安全编程之缓冲区溢出

1、安全编程之缓冲区溢出 (笼统的总结,不会深入细节，如有疑问，请随时提问)内容缓冲区溢出初步(标准栈溢出)总结 & 提问深入了解缓冲区溢出总结 & 提问安全编程防止缓冲区溢出(一些实例)拓展:非x86平台上的缓冲区溢出总结 & 提问History1988 : Robert Morris Internet WormsBSD fingerd buffer overflow Vulnerability 1996 : Smashing The Stack for Fun and ProfitAleph One 1999 : w00w00 on heap/bss overflow2001 : free()

2、2002 : Integer overflowKernel Buffer overflow, Misc shellcode, worm,pushl $68732f sh0 pushl $6e69622f /bin movl sp, r10 pushl $0 pushl $0 pushl r10 pushl $3 movl sp, ap chmk $3b Why we learn it?Black Hat & White HatInform the vendor before expose the vul.No exploit in the advisoryConcept code always

3、Write the exploit yourself in your hackingSecurity base knowledgeDeep into your worldSecure programmingA simple sample#include #include void foo(const char* input) char stack10; strcpy(stack,input);void bar() printf(nAh,Ive been hacked!n);void main(int argc,char *argv) foo(argv1);main: pushl %ebp mo

4、vl %esp,%ebp subl $8,%esp addl $-12,%esp movl 12(%ebp),%eax addl $4,%eax movl (%eax),%edx pushl %edx call foo addl $16,%esp.L4: leave retfoo: pushl %ebp movl %esp,%ebp subl $24,%esp addl $-8,%esp movl 8(%ebp),%eax pushl %eax leal -12(%ebp),%eax pushl %eax call strcpy addl $16,%esp.L2: leave retHow t

5、he program workscallPushes Instruction Pointer (and Code Segment for far calls) onto stack and loads Instruction Pointer with the address of proc-name. Code continues with execution at CS:IP.retTransfers control from a procedure back to the instruction address saved on the stack. n bytes is an optio

6、nal number of bytes to release. Far returns pop the IP followed by the CS, while near returns pop only the IP register.strcpycopy a string without boundary checkActivation record (stack based)Frame pointerStack pointerReturn addressGrow downwardsbufferGrow upwardsHow to exploit itCover the return ad

7、dress with your shellcode address.When the foo return, it will execute your shellcode.Shellcode ? It may be the var function which print “Ive been hacked” on the screen.En, lets continueShellcodeBinary code (Machine code)The CPU can execute it directly.Generally, it return a shell like bash$, or bin

8、d a shell with a special TCP/UDP port Please refer to for detailsSummaryBuffer grows upwards while the stack grows downwards. (buffer may overwrite the activation record)Protect the activation record.String functions in lib do not check the array boundary.Safe string functions like strncpyThe shellc

9、ode executes on stack.Non-executable stackQuestion & AnswersNext : Inside the buffer overflowInside the processs address spaceLinux on x860 x00000000-0 x08000000NULL Pointer0 x08000000-0 x40000000Data SegmentText Segment0 x40000000-Library code - 0 xc0000000HeapStackWhere is the bufferStack (the sam

10、ple above, local variables)0 xbfffffff downwardsHeapchar *buf = malloc(BUF_LEN);char *buf = new charBUF_LEN;0 x4xxxxxxx upwardsBSS (uninitialized data)staic char bufBUF_LEN;static char* buf; buf = “/etc/passwd”;0 x08xxxxxx upwardsInitialized datachar bufBUF_LEN = 1;0 x08xxxxxx upwardsData we will ov

11、erwriteStackData on stackActivation RecordHeapData on heapThe management block of malloc or newBSS & Initialized dataFunction pointerGCC implement (sections in elf binary)Section NameStart AddressFlags.text0 x08048350AX.data0 x080494e8WA.dtors0 x08049500WA.got0 x08049508WA.bss0 x080495ccWAA (alloc)

12、X (execute) W (write) , the address above maydifferent with different binaryGOT & DTORSGOT (Global Offset Table)RelocationDTORSSupport destructor function in c+Buffer overflows in real-lifeGeneral stack overflowHeap/BSS overflowDouble Free (2001 1)Reentered signal ()Off by one errorsInteger overflow

13、 (2002 1)Misuse of pointer (always in loop)Off by one problemsmiddleman-1.2 and prior off-by-one bugCode/*strncpy which always NULL terminates*/char *s_strncpy(char *d, char *s, size_t len) char *dest = d; for (; len & (*dest = *s); s+, dest+, len-); *dest = 0; return d;The buffer which user supplie

14、d may overwrite the frame pointer (ebp).Integer OverflowInteger Overflow0 xfffffff + 1 = ?0 x9000000 * 2 = ?0 x0 1 = ? signed problemunsigned and signed0 xfffffffc = -4%d %uInteger Overflowint num, i;object_t *objs;num = get_user_num();if(!(objs = (object_t *)malloc(num * sizeof(object_t) perror(“ma

15、lloc”); exit(errno);for(i = 0; i num; i+) objsi = get_user_object();signed and unsignedint http_init() char *buf, buf21024, *t2, *t3; int n;#ifndef SILENCE printf(Content-type: text/html; charset=%snnn, CHARSET); printf(n); printf(n, CHARSET);#endif n=atoi(getsenv(CONTENT_LENGTH); if(n5000000) n=500

16、0000; buf=calloc(n+1, 1); if(buf=0) http_fatal(memory overflow); fread(buf, 1, n, stdin); Errors in Loopingwhile (cp reqend & isspace(*cp) cp+;if (cp = reqend | *cp = ,) buf0 = 0; *data = buf; if (cp reqend) cp+; reqpt = cp; return v;if (*cp = =) cp+; tp = buf; while (cp reqend & isspace(*cp) cp+; w

17、hile (cp reqend & *cp != ,) *tp+ = *cp+; / here is the problem if (cp reqend) cp+; *tp = 0; while (isspace(*(tp-1) *(-tp) = 0; reqpt = cp; *data = buf; return v;SummaryWhere is the bufferStackHeap/BSSWhat we can overwrite. (the data can change eip)Activation Record (ret, ebp, )The data can make a ju

18、mp.Implement in GCC and GlibcDefending buffer overflowNon-executable stack, data, heap/BSS (optimize online)Return to Lib (Solar Design )Safe compilerSecure programmingQuestion & AnswerNext topic: Secure ProgrammingUnsafe functionString functionstrcpy,strcat,sprintf,vsprintf,getsscanf familyscanf,fs

19、canf,sscanf,vscanf,vsscanf,vfscanfOtherrealpath,getopt,getpass,streadd,strecpy,strtrns,getwdselect (FD_SET )The buffer accepting data is not enough to store the data user input.Secure ProgrammingNon-boundary check functionstrcpy, strcat, memcpyBoundary check functionstrncpy , strncat,But, the misuse

20、 of these functions leads to new exploitGeneral misusesnprintf(dst, src, strlen(src);snprintf(dst, src, strlen(dst);strncat(dst, src, strlen(dst);strncat(dst, src, strlen(dst) - 1);strncpy NULL termination problem/* * strncpy() NULL termination problems * * ./a.out perl -e print A x49 */int main(int

21、 argc, char* argv) char buf150; char buf250; strcpy(buf1,This is buf2); strncpy(buf2, argv1, sizeof(buf2)-1); printf(%sn, buf2);strncat off-by-one problem/* * strncat() off-by-one problem * */int main(int argc, char* argv) char buf50; strcpy(buf,This is buf2); strncat(buf, argv1, sizeof(buf)-strlen(

22、buf); printf(length: %d content:%sn, strlen(buf), buf);Underflow problem/* undeflow problem * strncpy() NULL teimination problem * */int main(int argc, char* argv) char buf50; /buf49 = 0; strncpy(buf, argv1, sizeof(buf)-1); printf(size:%x, strlen:%x remain:%xn, sizeof(buf), strlen(buf), sizeof(buf)-

23、strlen(buf)-1); strncat(buf, argv2, sizeof(buf)-strlen(buf)-1); printf(length:%d content:%sn, strlen(buf), buf);misuse of return value in snprintf()/* misuse of return value in snprintf() * * ./a.out perl -e print A x51 perl -e print B x20 */int main(int argc, char* argv) char buf50; char *ptr; ptr = buf; /buf49-1 = 0; ptr += snprintf(ptr, sizeof(buf), %s, argv1); ptr += snprintf(ptr, sizeof(buf)-(ptr-buf), %s, argv2); printf(%sn, buf);snprintf & strncatsnprintfsnprintf(dst, src, sizeof(dst) -1);dstsizeof(dst) - 1 = 0;strncatstrncat(dst, src, siz