected and then reads that number of bytes into the destination buffer. Again the problem is that this code is not given any information about the size of the buffer, and hence is unable to check for possible overflow.

它讀取預期的二進位資料長度，然後將該位元組數讀入目標緩衝區。同樣的問題是，這段程式碼沒有給出任何有關緩衝區大小的信息，因此無法檢查可能的溢出

Language extensions and use of safe libraries

Safe Coding Style

Stack protection mechanisms

Run-Time Defenses

10.3  Other Forms of Overflow Attacks

Replacement Stack Frame

Return to System Call

Heap Overflows

Defense:
• Making the heap non-executable
• Randomizing the allocation of memory on the heap

Global Data Area Overflows

Defense
Non executable or random global data region
Move function pointers or use guard pages

Other Types of Overflows

10.4  Key Terms, Review Questions, and Problems

#