Embed Size (px)
Citation preview
Memory protectionsGlibc and GCC security patches
Conclusion
Defeat userland exploits on Linux
Arnaud Maillet ([email protected])
SecurIMAG - the Ensimag IT security clubENSIMAG - Computer Science and Mathematics
Grenoble INP University
SecurIMAG talks, September 2011
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Outline
1 Memory protectionsNon-eXecutable MemoryFull RELROPIE
2 Glibc and GCC security patchesCanaryFortify sourceHeap protector
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Outline
1 Memory protectionsNon-eXecutable MemoryFull RELROPIE
2 Glibc and GCC security patchesCanaryFortify sourceHeap protector
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Non-eXecutable Memory
Reminder : Stack Overflow
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Non-eXecutable Memory
Stack Overflow basic exploitation technics, firstly introduced byAleph1 in 1996 ( Smashing the stack for fun and profit )
Shellcode on the stack ( environment variables, stackbuffer )
Shellcode on the heap
Shellcode everywhere
Prerequisites : these sections should be eXecutable!
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Non-eXecutable Memory
Most modern CPUs protect against executing non-executablememory regions (heap, stack, etc).
Hardware-based (via PAE mode) :
Partial Emulation (via segment limits):
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Non-eXecutable Memory
Non-Executable Memory and recent kernel :
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Non-eXecutable Memory
Example : 19-another-smallbug PCTF ( IDA Pseudo-code )
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Non-eXecutable Memory
ROP : mmap an rwx area, copy a shellcode and jump ( StalkR’sexploit )
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Outline
1 Memory protectionsNon-eXecutable MemoryFull RELROPIE
2 Glibc and GCC security patchesCanaryFortify sourceHeap protector
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Full RELRO
Full RELRO is a generic mitigation technique to avoidGOT-overwrite-style memory corruption attacks.
compiler command line: gcc -Wl,-z,relro,-z,now
the entire Global Offset Table is (re)mapped as read-only
avoid format string and 4-byte write attacks
With partial RELRO, the GOT is not read-only.
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Full RELRO
Reminder: understand the Global Offset Table with an example
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Full RELRO
Display the GOT of our program :
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Full RELRO
Full RELRO running processes on Ubuntu Maverick 10.10:
No RELRO : 1 processusPartial RELRO : 91 processusFull RELRO : 20 processus
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Full RELRO
Full RELRO running processes on Fedora 15:
No RELRO : 49 processusPartial RELRO : 6 processusFull RELRO : 9 processus
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Full RELRO
Full RELRO running processes on Debian GNU/Linux 6.0Squeeze:
No RELRO : 13 processusPartial RELRO : 0 processusFull RELRO : 6 processus
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Full RELRO
Training : GOT-overwrite-style memory corruption attacks
Ivanlef0u’s challenge AMENRAChallenge 6 : format string / no ASLR / stack +x / partialRELRO
Challenge 7 : format string / partial ASLR / stack +x /partial RELRO
Challenge 8 : format string / partial ASLR / stack -x / partialRELRO
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
Outline
1 Memory protectionsNon-eXecutable MemoryFull RELROPIE
2 Glibc and GCC security patchesCanaryFortify sourceHeap protector
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
PIE
Position Independent Executables :
gcc command line : -pie
protects against ”return-to-text” ( ROP )
large (5-10%) performance penalty
often used for a select number of security-critical packages( openssh, apache, bind9, openldap, postfix, cup,postgresql, samba, dhcp3, squid ... )
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Non-eXecutable MemoryFull RELROPIE
PIE
In real life :
Ubuntu Desktop 10.10: 23% of running processes arecompiled with PIE
Fedora 15 : 50% of running processes are compiled withPIE
Debian Squeeze (6.0) : 35% of running processes arecompiled with PIE
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Outline
1 Memory protectionsNon-eXecutable MemoryFull RELROPIE
2 Glibc and GCC security patchesCanaryFortify sourceHeap protector
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Canary
Firstly introduced in Stack-Smashing Protector (SSP)
GCC patch, command line : -fstack-protector-all
reordering of local variables to place buffers after pointersto avoid the corruption of pointers
random canary to prevent EIP overwrite
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Canary
Stack-Smashing Protector (SSP)
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Canary
Assembly Canary Code
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Canary
Exploiting canaries remotely in network daemon ( AdamZabrocki aka pi3 ) :
Childs and the mother share the same canary.
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Canary
In this configuration it’s possible to find the canary with lessthan 1024 tests :
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Canary
A stupid brute force would lead to 232 combinations(4294967296 combinations) :
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Canary
In real life :
Ubuntu Desktop 10.10: 75% of running processes have acanary
Ubuntu Server 10.04: 85% of running processes have acanary
Fedora 15 : 95% of running processes have a canary
Debian Squeeze (6.0) : 20% of running processes have acanary
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Outline
1 Memory protectionsNon-eXecutable MemoryFull RELROPIE
2 Glibc and GCC security patchesCanaryFortify sourceHeap protector
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Build your programs with ”-D FORTIFY SOURCE=2”
expand unbounded calls to ”sprintf”, ”strcpy” into their ”n”length-limited cousins.stop format string ”%n” attacks when the format string is ina writable memory segment.require checking various important function return codesand arguments (e.g. system, write, open).require explicit file mask when creating new files.
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Bypass FORTIFY SOURCE using Format strings
Captain Planet - A Eulogy of Format strings
Uncommon format string : ”%49150u %4849$hn%1$*269158540$x %1$*13996$x %1073741824$d”4-byte NULL write to disable FORTIFY SOURCE :
args type[ ATTACKER OFFSET ] = 0x00000000;
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Memory leak in FORTIFY SOURCE
Dan Rosenberg - Fun with FORTIFY SOURCE
An overflow attempt can engender a sensitive memory leak.
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Memory leak in FORTIFY SOURCE
A crafted argv[0] is used to read the application’s addressspace
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
FORTIFY SOURCE in Linux
Integration of FORTIFY SOURCE :
Ubuntu :
Debian Lenny ( 2009 ) - Several security-critical packagesFedora 8 ( 2007 ) - The author of this feature is a redhatdeveloper
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Outline
1 Memory protectionsNon-eXecutable MemoryFull RELROPIE
2 Glibc and GCC security patchesCanaryFortify sourceHeap protector
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Glibc security checks
Since glibc 2.3.4, ptmalloc2/3 provides different securitychecks:
The ”unlink” patch :
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Glibc security checks
The House of Lore patch:
Technics introduced by blackngel require considerable efforts
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
CanaryFortify sourceHeap protector
Protect your heap from heap overflow.
Allocator security designed :
Jemalloc on FreeBSD
Guard Malloc for Mac OS X
DistriNet memory allocator
OpenBSD malloc
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Memory protectionsGlibc and GCC security patches
Conclusion
Conclusion
Today, userland exploitation on Linux has become much moredifficult than 15 years ago.
That’s why, concepts like ret2libc, ROP, GOT-overwrite-stylememory corruption attacks have been developed.
Under certain conditions it is possible to bypass one or twoprotection(s), but it becomes almost impossible with all theprotections.
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Appendix Bibliography
Bibliography I
Aleph. OneSmashing the stack for fun and profitPhrack #49 http://www.phrack.org
blackngel.Malloc Des-MaleficarumPhrack #66 http://www.phrack.org
blackngel.The House Of Lore Reloaded ptmalloc v2 & v3: Analysis &CorruptionPhrack #67 http://www.phrack.org
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Appendix Bibliography
Bibliography II
Adam. ZabrockiScraps of notes on remote stack overflow exploitationPhrack #67 http://www.phrack.org
Wolfram. Gloger.ptmalloc2 & ptmalloc3 homepage.http://www.malloc.de/en/
Yves. Younan.dnmalloc homepage.http://www.fort-knox.org/taxonomy/term/3
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Appendix Bibliography
Bibliography III
Jakub. Jelinek.Fortify Source patch.http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
Captain. Planet.A eulogy of format stringPhrack #67 http://www.phrack.org
Dan. Rosenberg.Fun with FORTIFY SOURCEhttp://drosenbe.blogspot.com/2010/04/fun-with-fortifysource.html
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Appendix Bibliography
Bibliography IV
Canonical. Ubuntu.Ubuntu Security Featureshttps://wiki.ubuntu.com/Security/Features
Debian. Security DevelopersDebian Hardeninghttp://wiki.debian.org/Hardening
Fedora. Security DevelopersFedora Security Featureshttp://fedoraproject.org/wiki/Security/Features
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Appendix Bibliography
Bibliography V
Checksec. Trapkitchecksec.shhttp://tk-blog.blogspot.com/2009/02/checksec.html
blog. StalkR19 - Another small bug - PCTFhttp://blog.stalkr.net/2011/04/pctf-2011-19-another-small-bug.html
Emilien. GiraultComprendre le role des sections PLT et GOT dans l’editionde liens dynamiquehttp://www.segmentationfault.fr/linux/role-plt-got-ld-so/
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
Appendix Bibliography
Bibliography VI
Relro. TrapkitRELRO - A (not so well known) Memory CorruptionMitigation Techniquehttp://tk-blog.blogspot.com/2009/02/relro-not-so-well-known-memory.html
blog. xorlLinux GLibC Stack Canary Valueshttp://xorl.wordpress.com/2010/10/14/linux-glibc-stack-canary-values/
Arnaud Maillet SecurIMAG - Defeat userland exploits on Linux
