|
ARTeam Tutorial Visit:
http://cracking.accessroot.com
|
http://forum.accessroot.com A funny view on int smashing v 1.1 |
| Information | A little tutorial which introduces int smashing and shows how PC doesn't like buffer overruns |
| Target | - |
| Available | - |
| Tools | OllyDbg 1.10 |
| Protection | -- |
| level | Beginner |
| Category | int smashing and Buffer Overruns |
| Author(s) | Shub-Nigurrath Dec 2005 |
| Requirements | Windows XP, IE 5.5 and above for best viewing |
|
1. Introduction
|
|
Hi all today's today I'll demonstrate how our PCs
doesn't like buffer overruns and int smashing.
This code is a modification of the code inside this tutorial: Blexim, Basic Integer Overflows, Phrack 60, www.phrack.org/show.php?p=60&a=10 but isn't strictly required to understand what I'm describing. Anyway take a look at it you'll learn something interesting.. This is not a tutorial about smashing tecniques but
rather a tutorial on a funny situation happened to me,
and that I wanted to share with you, however at the end
I included a complete references guide where to take
your moves on this mines field .. there’s no doubt that
there will be significant new vulnerabilities discovered
due to integer errors in any of the thousands
applications in use. |
|
2. Description of
the bug
|
|
Integer overflows are not like most common bug classes. They do not allow direct overwriting of memory or direct execution flow control, but are much more subtle. The root of the problem lies in the fact that there is no way for a process to check the result of a computation after it has happened, so there may be a discrepancy between the stored result and the correct result. Because of this, most integer overflows are not actually exploitable. Even so, in certain cases it is possible to force a crucial variable to contain an erroneous value, and this can lead to problems laterin the code. Because of the subtlety of these bugs, there is a huge number of situations in which they can be exploited, so I will not attempt to cover all exploitable conditions. Instead, I will provide examples of a situations which is exploitable, in the hope of inspiring the reader in their own research :) This tutorial applies to this code: #include <stdio.h> #include <stdlib.h> #include <string.h> int main(int argc, char *argv[]){
try {
unsigned short s;
int i;
char buf[80];
if(argc < 3){
return -1;
}
i = atoi(argv[1]); s = i; if(s >= 80){ /* [w1] */
printf("Oh no you don't!\n");
return -1;
}
printf("s = %d\n", s);
memcpy(buf, argv[2], i);
buf[i] = '\0';
printf("%s\n", buf);
return 0;
}
catch(...) {
printf("Oh my God!\n");
}
}
While a construct like this would probably never show up in real life code, it serves well as an example. Take a look at the following inputs:
c:\tmp\smash 80 hello
When this value is transferred into the short integer s, it is truncated if the value is too great to fit into s (i.e. if the value is greater than 65535). Because of this, it is possible to bypass the bounds check at [w1] and overflow the buffer. After this, standard stack smashing techniques can be used to exploit the process.
|
|
3.
Studying the problem
|
|
Well, try now to insert this input to start looking at the stack buffer (I'll not cover it completely indeed). c:\tmp\smash 65536 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaDEADBEEF There are 80 'a' and “DEADBEEF” is the overrun Let's now open ollydbg on smash.exe (in this tutorial archive) to see what happens..
First of all insert the program's arguments:
65536
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa then run the program and place these two breakpoints 0040105C . /7C 12 JL SHORT xx.00401070 and
00401096 . E8 55000000 CALL xx.004010F0 Now, happily go forward till the second breakpoint and enter the corresponding call.
We are now testing if the buffer which has a maximum lenght of 80 characters can be overrunned.
step through the instructions till you get to this one:
00401123 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR
DS:[ESI]
look at the registers of the application, and specially at the EIP
Wow, it seems like our computer doesn't like our DEADBEEF :-D
|
|
5.
References
|
|
Nontraditional literature on buffer
overruns Well in order to give to you also something interesting on which to study and start learning something new, I thought to also place here a reference guide to "non traditional" literature on smashing (stack, as well as heap and so on). I think might of some interest to the most beginners of you (but not only indeed). This material comes partially from a publication I found and of which sincerely I don't remember the name (who cares afterall) ;-) Although very little work has been published on
exploitation in traditional conferences and journals,
there is a lively parallel world —where the work is
often of surprisingly high quality (don't you think so
?). This important resource is often left untapped by
security researchers. The exploit techniques nowadays
around come from four major threads of nontraditional
literature, with a fair amount of crossover between
them: Web sites and advisories from security companies
and individual researchers; mailing lists, most notably
the Security Focus VulnWatch and VulnDev mailing lists;
hacker conferences such as Black Hat (www.blackhat.org);
and Phrack magazine (www.phrack.org). Notable vulnerabilities caused by integer errors The int smashing is a new tecnique raising attention as you can see. Integer errors caused some notable vulnerabilities. They are referenced by their BugTraq number.
Further reading about int smashing:
|
|
6. Conclusions
|
|
Lesson Learnt a new interesting way to ROFL and some starting points where to learn new things..
|
|
7. Greetingz
|
|
[MAIN TEAM]
|