Downloaded 194 times
Uploaded byn|u - The Open Security Community
Return Oriented Programming (ROP) Based Exploits - Part I
The document discusses return-oriented programming (ROP) exploits, including methods for bypassing exploit mitigation technologies such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). It provides insights into constructing ROP chains using existing executable instructions and highlights strategies for discovering ROP gadgets. Additionally, it outlines necessary Windows API functions to manipulate memory protections to facilitate executing shellcode.
Return Oriented Programming (ROP) Based Exploits - Part I
- 2. Return Oriented Programming (ROP) Based Exploits - Part I
- 3. Exploit - ex·ploittouse selfishly for one's own ends
- 4. Exploit DiscoveryBig spacein computer security Exploits are discovered by Security Researchers and Hackers alikeZero day attacks are a result of newly created exploits or un-patched vulnerabilities
- 5. Exploit MitigationWindows XPSp2 was the first widespread OS to incorporate exploit mitigationProtected stack metadata (Visual studio compiler/ GS flag)Protected heap metadata (RtlHeap Safe Unlinking)SafeSEH (Compile time execution handler registration)Software, Hardware enforced Data Execution Prevention (DEP)Windows Vista implements Address Space Layout Randomization (ASLR)
- 6. Break the mitigationBlackHatPresentationsSecurity ForumsBlogs
- 7. Whose responsibility isit to mitigate ?Heap ProtectionSEH Chain validationDEPASLRStack CookiesSafe SEH
- 8. DEP -Data Execution PreventionWhen an attempt is made to execute code from a DEP protected data page,an access violation (STATUS_ACCESS_VIOLATION (0xc0000005)) will occur. In most cases, this will result in process termination (unhandled exception).
- 9. DEP -Data Execution PreventionWithout DEP OnWith DEP On
- 10. ProblemWith DEP on,code from the stack won’t work
- 11. Work-AroundWe need tobuild a chain of instructions. We need to jump from one part of the chain to the other part of the chain without ever executing a single bit from our DEP protected region. Or, to use a better term, we need to return from one instruction to the address of the next instructionEach instruction (series of instructions) in our chain will be called a "gadget". Each gadget will return to the next gadget ( = to the address of the next gadget, placed on the stack), or will call the next address directly.We will need to use existing instructions (instructions in executable areas within the process)and put them in such an order (and "chain" them together) so they would produce what we need and put data in registers and/or on the stack
- 12. LetterThe chocolate bombsyou sent, bombs they are in size . Received them, yesterday. Planted the rose plant, bomb was delicious … had to mention again. Set to go for shopping, 5 p.m. tomorrow. The chocolate bombs you sent, bombs they are in size . Received them, yesterday. Planted the rose plant, bomb was delicious … had to mention again. Set to go for shopping, 5 p.m. tomorrow. ThebombsReceivedyesterday PlantedbombSet5 p.m. tomorrow
- 13.
- 14. GadgetWe need totake a value from the stack, put it in EAX, and increase it with 0×80
- 15. GadgetWe need totake a value from the stack, put it in EAX, and increase it with 0×80-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- WindowsFunction_1()ADD EBX, 30TEST AL, ALPOP EAXRETPOP EAXRETADD EAX, 80POP EBXRET-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- WindowsFunction_2()INC EAXADD EAX, 80POP EBXRET-- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - -- -- - - - - - - - -- -- - - - - --- - - --
- 16. Gadget Stack addressStack value ESP points here -> 0010F730 10026D56 (pointer to POP EAX + RET) 0010F734 50505050 (this will be popped into EAX) 0010F738 1002DC24 (pointer to ADD EAX,80 + POP EBX + RET) 0010F73C DEADBEEF (this will be popped into EBX, padding)
- 17. Windows Function Callsto bypass DEPVirtualAlloc(MEM_COMMIT + PAGE_READWRITE_EXECUTE) + copy memory. This will allow you to create a new executable memory region, copy your shellcode to it, and execute itHeapCreate(HEAP_CREATE_ENABLE_EXECUTE) + HeapAlloc() + copy memory. SetProcessDEPPolicy()NtSetInformationProcess()VirtualProtect(PAGE_READ_WRITE_EXECUTE). This function will change the access protection level of a given memory page, allowing you to mark the location where your shellcode resides as executable.WriteProcessMemory()
- 18. Windows Function Callsto bypass DEPEach one of those functions requires the stack or registers to be set up in a specific way.when an API is called, it will assume that the parameters to the function are placed at the top of the stack (= at ESP)
- 19.
- 20. Finding ROP gadgetsThereare 2 approaches to finding gadgets that will help you building the ROP chain : You can specifically search for instructions and see if they are followed by a RET. The instructions between the one you are looking for, and the RET instruction (which will end the gadget) should not break the gadget. You can look for all RET instructions and then walk back, see if the previous instructions include the instruction you are looking for. pvefindaddr
- 21. First part ofthe ExploitTesting ROP with a Windows APIVirtualProtect()Demo
- 22. Now you cansleep
- 23.
- 24.