Binary Exploitation 101 in Tamil By Ajay SK

Ep 2 Binary Exploitation 101 in Tamil

KNOW HOW - A series of Knowledge Sharing Sessions/Webinar in the Cybersecurity Domain to educate others, spread awareness and bring out new opportunities to beginners by WAP Chennai Team

Our goal is to bring out as many Security Researchers as possible and give clear guidance in the Cybersecurity Domain.

Follow our Social Medias for Updates

https://www.instagram.com/wap.chennai
https://t.me/wapchennai
https://twitter.com/wapchennai
https://www.facebook.com/wapchennai
https://www.linkedin.com/company/chennai-wap

Transcript

1. Know How Webinar – EP-2 Binary Exploitation 101 We are Plymouths Chennai Chapter -SK.AJAY (Reverse Engineer and Exploit Developer of CTF Team SSOD)
2. Topics:-  What is Binary Exploitation?  Tools for analyzing Binary  Basic Linux User Land Exploit Mitigations  Bugs  Demo Time(Classical Simple Buffer Overflow)  Question Time
3. What is Binary Exploitation?  Binary exploitation is the topic concerning the finding and exploitation of vulnerabilities in low-level code, particularly machine level code. It is usually considered one of the more complex areas of IT security and some of the exploits produced sometimes chain together dozens of moving parts in mind-boggling ways to cause programs to behave in a completely unintended manner. The field is the basis of high-severity exploits such as OS privilege escalation, Sandbox Escape ,Remote Code Execution and browser exploits.
4. Tools for analyzing binaries  Disassemblers like IDA,binary ninja,hopper,ndisasm,Ghidra,etc..,  Debuggers like GDB,radare2,windbg,ollydbg,edb,etc.,  Decompilers like IDA’s Hex-Rays Decompiler,Ghidra’s Decompiler,etc..,  Program tracers like ltrace and strace.  Fuzzers like AFL,libfuzzer,etc..,
5. Disassemblers  A disassembler is a computer program that translates machine language into assembly language—the inverse operation to that of an assembler. ... Some disassemblers make use of the symbolic debugging information present in object files such as ELF.
6. Debuggers  The purpose of a debugger is to allow you to see what is going on "inside" another program while it executes -- or what another program was doing at the moment it crashed.  Start your program, specifying anything that might affect its behavior.  Make your program stop on specified conditions.  Examine what has happened, when your program has stopped.  Change things in your program, so you can experiment with it.
7. Decompilers  Decompilers do the impossible and reverse compiled code back into psuedocode/code.  Decompiling is essentially the reverse of compiling. That is - taking the object code (binary) and trying to recreate the source code from it.  Decompilation depends on artefacts being left in the object code which can be used to ascertain the structure of the source code.
8. Tracers  Tracing involves a specialized use of logging to record information about a program's execution.  ltrace is a library call tracer and it is primarily used to trace calls made by programs to library functions. It can also trace system calls and signals, like strace.  The ltrace and strace both uses ptrace system call to trace program execution.  The ptrace system call is incredibly powerful and can be used to trace system calls, overwrite memory in a running program, read registers in a running program, and more.
9. Fuzzers  A fuzzer is a program which injects automatically semi-random data into a program/stack and detect bugs.  The purpose of fuzzing relies on the assumption that there are bugs within every program, which are waiting to be discovered. Therefore, a systematic approach should find them sooner or later.  Fuzzing can add another point of view to classical software testing techniques (hand code review, debugging) because of it’s non-human approach. It doesn’t replace them, but is a reasonable complement.
10. Basic User Land Exploit Mitigations  ASLR(Address Space Layout Randomization)  NX(No-eXecute) or DEP(Data execution prevention)  Stack Canary or SSP(Stack smashing Protection)  PIE(Position Independent Executable)  RELRO(Relocation Read Only)
11. ASLR(Address Space Layout Randomiztion)  Address Space Layout Randomization (ASLR) is a memory-protection process for operating systems .  It helps to ensure that the memory addresses associated with running processes on systems are not predictable, thus flaws or vulnerabilities associated with these processes will be more difficult to exploit.  ASLR works considerably better on 64-bit systems, as these systems provide much greater entropy (randomization potential).  ASLR randomizes the location of stack,heap and shared libraries by changing its base address(For Windows and Mac it is per boot ASLR and for Linux it is per process).
12. ASLR on action
13. Bypass for ASLR  Address Leak can be performed using multiple ways to gain a one shot code execution by ret2plt in absence of PIE in binary,Format string leak,Out of bound read,Heap metadata(leaks heap addresses as well as shared libraries based on the bins.)  Bruteforce(Partial overwrite or full overwrite of Saved Instruction)If partial overwrite is possible instead of full overwrite it is better to perform partial overwrite as the number of tries to get code execution gets reduced.Due to the number of bits 32 bit bruteforce is easy compared to 64 bit.
14. NX(No-eXecute) or Data Execution Prevention  The No eXecute or the NX bit (also known as Data Execution Prevention or DEP) marks certain areas of the program as not executable, meaning that stored input or data cannot be executed as code. This is significant because it prevents attackers from being able to jump to custom shellcode that they've stored on the stack or in a global variable.  In short NX makes the memory regions only available to write or execute but not both which denies the attacker to jump to his shellcode(his own crafted special instructions) to get shell.
15. Bypass for NX  Creating a Return Oriented Programming chain(ROPchain) to perform a ret2libc in dynamically linked binaries.  Perform a ret2libc attack to call mmap or mprotect on the memory region to make it executable and finally execute the shellcode present in that executable memory region.  Make a shellcode ROPchain using ROP in statically linked libraries.
16. Stack Canary or Stack Smashing Protector(SSP)  Stack Canaries are a secret value placed on the stack which changes every time the program is started. Prior to a function return, the stack canary is checked and if it appears to be modified, the program exits immeadiately.  There are three types of canaries in use: terminator, random, and random XOR.
17. Stack canary in action
18. Code changes with and without Stack canary
19. Bypass to Stack Canary  One of the best exploit mitigation to Stack Buffer overflow till date.If the process is a forked process which has the overflow bug with read to get user input we can use a one byte bruteforce to get the canary as the canary will not change.  Format string bug to leak Stack Canary.  If Write What Where is available stack canary is bypassed as we can use it to overwrite only on the return address while the stack canary is remain undisturbed.
20. PIE(Position Independent Executable)  PIE is an address space randomization technique that compiles & links executables to be position independent, i.e. machine instruction code that executes properly regardless of where in memory it actually resides. When combined with a kernel that can recognize it is loading a PIE binary, the kernel loads it into a random address instead of the traditional fixed address locations.
21. PIE on action
22. Bypass for PIE  PIE mitigates the weakness of ASLR which suffers from return to .plt attack. PIE with ASLR is a deadly combination as all the memory regions of the process is randomized. Partial overwrite of Saved Return address is one of the key to defeat PIE.  Format string to leak memory address to defeat PIE.  And finally it is the bruteforce but for 64 bit binary it is practically near to impossible and for 32 bit it is comparatively easier than 64 bit.
23. RELRO(Relocation Read Only)  Relocation Read-Only (or RELRO) is a security measure which makes some binary sections read-only.  There are three RELRO "modes": No ,Partial and Full.  No RELRO  Every relocation entries in binary is writable.  Partial RELRO  Partial RELRO is the default setting in GCC, and nearly all binaries you will see have at least partial RELRO.  From an attackers point-of-view, partial RELRO makes almost no difference from No RELRO, other than it forces the GOT to come before the BSS in memory, eliminating the risk of a buffer overflows on a global variable overwriting GOT entries and also it makes fini_array as read - only.  Full RELRO  Full RELRO makes the entire GOT read-only which removes the ability to perform a "GOT overwrite" attack.
24. Common Bugs  Buffer Overflow  Format String  Use after free  Double Free
25. Buffer Overflow  A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an array of integers. Writing outside the bounds of a block of allocated memory can corrupt data, crash the program, or cause the execution of malicious code.  One of the best and old articles for studying buffer overflow in stack is phrack article ”Smashing the stack for fun and profit”  http://phrack.org/issues/49/14.html
26. Format String  The Format String exploit occurs when the submitted data of an input string is evaluated as a command by the application. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application, causing new behaviors that could compromise the security or the stability of the system.  The attack could be executed when the application doesn’t properly validate the submitted input. In this case, if a Format String parameter, like %x, is inserted into the posted data, the string is parsed by the Format Function, and the conversion specified in the parameters is executed. However, the Format Function is expecting more arguments as input, and if these arguments are not supplied, the function could read or write the stack.
27. Use after free  The use of heap allocated memory after it has been freed or deleted leads to undefined system behavior and, in many cases, to a write-what-where condition.  Use after free errors occur when a program continues to use a pointer after it has been freed
28. Double Free  Double free errors occur when free() is called more than once with the same memory address as an argument.  Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program’s memory management data structures become corrupted and could allow a malicious user to write values in arbitrary memory spaces. This corruption can cause the program to crash or, in some circumstances, alter the execution flow. By overwriting particular registers or memory spaces, an attacker can trick the program into executing code of their own choosing, often resulting in an interactive shell with elevated permissions.  When a buffer is free()‘d, a linked list of free buffers is read to rearrange and combine the chunks of free memory (to be able to allocate larger buffers in the future).
29. Demo Time  Let’s exploit a classic buffer overflow to yield a shell with ASLR and NX mitigations turned ON.
30. Questions Time
31. Reach me on:  Instagram:-Itz_me_strikerr  LinkedIn:-https://www.linkedin.com/in/ajay-sk-33ab591b0