Ethical Hacking
Module XX
Buffer Overflows
Module Objective
What is a Buffer Overflow?
Exploitation
How to detect Buffer Overflows in a program?
Skills required
CPU / OS Dependency
Understanding Stacks
Stack Based Buffer Overflows
Technical details
Writing your own exploits
Defense against Buffer Overflows
On Oct 19 2000, hundreds of flights were grounded or delayed because of a software problem in the Los Angeles air traffic control system. The cause was attributed to Mexican Controller typing 9 (instead of 5) characters of flight-description data, resulting in a buffer overflow.
Buffer Overflows
A buffer overrun is when a program allocates a block of memory of a certain length and then tries to stuff too much data into the buffer, with extra overflowing and overwriting possibly critical information crucial to the normal execution of the program. Consider the following source code:
When the source is compiled and turned into a program and the program is run, it will assign a block of memory 32 bytes long to hold the name string.
Buffer overflow will occur if you enter:
`AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Exploitation
Buffer overflow attacks depend on two things: the lack of boundary testing and a machine that can execute code that resides in the data/stack segment.
The lack of boundary is very common and usually the program ends with segmentation fault or bus error. In order to exploit buffer overflow to gain access or escalate privileges, the offender must create the data to be fed to the application.
Random data will generate a segmentation fault or bus error, never a remote shell or the execution of a command.
Stack based Buffer Overflow
Buffer is expecting a maximum number of guests.
Send the buffer more than x guests
If the system does not perform boundary checks, extra guests continue to be placed at positions beyond the legitimate locations within the buffer. (Java does not permit you to run off the end of an array or string as C and C++ do)
Malicious code can be pushed on the stack.
The overflow can overwrite the return pointer so flow of control switches to the malicious code.
Knowledge required to Program Buffer Overflow Exploits
1. C functions and the stack
2. A little knowledge of assembly/machine language.
3. How system calls are made ( at the level of machine code level).
4. exec( ) system calls
5. How to `guess` some key parameters.
Understanding Stacks
The stack is a (LIFO) mechanism that computers use both to pass arguments to functions and to reference local variables.
It acts like a buffer, holding all of the information that the function needs.
The stack is created at the beginning of a function and released at the end of it.
Understanding Assembly Language
Two most important operations in a stack:
1. Push – put one item on the top of the stack
2. Pop - "remove" one item from the top of the stack
typically returns the contents pointed to by a pointer and changes the pointer (not the memory contents)
A Normal Stack
How to detect Buffer Overflows in a program
There are two ways to detect buffer overflows.
The first one is looking at the source code. In this case, the hacker can look for strings declared as local variables in functions or methods and verify the presence of boundary checks. It is also necessary to check for improper use of standard functions, especially those related to strings and input/output.
The second way is by feeding the application with huge amounts of data and check for abnormal behavior.
Attacking a real Program
Assuming that a string function is being exploited, the attacker can send a long string as the input.
This string overflows the buffer and causes a segmentation error.
The return pointer of the function is overwritten and the attacker succeeds in altering the flow of execution.
If he has to insert his code in the input, he has to:
Know the exact address on the stack
Know the size of the stack
Make the return pointer point to his code for execution
NOPS
Most CPUs have a No Operation instruction - it does nothing but advance instruction pointer.
Usually we can put some of these ahead of our program (in the string)
As long as the new return address points to a NOP we are OK
Attacker pad the beginning of the intended buffer overflow with a long run of NOP instructions (a NOP slide or sled) so the CPU will do nothing till it gets to the `main event` (which preceded the `return pointer`)
Most intrusion detection Systems (IDS) look for signatures of NOP sleds ADMutate (by K2) accepts a buffer overflow exploit as input and randomly creates a functionally equivalent version (polymorphism)
How to mutate a Buffer Overflow Exploit
For the NOP portion
Randomly replace the NOPs with functionally equivalent segments of code (e.g.: x++; x-; ? NOP NOP)
For the "main event"
Apply XOR to combine code with a random key unintelligible to IDS and CPU code must also decode the gibberish in time to run decoder is itself polymorphic, so hard to spot
For the "return pointer"
Randomly tweak LSB of pointer to land in NOP-zone.
Once the stack is smashed..
Once vulnerable process is commandeered, the attacker has the same privileges as the process can gain normal access, then exploit a local buffer overflow vulnerability to gain super-user access.
Create a backdoor
Using (UNIX-specific) inetd
Using Trivial FTP (TFTP) included with Windows 2000 and some UNIX flavors
Use Netcat to make raw, interactive connection
Shoot back an Xterminal connection
UNIX-specific GUI
Defense against Buffer Overflows
Manual auditing of code
Disabling Stack Execution
Safer C library support
Compiler Techniques

StackGuard
StackGuard: Protects Systems From Stack Smashing Attacks
StackGuard is a compiler approach for defending programs and systems against "stack smashing" attacks.
Programs that have been compiled with StackGuard are largely immune to Stack smashing attack.
Protection requires no source code changes at all. when a vulnerability is exploited, StackGuard detects the attack in progress, raises an intrusion alert, and halts the victim program.
http://www.cse.ogi.edu/DISC/projects/immunix/StackGuard/
Immunix System
Immunix System 7 is an Immunix-enabled RedHat Linux 7.0 distribution and suite of application-level security tools.
Immunix secures a Linux OS and applications
Immunix works by hardening existing software components and platforms so that attempts to exploit security vulnerabilities will fail safe. i.e. the compromised process halts instead of giving control to the attacker, and then is restarted.
http://immunix.org
Vulnerability Search - ICAT
Summary
A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold.
Buffer overflow attacks depend on two things: the lack of boundary testing and a machine that can execute code that resides in the data/stack segment.
Buffer Overflows vulnerability can be detected by skilled auditing of the code as well as boundary testing.
Once the stack is smashed the attacker can deploy his payload and take control of the attacked system.
Countermeasures include: checking the code, Disabling Stack Execution, Safer C library support, using safer Compiler Techniques.
Tools like stackguard, Immunix and vulnerability scanners help securing systems.