Copyrighted Material
Total Page：16
File Type：pdf, Size：1020Kb
80238bindex.qxd:WileyRed 7/11/07 7:42 AM Page 705 Index NUMERICS arrays, 12 0day, definition, 4 ASCII, converting to Unicode, 0day kernel vulnerabilities, Unix, 210–211 636–642 ASCII Venetian implementation, 214–217 A ASLR (Address Space Layout AAAS (ASCII Armored Address Randomization), 313, 396–399 Space), 394–395 asm( ) statements, 132 abusing frame-based exception assembler references, 430 handlers, 161–166 assembly language, 6 existing handlers, 162–164 C code constructs, 7–10 alphanumeric filters, exploits, C++ code constructs, 7–10 writing, 205–209 registers and, 6 application layer attacks, database asymmetry, problems, 511–512 software, 618–619 attack detection, bypassing arbitrary free vulnerabilities, 271 alternate encodings, 514 arbitrary size overflow, stack attack signatures, 517 overflows, COPYRIGHTED232–233 file-handling MATERIAL features, 515–517 architectural failures length limitations, 517–520 asymmetry and, 511–512 stripping bad data, 513–514 authentication and, 512 auditing binaries. See binary authorization and, 512 auditing boundaries and, 508–509 auditing source code data translation and, 509–511 automated analysis tools, 484 archives, paper, 438 705 80238bindex.qxd:WileyRed 7/11/07 7:42 AM Page 706 706 Index ■ A–C auditing source code (continued) B methodology binary auditing bottom-up approach, 485 C++ code constructs, 561 selective approach, 485–486 calling conventions, 554–555 top-down approach, 485 C calling convention, 555 tools Stdcall calling convention, 555 Cbrowser, 484 compiler-generated code Cscope, 482–483 for loops, 557–558 Ctags, 483 function layouts, 556 editors, 483 if statements, 556–557 vulnerabilities switch statements, 558–560 different-sized integer while loops, 557–558 conversions, 497–498 IDA Pro, 550–552 double free, 498 manual, 563–566 extinct bug classes, 487 memcpy-like code constructs, 560 format strings, 487–489 source code auditing, 550 generic logic errors, 486 stack frames, 552–553 incorrect bounds-checking, BP-based, 553, 554 489–490 frame pointer, 553–554 integer-related vulnerabilities, strlen-like code constructs, 560–561 495–497 this pointer, 561–562 loop constructs, 490 bit flipping, 469–470 multithreading and, 500–501 boundaries, problems, 518–509 non-null termination issues, 492 bounds-checking, 489–490 off-by-one, 490–492 bridge building, 206 out-of-scope memory usage, 499 BSD, OS X and, 314 signed comparison buffer overflows vulnerabilities, 494–495 exploiting, 197–202 skipping null-termination issues, heap-based, 173 493 exploiting, 178–194 uninitialized variable usage, stack-based, 156 499–500 buffers, 12–13 use after free vulnerabilities, arrays, 12 499–500 length, 95 authentication, problems, 512 overflowing on stack, 18–23 Authentication Tokens, 116 bug discovery, exploitation and, 6 authorization, problems, 512 automated source code analysis C tools, 484 C, code constructs, 7–10 C++, code constructs, 7–10 80238bindex.qxd:WileyRed 7/11/07 7:42 AM Page 707 Index ■ C–D 707 canaries, 166, 388–389 control registers, 7 Cbrowser, 484 cookies, 403 chained ret2code, 379 countermeasures, 601–602 Check Heaps, 359 brute forcing, 602–603 Cisco IOS, 339–340 information leaks, 605–606 crash dumps, 354–355 local exploits, 603 exploiting OS/application fingerprinting, heap overflows, 359–361 603–605 stack overflows, 357–359 preparation, 602 GDB agent, 355–356 cross-platform shellcode (OS X), hardware platforms, 340 332–333 images Cscope, 482–483 diffing, 350–351 Ctags, 483 taking apart, 349–350 partial attacks global variable overwrite, 363–364 D NVRAM invalidation, 362 data, instructions and, 4 reverse engineering, 348–356 data translation, problems, 509–511 runtime analysis, 351–356 database software ROMMON, 351–354 application layer attacks, 618–619 shellcode, bind shell, 370–372 network layer attacks, 608–618 shellcodes operating system commands configuration changing, 364–370 IBM DB2, 621–623 runtime image patching, 370 Oracle, 620–621 software packages, 340–343 SQL Server, 619–620 system architecture DB (define byte) directive, 56 IO memory, 346 DCE-RPC, 116 IOS heap, 344–346 DCE-RPC tools, 118 memory layout, 343–344 recon, 118–120 vulnerabilities, 346–347 SPIKE, 118–120 command-line interface, 348 DCOM (Distributed Component protocol parsing code, 347 Object), 111 security, 347–348 DCE-RPC and, 116–123 services, router, 347 exploitation, 120 class definitions, reconstructing debugging vtables, 562–563 debug trick, 433–434 configuration related shellcode, 599 OllyDbg, 112–114 continuation of execution, 441–442 unhandled exception filter and, 186 80238bindex.qxd:WileyRed 7/11/07 7:42 AM Page 708 708 Index ■ D–E debugging (continued) EIP (Extended Instruction Pointer), 7 Windows controlling, 22–23 kernel debugger, 124 ellipsis syntax, 84 Microsoft tool chain, 124 encryption, end-to-end, 299 OllyDbg, 124 end-to-end encryption, 299 SetDefaultExceptionHandler, 126 exception filter, unhandled, shellcode, writing, 125 overwrite pointer to, 185–191 SoftICE, 124 exception handlers TlsSetValue( ), 126 abusing existing, 162–164 VirtualProtect( ), 126 frame-based, 156–161 Win XP, 127 triggering, continuation and, 441 Win2K, 126 exception handling Win32, 124–125 signal( ) system call, 122 Win9X/ME, 126 vectored, 181 WinDbg, 124 Vectored Exception Handling, 123 Windows 2003 Server, 127 Win32 and, 122–123 Windows Vista, 127 Windows, searches and, 148–153 WinNT, 126 Exception Registration Record, 392 WSASocket( ), 126 EXCEPTION_REGISTRATION decoder, Unicode, 218–221 structure, 156 delay slot, SPARC, 227 execution device drivers, 683 continuation of, 441–442 I/O control code components, controlling for exploitation, 75–84 693–694 execve function, 54 IOCTL handlers, 694–695 execve syscal, 52 directives, DB (define byte), 56 exit( ) syscall, shellcode for, 44–48 dlmalloc, 89 exploitation DOS attacks, 521 Cisco IOS double free vulnerabilities, 270, 498 heap overflows, 359–361 dynamic analysis, fuzzing and, 470 stack overflows, 357–359 dynamic heaps, 173 execution, controlling, 75–84 dynamic linking heaps, OS X, 333–335 single stepping dynamic linker, overruns, SQL level, SQL 281–296 functions, 623–625 SPARC ABI, 279 Solaris/SPARC, methodology, dynamic string table, 280 263–270 stack overflows, 236–241 E exploits EAX register, 177 countermeasures, 601–606 EBP register, 15 definition, 4 editors, source code, 483 one-factor, 598 EFLAGS (Extended Flags), 7 planning, 439 80238bindex.qxd:WileyRed 7/11/07 7:42 AM Page 709 Index ■ E–G 709 exploits (continued) format strings, 61–63, 487–489 root privileges and, 25–35 bugs, 63–67 stabilization and, 442–443 reasons for, 84–85 writing exploits, 68–69 alphanumeric filters, 205–209 crashing services, 69–70 Unicode filters, 209–211 information leakage, 70–75 Extended Flags (EFLAGS), 7 techniques, 85–88 extended stack pointer (ESP) frame pointers, 15 register, 6 frame-based exception handlers, extinct bug classes, 487 156–161 extproc overflow, 504–508 abusing, 161–166 existing, 162–164 F fstat (BSD), 435 fault injection, 445–446 functions design, 447–456 execve, 54 fault delivery, 455 HeapAllocate( ), 173 fuzzing and, 461 KiUserExceptionDispatcher, 161 heuristics, 455–456 MyExceptionHandler, 158 input generation, 447–448 printf, 63–64 automated, 449 RtlImageNtheader, 161 fuzz generation, 449–450 stack and, 15–18 live capture, 449 fuzzers, 433 manual, 448 bit flipping, 469–470 modification engines, 450–451 Blackhat, 480 delimiting logic, 451–453 CHAM, 480 input sanitization, 453–454 definition, 4 Nagel algorithm, 455 Hailstorm, 480 state-based protocols, 456 open source, modifying, 470 stateless protocols, 456 weaknesses in, 468 timing, 455–456 fuzzing, 99 fault monitoring, 456–457 dynamic analysis and, 470 debuggers and, 457 fault injection and, 461 FaultMon, 457–458 introduction, 461–465 fault testing, 446 scalability, 466–467 FIFO (first in first out), 5 sharefuzz, 462 filters static analysis versus, 466 alphanumeric, exploits, writing, 205–209 G Unicode, exploits, writing, 209–211 gcc (GNU Compiler Collection), 430 Windows, 129–130 gdb (GNU Debugger), 430–431 foo( ) function, strcpy( ) call, 176 general-purpose registers, 6 generic logic errors, 486 80238bindex.qxd:WileyRed 7/11/07 7:42 AM Page 710 710 Index ■ G–I GetSystemTimeAsFileTime, 167 HeapAllocate( ), 115 global registers, SPARC, 225 HeapCreate( ), 114 GOT (Global Offset Table), 279 initialization, 5 GPG 1.2.2 randomness patch, 583 introduction, 90 malloc( ), 91 overview, 91 H process heap, 173–177 hardware, Cisco IOS, 340 realloc( ), 91 heap overflows, 91 repairing, 191–193 advanced exploitation, 105–107 RtlHeapAllocate( ), 115 breakpoints, 96 RtlHeapFree( ), 115 buffer length, 95 strcpy( ), 176 Cisco IOS, 359–361 threading and, 115–116 partial attacks, 362–364 host IDS related shellcode, 599 dlmalloc, 96 example, 271–276 intermediate, 98–105 I limitations, Solaris, 266–267 IBM DB2, operating system ltrace output, 93 commands, 619–620 malloc, 95 IDA Pro, 550–552 Microsoft IIS, 92 ideal stack layout, 389–394 repairing, 179 impersonation, tokens and, 120–122 samba, 92 incorrect bounds-checking, 489–490 Solaris, 92 input validation, bypassing SPARC, 296–299 alternate encodings, 514 heap protections, 399–407 attack signatures, evading, 517 heap-based buffer overflows, 173 file-handling features, 515–517 COM objects and, 193–194 length limitations, 517–520 exploiting, 178–194 stripping bad data, 513–514 logic program control data, 194 Instruction Pointer, 7 Solaris/SPARC, 241–263 instructions, data and, 4 HeapAlloc, 177 integer-related vulnerabilities, HeapAllocate( ) function, 173 495–497