Phrack Heap Hacking
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
The Javascript Revolution
Top teams present at Segfault Tank on 4/21: 1 Duel: 6 (2 extra shifted from self votes) 2 Ambassador: 4 3 QuickSource: 3 4 ChalkBoard: 3 5 Fortuna Beer: 3 Bottom teams present in class this Thursday 4/16: 1 Scribble: 2 2 ClearViz: 2 3 AllInOne: 1 4 TripSplitter: 0 Shockers: Scribble & Fortuna Congrats on sneaky strategizing to get yourself to the top :) The moment of fruit: the class has spoken Shockers: Scribble & Fortuna Congrats on sneaky strategizing to get yourself to the top :) The moment of fruit: the class has spoken Top teams present at Segfault Tank on 4/21: 1 Duel: 6 (2 extra shifted from self votes) 2 Ambassador: 4 3 QuickSource: 3 4 ChalkBoard: 3 5 Fortuna Beer: 3 Bottom teams present in class this Thursday 4/16: 1 Scribble: 2 2 ClearViz: 2 3 AllInOne: 1 4 TripSplitter: 0 Congrats on sneaky strategizing to get yourself to the top :) The moment of fruit: the class has spoken Top teams present at Segfault Tank on 4/21: 1 Duel: 6 (2 extra shifted from self votes) 2 Ambassador: 4 3 QuickSource: 3 4 ChalkBoard: 3 5 Fortuna Beer: 3 Bottom teams present in class this Thursday 4/16: 1 Scribble: 2 2 ClearViz: 2 3 AllInOne: 1 4 TripSplitter: 0 Shockers: Scribble & Fortuna The moment of fruit: the class has spoken Top teams present at Segfault Tank on 4/21: 1 Duel: 6 (2 extra shifted from self votes) 2 Ambassador: 4 3 QuickSource: 3 4 ChalkBoard: 3 5 Fortuna Beer: 3 Bottom teams present in class this Thursday 4/16: 1 Scribble: 2 2 ClearViz: 2 3 AllInOne: 1 4 TripSplitter: 0 Shockers: Scribble & Fortuna Congrats on sneaky strategizing -
Technical Intelligence ISSUE: 19.04.21
Technical Intelligence ISSUE: 19.04.21 The CyberScotland Technical Threat Intelligence Bulletin is designed to provide you with information about updates, exploits and countermeasures. We hope that you benefit from this resource and we ask that you circulate this information to your networks, adapting where you see fit. Jump To TECHNICAL THREAT AWARENESS AND HUNTING Microsoft Patch Tuesday (April 2021) Adobe Patches Slew of Critical Security Bugs Patch Chrome to Remediated In-The-Wild 0-Day Exploits F5 urges customers to patch critical BIG-IP pre-auth RCE bug Wordpress Privilege-Escalation and Authentication Bypass Apple rushes to patch zero‑day flaw in iOS, iPadOS Cisco Will Not Patch Critical RCE Flaw Affecting End-of-Life Business Routers Threat Intelligence Bulletin Technical Threat Awareness and Hunting Microsoft Patch Tuesday (April 2021) Microsoft released its monthly security update Tuesday 13th April 2021, disclosing 114 vulnerabilities across its suite of products1. Four new remote code execution vulnerabilities in Microsoft Exchange Server are included, beyond those that were release out-of-band last month. The detection of the vulnerabilities which led to these patches has been attributed to the US’s National Security Agency (NSA)2. Given the recent focus on Microsoft Exchange by varying threat actors, NCSC has produced an alert encouraging organisations to install the critical updates immediately3. More patches are likely to follow for Microsoft’s Exchange servers as, at a recent hacking contest called pwn2own a team called DEVCORE combined an authentication bypass and a local privilege escalation to complete take over the Exchange server. As a result they won $200,000.4 In all, there are 20 critical vulnerabilities as part of this release and one considered of “moderate” severity. -
HTTP Cookie - Wikipedia, the Free Encyclopedia 14/05/2014
HTTP cookie - Wikipedia, the free encyclopedia 14/05/2014 Create account Log in Article Talk Read Edit View history Search HTTP cookie From Wikipedia, the free encyclopedia Navigation A cookie, also known as an HTTP cookie, web cookie, or browser HTTP Main page cookie, is a small piece of data sent from a website and stored in a Persistence · Compression · HTTPS · Contents user's web browser while the user is browsing that website. Every time Request methods Featured content the user loads the website, the browser sends the cookie back to the OPTIONS · GET · HEAD · POST · PUT · Current events server to notify the website of the user's previous activity.[1] Cookies DELETE · TRACE · CONNECT · PATCH · Random article Donate to Wikipedia were designed to be a reliable mechanism for websites to remember Header fields Wikimedia Shop stateful information (such as items in a shopping cart) or to record the Cookie · ETag · Location · HTTP referer · DNT user's browsing activity (including clicking particular buttons, logging in, · X-Forwarded-For · Interaction or recording which pages were visited by the user as far back as months Status codes or years ago). 301 Moved Permanently · 302 Found · Help 303 See Other · 403 Forbidden · About Wikipedia Although cookies cannot carry viruses, and cannot install malware on 404 Not Found · [2] Community portal the host computer, tracking cookies and especially third-party v · t · e · Recent changes tracking cookies are commonly used as ways to compile long-term Contact page records of individuals' browsing histories—a potential privacy concern that prompted European[3] and U.S. -
Testing Database Engines Via Pivoted Query Synthesis Manuel Rigger and Zhendong Su, ETH Zurich
Testing Database Engines via Pivoted Query Synthesis Manuel Rigger and Zhendong Su, ETH Zurich https://www.usenix.org/conference/osdi20/presentation/rigger This paper is included in the Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation November 4–6, 2020 978-1-939133-19-9 Open access to the Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation is sponsored by USENIX Testing Database Engines via Pivoted Query Synthesis Manuel Rigger Zhendong Su Department of Computer Science, ETH Zurich Abstract query on multiple DBMSs, which the author implemented in a tool RAGS [46]. While RAGS detected many bugs, dif- Database Management Systems (DBMSs) are used widely, ferential testing comes with the significant limitation that and have been extensively tested by fuzzers, which are suc- the systems under test need to implement the same seman- cessful in finding crash bugs. However, approaches to finding tics for a given input. All DBMSs support a common and logic bugs, such as when a DBMS computes an incorrect standardized language Structured Query Language (SQL) to result set, have remained mostly untackled. To this end, we create, access, and modify data [8]. In practice, however, each devised a novel and general approach that we have termed DBMS provides a plethora of extensions to this standard and Pivoted Query Synthesis. The core idea of this approach is to deviates from it in other parts (e.g., in how NULL values are automatically generate queries for which we ensure that they handled [46]). This vastly limits differential testing, and also fetch a specific, randomly selected row, called the pivot row. -
$Hell on Earth: from Browser to System Compromise
$hell on Earth: From Browser to System Compromise Matt Molinyawe, Abdul-Aziz Hariri, and Jasiel Spelman A Zero Day Initiative Research Paper TREND MICRO LEGAL DISCLAIMER The information provided herein is for general information Contents and educational purposes only. It is not intended and should not be construed to constitute legal advice. The information contained herein may not be applicable to all situations and may not reflect the most current situation. 3 Nothing contained herein should be relied on or acted upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing Introduction herein should be construed otherwise. Trend Micro reserves the right to modify the contents of this document at any time without prior notice. Translations of any material into other languages are 4 intended solely as a convenience. Translation accuracy is not guaranteed nor implied. If any questions arise related to the accuracy of a translation, please refer to Mitigation Evolution the original language official version of the document. Any discrepancies or differences created in the translation are not binding and have no legal effect for compliance or enforcement purposes. 6 Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro History and Anatomy makes no warranties or representations of any kind as to its accuracy, currency, or completeness. You agree of Pwn2Own Remote that access to and use of and reliance on this document and the content thereof is at your own risk. Trend Micro Browser to Super-User disclaims all warranties of any kind, express or implied. -
A Buffer Overflow Study
A Bu®er Overflow Study Attacks & Defenses Pierre-Alain FAYOLLE, Vincent GLAUME ENSEIRB Networks and Distributed Systems 2002 Contents I Introduction to Bu®er Overflows 5 1 Generalities 6 1.1 Process memory . 6 1.1.1 Global organization . 6 1.1.2 Function calls . 8 1.2 Bu®ers, and how vulnerable they may be . 10 2 Stack overflows 12 2.1 Principle . 12 2.2 Illustration . 12 2.2.1 Basic example . 13 2.2.2 Attack via environment variables . 14 2.2.3 Attack using gets . 16 3 Heap overflows 18 3.1 Terminology . 18 3.1.1 Unix . 18 3.1.2 Windows . 18 3.2 Motivations and Overview . 18 3.3 Overwriting pointers . 19 3.3.1 Di±culties . 20 3.3.2 Interest of the attack . 20 3.3.3 Practical study . 20 3.4 Overwriting function pointers . 24 3.4.1 Pointer to function: short reminder . 24 3.4.2 Principle . 24 3.4.3 Example . 25 3.5 Trespassing the heap with C + + . 28 3.5.1 C++ Background . 28 3.5.2 Overwriting the VPTR . 31 3.5.3 Conclusions . 32 3.6 Exploiting the malloc library . 33 3.6.1 DLMALLOC: structure . 33 3.6.2 Corruption of DLMALLOC: principle . 34 II Protection solutions 37 4 Introduction 38 1 5 How does Libsafe work? 39 5.1 Presentation . 39 5.2 Why are the functions of the libC unsafe ? . 39 5.3 What does libsafe provide ? . 40 6 The Grsecurity Kernel patch 41 6.1 Open Wall: non-executable stack . -
Apple Safari – PWN2OWN Desktop Exploit
Apple Safari – PWN2OWN Desktop Exploit 2018-10-29 (Fabian Beterke, Georgi Geshev, Alex Plaskett) Contents Contents ........................................................................................................ 1 1. Introduction ............................................................................................... 2 2. Browser Vulnerability Details ...................................................................... 3 3. Browser Exploitation ................................................................................ 11 3.1 Memory Layout and Trigger Objects ................................................................... 11 3.2 Heap RefPtr Information Leak ............................................................................. 12 3.3 Arbitrary Decrement Primitive ............................................................................. 13 3.4 Read Primitive ..................................................................................................... 13 3.5 JIT Page Location ................................................................................................ 17 3.6 Shell Code Execution .......................................................................................... 18 4. Dock Vulnerability Details ........................................................................ 20 5. Dock Exploitation ..................................................................................... 25 6. Appendix ................................................................................................ -
Chapter 10 Buffer Overflow Buffer Overflow
Chapter 10 Buffer Overflow Buffer Overflow ● Common attack mechanism ○ first wide use by the Morris Worm in 1988 ● Prevention techniques known ○ NX bit, stack canaries, ASLR ● Still of major concern ○ Recent examples: Shellshock, Hearthbleed Buffer Overflow/Buffer Overrun Definition: A condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information. Attackers exploit such a condition to crash a system or to insert specially crafted code that allows them to gain control of the system. Buffer Overflow Basics ● Programming error when a process attempts to store data beyond the limits of a fixed-sized buffer ● Overwrites adjacent memory locations ○ locations may hold other program variables, parameters, or program control flow data ○ buffer could be located on the stack, in the heap, or in the data section of the process ● Consequences: ○ corruption of program data ○ unexpected transfer of control ○ memory access violations Basic Buffer Overflow Example Basic Buffer Overflow Stack Values Buffer Overflow Attacks Attacker needs: ● To identify a buffer overflow vulnerability in some program that can be triggered using externally sourced data under the attacker’s control ● To understand how that buffer is stored in memory and determine potential for corruption Identifying vulnerable programs can be done by: ● inspection of program source ● tracing the execution of programs as they process oversized input ● using tools such as fuzzing to automatically identify -
Towards Efficient Heap Overflow Discovery
Towards Efficient Heap Overflow Discovery Xiangkun Jia, TCA/SKLCS, Institute of Software, Chinese Academy of Sciences; Chao Zhang, Institute for Network Science and Cyberspace, Tsinghua University; Purui Su, Yi Yang, Huafeng Huang, and Dengguo Feng, TCA/SKLCS, Institute of Software, Chinese Academy of Sciences https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/jia This paper is included in the Proceedings of the 26th USENIX Security Symposium August 16–18, 2017 • Vancouver, BC, Canada ISBN 978-1-931971-40-9 Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIX Towards Efficient Heap Overflow Discovery Xiangkun Jia1;3, Chao Zhang2 , Purui Su1;3 , Yi Yang1, Huafeng Huang1, Dengguo Feng1 1TCA/SKLCS, Institute of Software, Chinese Academy of Sciences 2Institute for Network Science and Cyberspace 3University of Chinese Academy of Sciences Tsinghua University {jiaxiangkun, yangyi, huanghuafeng, feng}@tca.iscas.ac.cn [email protected] [email protected] Abstract to attack. As the heap layout is not deterministic, heap Heap overflow is a prevalent memory corruption vulner- overflow vulnerabilities are in general harder to exploit ability, playing an important role in recent attacks. Find- than stack corruption vulnerabilities. But attackers could ing such vulnerabilities in applications is thus critical for utilize techniques like heap spray [16] and heap feng- security. Many state-of-art solutions focus on runtime shui [43] to arrange the heap layout and reliably launch detection, requiring abundant inputs to explore program attacks, making heap overflow a realistic threat. paths in order to reach a high code coverage and luckily Several solutions are proposed to protect heap overflow trigger security violations. -
RIT Computer Engineering Cluster the RIT Computer Engineering
RIT Computer Engineering Cluster The RIT Computer Engineering cluster contains 17 computers for parallel programming using MPI. One computer, segfault.ce.rit.edu (or cluster.ce.rit.edu), serves as the master controller or head node for the cluster and is accessible from the Internet. The other 16 machines, named a, b, and so on through p, are attached to a private LAN segment and are visible only to each other and the cluster head node. To connect to the cluster, simply use a SSH or SFTP client to connect to: <username>@segfault.ce.rit.edu or <username>@cluster.ce.rit.edu segfault (AKA cluster) only supports secure connections using SSH and SFTP; normal Telnet and FTP protocols simply won’t work. Once you’re inside the cluster, however, you may telnet or rlogin to any machine on the cluster at your convenience. SSH Clients Putty, a very small and extremely powerful SSH client, is available from: http://www.chiark.greenend.org.uk/~sgtatham/putty/ or from the mirror sight: http://www.putty.nl/ This SSH client supports X11 forwarding, so if you use an XWindow emulator such as Exceed or ReflectionX, you may open graphical applications remotely over the SSH connection. The website also includes a command line secure FTP client. The San Diego Supercomputer Center has a graphical SFTP program available at: http://security.sdsc.edu/software/secureftp/ This program, however, requires Sun’s most recent JDK as an installation prerequisite. Using Message Passing Interface on the RIT Computer Engineering Cluster MPI is designed to run Single Program Multiple Data (SPMD) parallel programs on homogenous cluster or supercomputer systems. -
Comprehensively and Efficiently Protecting the Heap ∗
Appears in the Proceedings of the 12th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS XII), October 2006. Comprehensively and Efficiently Protecting the Heap ∗ Mazen Kharbutli Xiaowei Jiang Yan Solihin Guru Venkataramani Milos Prvulovic Jordan Univ. of Science and Technology North Carolina State University Georgia Institute of Technology [email protected] {xjiang,solihin}@ece.ncsu.edu {guru,milos}@cc.gatech.edu Abstract of altering the program behavior when it uses V . Attackers may use The goal of this paper is to propose a scheme that provides com- a variety of well-known techniques to overwrite M with V ,suchas prehensive security protection for the heap. Heap vulnerabilities are buffer overflows, integer overflows,andformat strings, typically by increasingly being exploited for attacks on computer programs. In supplying unexpected external input (e.g. network packets) to the most implementations, the heap management library keeps the heap application. The desired program behavior alteration may include meta-data (heap structure information) and the application’s heap direct control flow modifications in which M contains control flow data in an interleaved fashion and does not protect them against information such as function pointers, return addresses, and condi- each other. Such implementations are inherently unsafe: vulnera- tional branch target addresses. Alternatively, attackers may choose bilities in the application can cause the heap library to perform un- to indirectly change program behavior by modifying critical data intended actions to achieve control-flow and non-control attacks. that determines program behavior. Unfortunately, current heap protection techniques are limited Researchers have shown that the stack is vulnerable to over- in that they use too many assumptions on how the attacks will writes, so many protection schemes have been proposed to protect be performed, require new hardware support, or require too many it. -
Semi-Synchronized Non-Blocking Concurrent Kernel Cruising
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCC.2020.2970183, IEEE Transactions on Cloud Computing IEEE TRANSACTIONS ON CLOUD COMPUTING 1 Semi-synchronized Non-blocking Concurrent Kernel Cruising Donghai Tian, Qiang Zeng, Dinghao Wu, Member, IEEE,Peng Liu, Member, IEEE, Changzhen Hu Abstract—Kernel heap buffer overflow vulnerabilities have been exposed for decades, but there are few practical countermeasure that can be applied to OS kernels. Previous solutions either suffer from high performance overhead or compatibility problems with mainstream kernels and hardware. In this paper, we present KRUISER, a concurrent kernel heap buffer overflow monitor. Unlike conventional methods, the security enforcement of which is usually inlined into the kernel execution, Kruiser migrates security enforcement from the kernel’s normal execution to a concurrent monitor process, leveraging the increasingly popular multi-core architectures. To reduce the synchronization overhead between the monitor process and the running kernel, we design a novel semi-synchronized non-blocking monitoring algorithm, which enables efficient runtime detection on live memory without incurring false positives. To prevent the monitor process from being tampered and provide guaranteed performance isolation, we utilize the virtualization technology to run the monitor process out of the monitored VM, while heap memory allocation information is collected inside the monitored VM in a secure and efficient way. The hybrid VM monitoring technique combined with the secure canary that cannot be counterfeited by attackers provides guaranteed overflow detection with high efficiency.