.:: Advanced return-into-lib(c) exploits (PaX case study) ::.[ News ][ Issues ][ Authors ][ Archives ][ Contact ][ Search ]<br>[ Close ]Enter something in the search box to see results
Issues :[ 1 ][ 2 ][ 3 ][ 4 ][ 5 ][ 6 ][ 7 ][ 8 ][ 9 ][ 10 ][ 11 ][ 12 ][ 13 ][ 14 ][ 15 ][ 16 ][ 17 ][ 18 ][ 19 ][ 20 ][ 21 ][ 22 ][ 23 ][ 24 ][ 25 ][ 26 ][ 27 ][ 28 ][ 29 ][ 30 ][ 31 ][ 32 ][ 33 ][ 34 ][ 35 ][ 36 ][ 37 ][ 38 ][ 39 ][ 40 ][ 41 ][ 42 ][ 43 ][ 44 ][ 45 ][ 46 ][ 47 ][ 48 ][ 49 ][ 50 ][ 51 ][ 52 ][ 53 ][ 54 ][ 55 ][ 56 ][ 57 ][ 58 ][ 59 ][ 60 ][ 61 ][ 62 ][ 63 ][ 64 ][ 65 ][ 66 ][ 67 ][ 68 ][ 69 ][ 70 ][ 71 ][ 72 ]<br>Get tar.gz<br>Current issue : #58 | Release date : 2001-12-28 | Editor : Phrack Staff<br>IntroductionPhrack StaffPhrack LoopbackPhrack StaffPhrack SignalnoisePhrack StaffAdvanced return-into-lib(c) exploits (PaX case study)nergalRuntime binary encryptionscut & grugqAdvances in kernel hackingpalmersLinux on-the-fly kernel patching without LKMdevik & sdLinux x86 kernel function hooking emulationmayhemRPC without bordersstealthDeveloping StrongARM/Linux shellcodefunkyshHP-UX (PA-RISC 1.1) OverflowsZhodiacThe Security of Vita Vuova's Inferno OSdalaiPhrack World NewsPhrack StaffPhrack magazine extraction utilityPhrack StaffTitle : Advanced return-into-lib(c) exploits (PaX case study)<br>Author : nergal
==Phrack Inc.==
Volume 0x0b, Issue 0x3a, Phile #0x04 of 0x0e
|=------------=[ The advanced return-into-lib(c) exploits: ]=------------=|<br>|=------------------------=[ PaX case study ]=---------------------------=|<br>|=-----------------------------------------------------------------------=|<br>|=----------------=[ by Nergal [email protected]> ]=--------------=|
May this night carry my will<br>And may these old mountains forever remember this night<br>May the forest whisper my name<br>And may the storm bring these words to the end of all worlds
Ihsahn, "Alsvartr"
--[ 1 - Intro
1 - Intro
2 - Classical return-into-libc
3 - Chaining return-into-libc calls<br>3.1 - Problems with the classical approach<br>3.2 - "esp lifting" method<br>3.3 - frame faking<br>3.4 - Inserting null bytes<br>3.5 - Summary<br>3.6 - The sample code
4 - PaX features<br>4.1 - PaX basics<br>4.2 - PaX and return-into-lib exploits<br>4.3 - PaX and mmap base randomization
5 - The dynamic linker's dl-resolve() function<br>5.1 - A few ELF data types<br>5.2 - A few ELF data structures<br>5.3 - How dl-resolve() is called from PLT<br>5.4 - The conclusion
6 - Defeating PaX<br>6.1 - Requirements<br>6.2 - Building the exploit
7 - Misc<br>7.1 - Portability<br>7.2 - Other types of vulnerabilities<br>7.3 - Other non-exec solutions<br>7.4 - Improving existing non-exec schemes<br>7.5 - The versions used
8 - Referenced publications and projects
This article can be roughly divided into two parts. First, the<br>advanced return-into-lib(c) techniques are described. Some of the presented<br>ideas, or rather similar ones, have already been published by others.<br>However, the available pieces of information are dispersed, usually<br>platform-specific, somewhat limited, and the accompanying source code is not<br>instructive enough (or at all). Therefore I have decided to assemble the<br>available bits and a few of my thoughts into a single document, which should<br>be useful as a convenient reference. Judging by the contents of many posts<br>on security lists, the presented information is by no means the common<br>knowledge.
The second part is devoted to methods of bypassing PaX in case of<br>stack buffer overflow (other types of vulnerabilities are discussed at the<br>end). The recent PaX improvements, namely randomization of addresses the<br>stack and the libraries are mmapped at, pose an untrivial challenge for an<br>exploit coder. An original technique of calling directly the dynamic linker's<br>symbol resolution procedure is presented. This method is very generic and the<br>conditions required for successful exploitation are usually satisfied.
Because PaX is Intel platform specific, the sample source code has been<br>prepared for Linux i386 glibc systems. PaX is not considered sufficiently<br>stable by most people; however, the presented techniques (described for<br>Linux on i386 case) should be portable to other OSes/architectures and can<br>be possibly used to evade other non-executability schemes, including ones<br>implemented by hardware.
The reader is supposed to possess the knowledge on standard exploit<br>techniques. Articles [1] and [2] should probably be assimilated before<br>further reading. [12] contains a practical description of ELF internals.
--[ 2 - Classical return-into-libc
The classical return-into-libc technique is well described in [2], so<br>just a short summary here. This method is most commonly used to evade<br>protection offered by the non-executable stack. Instead of returning into<br>code located within the stack, the vulnerable function should return into a<br>memory area occupied by a dynamic library. It can be achieved by<br>overflowing a stack buffer with the following payload:
| buffer fill-up(*)| function_in_lib | dummy_int32 | arg_1 | arg_2 | ...<br>- this int32 should...