1 / 18

Format strings

Format strings. Reporter : Nickle. Nickle@NSC. Agenda. Introduction Reading from arbitrary memory address Write to arbitrary memory address Direct parameter access Detours with dtors Overwriting the global offset table Conclusion. Introduction. Printf() function Format %d - decimal

honey
Télécharger la présentation

Format strings

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Format strings Reporter : Nickle Nickle@NSC

  2. Agenda • Introduction • Reading from arbitrary memory address • Write to arbitrary memory address • Direct parameter access • Detours with dtors • Overwriting the global offset table • Conclusion

  3. Introduction • Printf() function • Format • %d - decimal • %u - unsigned decimal • %x - hexadecimal • %s - string, start address of string • %n – number of bytes written so far

  4. Introduction (cont.) Low address EBP • printf(“blah %d %d %d %d”,a ,b ,c ,d); • Then, if d is missed? • %d will print the value of forth parameter position • EBP – OFFSET • The format-string vulnerability • printf(“%s”,string); • printf(string); Address of format string a b c d -4 * 4 High address

  5. Reading from arbitrary memory address • The format-string is processed one by one • Format parameter %s read the address and print out the content until it reach NULL byte • If we can control the address which %s read, we can get any content in whole memory • Demo code (fmt_vuln.c)

  6. Reading from arbitrary memory address • The input parameter • %s read the content which the address is in the beginning of format string ... Target address %x. %x. %x. %s offset

  7. Low address Reading from arbitrary memory address .... EBP SFP • The memory layout RET Address of format string .... buffer Local variable SFP RET .... High address

  8. Write to arbitrary memory address • Format parameter %n will write the number of byte written so far to the variable • printf(“blablabla %n”,variable); • demo cdoe (fmt_vuln)

  9. Write to arbitrary memory address • The input parameter • Control the written value (%βx) ... Target address %x. %x. %x. %n offset ... Target address %x. %x. %βx. %n offset

  10. Write to arbitrary memory address • Write the address into target

  11. Write to arbitrary memory address • Write once • Target address ... Target address %x. %βx. %n. %βx. %n. %βx. %n. %βx. %n 08049570 08049572 OFFSET 08049571 OFFSET 08049573 OFFSET 4 bytes 4 bytes 4 bytes

  12. Write to arbitrary memory address • Who to calculate the β? • E.g. 0x dd cc bb aa • Current target value is X • The last width of %x is Y • Calculate it • X – Y = Z • 0xaa – Z = β1 • 0xbb – 0xaa = β2 • 0xcc – 0xbb = β3 • 0xdd – 0xcc = β4 ... Target address %x. %β1x. %n. %β2x. %n. %β3x. %n. %β4 x. %n

  13. Write to arbitrary memory address • Simple way to calculate • Fmtbuilder - http://packetstormsecurity.org/papers/unix/fmtbuild.htm • Formulate • 0xbfbff26c (HOB => 0xbfbf, LOB => 0xf26c) • HOB < LOB • addr+2addr%.[HOB -8]x%[offset]$hn%.[LOB -HOB]x[offset+ 1]$hn • HOB > LOB • addr+2addr%.[LOB -8]x%[offset + 1]$hn%.[HOB -LOB]x[offset]$hn

  14. Direct parameter access • Format parameter • %N$x – the Nth parameter Target address %x. ... %βx. %n %βx. %n %βx. %n %βx. %n Target address %θ$βx. % θ$ n %θ$βx. % θ$ n %θ$βx. % θ$ n %θ$βx. % θ$ n

  15. Detours with dtors • .dtors and .ctors are made for destructors and constructors • .dtors section is writable • .dtors section is that it is included in all binaries compiled with the GNU C compiler • Dome code

  16. Overwriting the global offset table • Procedure linkage table (PLT) • Consist of many jump instructions • But the PLT is read-only • The address in PLT are not the address which they jump, but pointers to addresses • These memory addresses lie in another special section, called the global offset table (GOT) • It is writeable • Demo code

  17. Conclusion • Using the format function must be carefully • You can read/write from/to arbitrary memory address

  18. Reference • Hacking – the art of exploitation, Jon Erickson • Format String Vulnerability, Kudo

More Related