• Home

  • Technology

  • Reversing & malware analysis training part 10 exploit development basics
23
www.SecurityXploded.com

Reversing & malware analysis training part 10 exploit development basics

Embed Size (px)

DESCRIPTION

 

Citation preview

Page 1: Reversing & malware analysis training part 10 exploit development basics

www.SecurityXploded.com

http://www.securityxploded.com/
Page 2: Reversing & malware analysis training part 10 exploit development basics

Disclaimer

The Content, Demonstration, Source Code and Programs presented here is "AS IS"

without any warranty or conditions of any kind. Also the views/ideas/knowledge

expressed here are solely of the trainer’s only and nothing to do with the company or

the organization in which the trainer is currently working.

However in no circumstances neither the trainer nor SecurityXploded is responsible for

any damage or loss caused due to use or misuse of the information presented here.

www.SecurityXploded.com

Page 3: Reversing & malware analysis training part 10 exploit development basics

Acknowledgement

Special thanks to null & Garage4Hackers community for their extended support and

cooperation.

Thanks to all the trainers who have devoted their precious time and countless hours to

make it happen.

www.SecurityXploded.com

Page 4: Reversing & malware analysis training part 10 exploit development basics

Reversing & Malware Analysis Training

This presentation is part of our Reverse Engineering & Malware Analysis Training

program. Currently it is delivered only during our local meet for FREE of cost.

For complete details of this course, visit our Security Training page.

www.SecurityXploded.com

http://securityxploded.com/security-training.php
Page 5: Reversing & malware analysis training part 10 exploit development basics

Who am I #1

Harsimran Walia

• Research Scientist @ McAfee

• Expertise: Malware Analysis, Exploit development and Vulnerability Analysis

• Twitter: b44nz0r

• Email: [email protected]

www.SecurityXploded.com

Page 6: Reversing & malware analysis training part 10 exploit development basics

Who am I #2

Amit Malik (sometimes DouBle_Zer0,DZZ)

Member SecurityXploded

Security Researcher @ McAfee Labs

RE, Exploit Analysis/Development, Malware Analysis

Email: [email protected]

www.SecurityXploded.com

Page 7: Reversing & malware analysis training part 10 exploit development basics

Course Q&A

Keep yourself up to date with latest security news

http://www.securityphresh.com

For Q&A, join our mailing list.

http://groups.google.com/group/securityxploded

www.SecurityXploded.com

http://www.securityphresh.com/
http://groups.google.com/group/securityxploded
Page 8: Reversing & malware analysis training part 10 exploit development basics

Contents

What is an Exploit?

Classification of exploits

Exploitation Techniques

Direct EIP overwrite

SEH overwrite

www.SecurityXploded.com

Page 9: Reversing & malware analysis training part 10 exploit development basics

Vulnerability

In computer security, a vulnerability is a weakness which allows

an attacker to reduce a system's information assurance.

Vulnerability is the intersection of three elements: a system

susceptibility or flaw, attacker access to the flaw, and attacker

capability to exploit the flaw.

- Source: Wikipedia

www.SecurityXploded.com

Page 10: Reversing & malware analysis training part 10 exploit development basics

Exploit

Piece of software/code that takes advantage of a vulnerability in order

to cause unintended or unanticipated behaviour to occur on computer

software, hardware [Wiki]

This frequently includes

gaining control of a computer system or

privilege escalation or

a denial-of-service attack.

www.SecurityXploded.com

Page 11: Reversing & malware analysis training part 10 exploit development basics

Exploits can be in any form based on the software it exploits:

Software : exploit

Adobe reader : pdf file

Microsoft word : doc file

Microsoft excel : xls file

Internet Explorer : Attacker hosted website or html file

and so on..

Exploit (contd)

www.SecurityXploded.com

Page 12: Reversing & malware analysis training part 10 exploit development basics

Classification

Based on the vulnerability they exploit

Buffer Overflow, Memory Corruption, Use-After-Free

Local or Remote

Local Privilege Escalation, Remote code execution

Result of running the exploit

DoS, EoP etc

www.SecurityXploded.com

Page 13: Reversing & malware analysis training part 10 exploit development basics

Stack Buffer Overflow

Occurs when a program writes to memory addresses on

the stack outside of the allocated buffer

For exploiting a stack based buffer overflow is to

overwrite the function return address with a pointer to

attacker-controlled data (usually on the stack itself)

www.SecurityXploded.com

Page 14: Reversing & malware analysis training part 10 exploit development basics

A - Before data is copied. B - "hello" is the first

command line argument.

C -

AA AAAA AAAAA AAAAAAA AA\x08\

x35\xC0\x80" is the first command

line argument.

Stack Buffer Overflow in Action

www.SecurityXploded.com

Page 15: Reversing & malware analysis training part 10 exploit development basics

Direct EIP overwrite (saved ret)

Every Windows uses process memory that contains 3 major components :

code segment (executable instructions). The EIP keeps track of the next

instruction

data segment (variables, dynamic buffers)

stack segment (used to pass data/arguments to functions, and is used as space

for variables)

○The stack starts (= the bottom of the stack) from the very end of the virtual

memory of a page and grows upwards (to a lower address).

○PUSH adds something to the top of the stack,

○POP will remove one item (4 bytes) from the stack and puts it in a register.

www.SecurityXploded.com

Page 16: Reversing & malware analysis training part 10 exploit development basics

EIP Overwrite Demo

A vulnerability in

“Shadow Stream Recorder version 3.0.1.7

Buffer overflow when reading file (.asx)

Step -1 : Create a PoC to generate a crash in the software to verify the vuln

Step -2 : Find the offset to overwrite EIP

Step -3: Find an address of the “jmp esp” instruction

Step -4: Generate a shellcode and append it to the exploit code

Step -5: Putting it all together

www.SecurityXploded.com

Page 17: Reversing & malware analysis training part 10 exploit development basics

DEMO - EIP

http://www.youtube.com/watch?v=erl_Aee8oDg

www.SecurityXploded.com

http://www.youtube.com/watch?v=erl_Aee8oDg
Page 18: Reversing & malware analysis training part 10 exploit development basics

SEH Overwrite

Exception?

An event which disrupts normal execution flow of code and requires

execution outside normal flow

Software Exception –Generated by program (e.g Invalid file handle)

Hardware Exception – Access invalid memory, divide by zero etc

SEH (structured exception handler)

Patented by Borland and licensed to Microsoft

Software’s method of dispatching and handling exceptions

Can handle both software and hardware exceptions

For eg try{ } ; except { }; block

Whenever an exception happens control is passed on to the OS, which in turn

locate and pass the control to the handler chain

www.SecurityXploded.com

Page 19: Reversing & malware analysis training part 10 exploit development basics

Pointer to next SEH

Pointer to excep. handlers

Exception

Registration

Record

8 bytes Process Thread

Information Block

Fs[0] – Exception

Registration

FFFFFFFF

OS Handler

Default ERR

SEH Overwrite in Action

www.SecurityXploded.com

Page 20: Reversing & malware analysis training part 10 exploit development basics

SEH Overwrite Demo

A vulnerability in

“MM Player 2.2

Buffer overflow when reading file (.ppl)

Step -1 : Create a PoC to generate a crash in the software to verify the vuln

Step -2 : Find the offset to overwrite nSEH + SEHandler

Step -3: Find an address of the command sequence “pop pop ret ”

Step -4: Generate a shellcode and append it to the exploit code

Step -5: Putting it all together

www.SecurityXploded.com

Page 21: Reversing & malware analysis training part 10 exploit development basics

SEH Overwrite Demo

http://www.youtube.com/watch?v=njQ47H7jO4s&fe

ature=youtu.be

www.SecurityXploded.com

http://www.youtube.com/watch?v=njQ47H7jO4s&feature=youtu.be
http://www.youtube.com/watch?v=njQ47H7jO4s&feature=youtu.be
Page 22: Reversing & malware analysis training part 10 exploit development basics

Reference

Complete Reference Guide for Reversing & Malware Analysis Training

www.SecurityXploded.com

http://securityxploded.com/malware-analysis-training-reference.php
http://technet.microsoft.com/en-us/library/cc768129.aspx
Page 23: Reversing & malware analysis training part 10 exploit development basics

Thank You !

www.SecurityXploded.com

http://www.securityxploded.com/

Reversing malware analysis training part7 unpackingupx

Reversing malware analysis training part7 unpackingupx

Technology
Practical Reversing IV – Advanced Malware Analysis

Practical Reversing IV – Advanced Malware Analysis

Documents
Malware (Sample) Static/Dynamic Analysis (no reversing)

Malware (Sample) Static/Dynamic Analysis (no reversing)

Documents
Reversing Android Malware - Hack In The Box Security ...conference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Mahmud Ab... · Reversing Android Malware ... - Spyeye’s’fake’security’tool

Reversing Android Malware - Hack In The Box Security ...conference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Mahmud Ab... · Reversing Android Malware ... - Spyeye’s’fake’security’tool

Documents
Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics

Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics

Internet
Reversing malware analysis training part3 windows pefile formatbasics

Reversing malware analysis training part3 windows pefile formatbasics

Technology
Malware. 2 Inhoud Historisch overzicht Malware Soorten Malware (+ werking) Virus, Worm, Trojan, botnet Andere Terminologie Exploit, Payload, Zero-day

Malware. 2 Inhoud Historisch overzicht Malware Soorten Malware (+ werking) Virus, Worm, Trojan, botnet Andere Terminologie Exploit, Payload, Zero-day

Documents
© SERG Reverse Engineering (Reversing Malware) Reversing Malware [based on material from the textbook]

© SERG Reverse Engineering (Reversing Malware) Reversing Malware [based on material from the textbook]

Documents
Reversing malware analysis training part5 reverse engineering tools basics

Reversing malware analysis training part5 reverse engineering tools basics

Technology
Practical Reversing VI - Exploit Development [advanced]

Practical Reversing VI - Exploit Development [advanced]

Documents
Reversing & malware analysis training part 4 assembly programming basics

Reversing & malware analysis training part 4 assembly programming basics

Technology
Reversing & malware analysis training part 7 unpacking upx

Reversing & malware analysis training part 7 unpacking upx

Technology
Malware and Exploit Enabling Code

Malware and Exploit Enabling Code

Documents
Reversing & malware analysis training part 8 malware memory forensics

Reversing & malware analysis training part 8 malware memory forensics

Technology
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Technology
Angler Exploit Kit/Malware Seguridad informatica en Mexico

Angler Exploit Kit/Malware Seguridad informatica en Mexico

Documents
Reversing and decrypting communications of apt malware

Reversing and decrypting communications of apt malware

Technology
Reversing malware analysis training part10 exploit development basics

Reversing malware analysis training part10 exploit development basics

Technology
Reversing malware analysis training part11 exploit development advanced

Reversing malware analysis training part11 exploit development advanced

Technology
Reversing malware analysis training part12 rootkitanalysis

Reversing malware analysis training part12 rootkitanalysis

Technology
Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Technology
Reversing and Malware Analysis

Reversing and Malware Analysis

Technology
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Technology
Practical Reversing III – Malware Memory Forensics

Practical Reversing III – Malware Memory Forensics

Documents
Reversing and Decrypting the Communications of APT Malware (Etumbot)

Reversing and Decrypting the Communications of APT Malware (Etumbot)

Technology
Reversing malware analysis training part2 introduction to windows internals

Reversing malware analysis training part2 introduction to windows internals

Technology
Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Technology
Reversing & Malware Analysis Training Part 12 - Rootkit Analysis

Reversing & Malware Analysis Training Part 12 - Rootkit Analysis

Technology
Practical Firmware Reversing and Exploit Development for ......Practical Firmware Reversing and Exploit Development for AVR-based Embedded Devices Alexander @dark_k3y Bolshev Boris

Practical Firmware Reversing and Exploit Development for ......Practical Firmware Reversing and Exploit Development for AVR-based Embedded Devices Alexander @dark_k3y Bolshev Boris

Documents
Reversing & malware analysis training part 11 exploit development advanced

Reversing & malware analysis training part 11 exploit development advanced

Technology