Upload File

reversing & malware analysis training part 10 - exploit development basics

  • Home
  • Technology
  • Reversing & Malware Analysis Training Part 10 - Exploit Development Basics
22
Practical Reversing V – Exploit Development Basics Harsimran Walia/Amit Malik www.SecurityXploded.com Reverse Engineering & Malware Analysis Training

Upload: securityxploded

Post on 18-Nov-2014

14.773 views

Category:

Technology


6 download

Report

Tags:

DESCRIPTION

This presentation is part of our Reverse Engineering & Malware Analysis Training program. For more details refer our Security Training page http://securityxploded.com/security-training.php

TRANSCRIPT

Page 1: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Practical Reversing V – Exploit Development Basics

Harsimran Walia/Amit Malik

www.SecurityXploded.com

Reverse Engineering & Malware Analysis Training

http://www.securityxploded.com/
Page 2: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Disclaimer

The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer’s only and nothing to do with the company or the organization in which the trainer is currently working.

However in no circumstances neither the trainer nor SecurityXploded is responsible for any damage or loss caused due to use or misuse of the information presented here.

www.SecurityXploded.com

Page 3: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Acknowledgement

Special thanks to null & Garage4Hackers community for their extended

support and cooperation.

Thanks to all the trainers who have devoted their precious time and

countless hours to make it happen.

www.SecurityXploded.com

Page 4: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Reversing & Malware Analysis Training

This presentation is part of our Reverse Engineering & Malware

Analysis Training program. Currently it is delivered only during our local

meet for FREE of cost.

For complete details of this course, visit our Security Training page.

www.SecurityXploded.com

http://securityxploded.com/security-training.php
Page 5: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Who am I #1

Harsimran Walia• Research Scientist @ McAfee

• Expertise: Malware Analysis, Exploit development and Vulnerability

Analysis

• Twitter: b44nz0r

• Email: [email protected]

www.SecurityXploded.com

Page 6: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Who am I #2

Amit Malik (sometimes DouBle_Zer0,DZZ)

Member SecurityXploded & Garage4Hackers

Security Researcher

RE, Exploit Analysis/Development, Malware Analysis

Email: [email protected]

www.SecurityXploded.com

Page 7: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Contents

What is an Exploit?

Classification of exploits

Exploitation Techniques

Direct EIP overwrite

SEH overwrite

www.SecurityXploded.com

Page 8: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Vulnerability

In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance.

Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw.

- Source: Wikipedia

www.SecurityXploded.com

Page 9: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Exploit

Piece of software/code that takes advantage of a vulnerability in order to cause unintended or unanticipated behaviour to occur on computer software, hardware [Wiki]

This frequently includes gaining control of a computer system orprivilege escalation ora denial-of-service attack.

Page 10: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Exploits can be in any form based on the software it exploits:

Software : exploitAdobe reader : pdf fileMicrosoft word : doc fileMicrosoft excel : xls fileInternet Explorer : Attacker hosted website or

html fileand so on..

Exploit (contd)

Page 11: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Classification

Based on the vulnerability they exploitBuffer Overflow, Memory Corruption, Use-After-Free

Local or RemoteLocal Privilege Escalation, Remote code execution

Result of running the exploit DoS, EoP etc

www.SecurityXploded.com

Page 12: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Stack Buffer Overflow

Occurs when a program writes to memory addresses on the stack outside of the allocated buffer

For exploiting a stack based buffer overflow is to overwrite the function return address with a pointer to attacker-controlled data (usually on the stack itself)

Page 13: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

A - Before data is copied. B - "hello" is the first command line argument.

C -A A A A A A A A A A A A A A A A A A A A \x08 \x35 \xC0 \x80" is the first command line argument.

Stack Buffer Overflow in Action

Page 14: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Direct EIP overwrite

Every Windows uses process memory that contains 3 major components :code segment (executable instructions).  The EIP keeps

track of the next instructiondata segment (variables, dynamic buffers)stack segment (used to pass data/arguments to functions,

and is used as space for variables)○The stack starts (= the bottom of the stack) from the very end of the virtual memory of a page and grows upwards (to a lower address). 

○PUSH adds something to the top of the stack, ○POP will remove one item (4 bytes) from the stack and puts it in a register.

Page 15: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

EIP Overwrite Demo

A vulnerability in “Shadow Stream Recorder version 3.0.1.7Buffer overflow when reading file (.asx)

Step -1 : Create a PoC to generate a crash in the software to verify the vuln

Step -2 : Find the offset to overwrite EIP

Step -3: Find an address of the “jmp esp” instruction

Step -4: Generate a shellcode and append it to the exploit code

Step -5: Putting it all together

Page 16: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

DEMO - EIP

http://www.youtube.com/watch?v=erl_Aee8oDg

www.SecurityXploded.com

http://www.youtube.com/watch?v=erl_Aee8oDg
http://www.youtube.com/watch?v=erl_Aee8oDg
Page 17: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

SEH Overwrite Exception?

An event which disrupts normal execution flow of code and requires execution outside normal flow

Software Exception –Generated by program (e.g Invalid file handle)

Hardware Exception – Access invalid memory, divide by zero etc SEH (structured exception handler)

Patented by Borland and licensed to Microsoft Software’s method of dispatching and handling exceptions Can handle both software and hardware exceptions For eg try{ } ; except { }; block Whenever an exception happens control is passed on to the OS,

which in turn locate and pass the control to the handler chain

Page 18: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Pointer to next SEH

Pointer to excep. handlers

Exception Registration Record

8 bytes ProcessThread

Information Block

Fs[0] – Exception

Registration

FFFFFFFF

OS Handler

Default ERR

SEH Overwrite in Action

Page 19: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

SEH Overwrite Demo

A vulnerability in “MM Player 2.2Buffer overflow when reading file (.ppl)

Step -1 : Create a PoC to generate a crash in the software to verify the vuln

Step -2 : Find the offset to overwrite nSEH + SEHandler

Step -3: Find an address of the command sequence “pop pop ret ”

Step -4: Generate a shellcode and append it to the exploit code

Step -5: Putting it all together

Page 20: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

SEH Overwrite Demo

http://www.youtube.com/watch?v=njQ47H7jO4s&feature=youtu.be

www.SecurityXploded.com

http://www.youtube.com/watch?v=njQ47H7jO4s&feature=youtu.be
http://www.youtube.com/watch?v=njQ47H7jO4s&feature=youtu.be
Page 21: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Reference

Complete Reference Guide for Reversing & Malware Analys

is Training

www.SecurityXploded.com

http://securityxploded.com/malware-analysis-training-reference.php
http://securityxploded.com/malware-analysis-training-reference.php
Page 22: Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Thank You !

www.SecurityXploded.com

http://www.securityxploded.com/

Reversing malware analysis training part12 rootkitanalysis

Reversing & malware analysis training part 8 malware memory forensics

Fileless WannaMine Cryptojacking Malware Using NSA Exploit

Reversing & Malware Analysis Training Part 4 - Assembly Programming Basics

Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics

Amateur Malware Analysis - SecDSM...Amateur Malware Analysis Are you interested in reversing but don't know where to start? Think reversing is beyond your means? This talk will try

Angler Exploit Kit/Malware Seguridad informatica en Mexico

Reversing malware analysis training part2 introduction to windows internals

Reversing & malware analysis training part 7 unpacking upx

Reversing & malware analysis training part 4 assembly programming basics

Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]

Reversing malware analysis trainingpart9 advanced malware analysis

Reversing & malware analysis training part 2 introduction to windows internals

Reversing malware analysis training part5 reverse engineering tools basics

Reversing & malware analysis training part 11 exploit development advanced

Practical Reversing III – Malware Memory Forensics

Malware. 2 Inhoud Historisch overzicht Malware Soorten Malware (+ werking) Virus, Worm, Trojan, botnet Andere Terminologie Exploit, Payload, Zero-day

Reversing and decrypting communications of apt malware

© SERG Reverse Engineering (Reversing Malware) Reversing Malware [based on material from the textbook]

Reversing & malware analysis training part 12 rootkit analysis

Reversing & malware analysis training part 3 windows pe file format basics

Reversing malware analysis training part4 assembly programming basics

Reversing malware analysis training part3 windows pefile formatbasics

Reversing Android Malware - Hack In The Box Security ...conference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Mahmud Ab... · Reversing Android Malware ... - Spyeye’s’fake’security’tool

Reversing & malware analysis training part 10 exploit development basics

Practical Reversing IV – Advanced Malware Analysis

Practical Firmware Reversing and Exploit Development for ......Practical Firmware Reversing and Exploit Development for AVR-based Embedded Devices Alexander @dark_k3y Bolshev Boris

Reversing malware analysis training part7 unpackingupx

Practical Reversing V – Exploit Development B asics

Reversing malware analysis training part11 exploit development advanced

Reversing and Malware Analysis

Reversing Malware [based on material from the textbook]

Practical Reversing VI - Exploit Development [advanced]

Reversing malware analysis training part10 exploit development basics

Reversing malware analysis training part8 malware memory forensics