Dobin 0x51_ExploitMitigations.pdf

• Use secure libraries
• Perfom Static Analysis of the source code
• Perform Dynamic Analysis of programs
• Perform fuzzing of input vectors
• Have a secure development lifecycle (SDL)
• Manual source code reviews

• Compile Time Protection
• Runtime Protection

• Executable Shellcode
  • Aka "Hacker instructions"
• The distance form the buffer to the SIP (Stored Instruction Pointer)
  • Offset for the overflow
• The address of shellcode
  • in memory of the target process

 Compile time mitigations:

• Stack canaries
• PIE

Runtime mitigations:

• ASLR
• DEP
• ASCII Armor

The stack canary is below the SIP (Stored Instruction Pointer) and the SBP [SFP] (Stored Base Pointer, Stored Frame Pointer)

DEP (Data Execution Prevention)

DEP makes the stack not executable.

Memory regions 

• Are mapped with permissions
• Like files
  • R Read
  • W Write
  • X eXecute

DEP (Data Execution Prevention) removes X bit from memory which do not contain code

• Stack
• Heap
• (Possibly others)

When the program tries to execute code from the Heap or the Stack there is a segmentation fault.

Other names:

• Stack Protector
• SSP: Stack Smashing Protector
• Stack Cookie
• Stack Canary

The stack canary is a secret value in front of control data ( SIP [ Stored Instruction Pointer], SFP/SBP [Stored Frame/Base Pointer]).

This is a value unknown to the attacker.

It is checked befor performing a "ret" (return)

• i.e befor using the SIP (Stored Instruction Pointer)

Stack Protector was first introduced in the 

• GCC patch in 1997

Last improvement by google in 2012 (-fstack-protect-strong)

It is enabled since like forever by default

• most distributions
• most packages

The stack protector (stack canary) changes:

• On execve()
  • (replace current process with a ELF file from disk)
• It does NOT change on fork()
  • (copy of current process)

ASLR = Adress Space Layout Randomization

ASLR introduces a randomness in the memory regions. 

ASLR randomizes where in memory the stack, libraries and heap location in memory.

• Pages have to be page aligned: 4096 bytes = 12 bit
• Very restricted address space in x32 architecture
  • ~ 8 bit for stack (256 possibilities)
• Much more space for x64
  • ~ 22 bit for stack

• ASLR is only applied on exec() [exec = execute new program]
• Not applied on fork() [fork = copy]

ASCII Armor:

• Maps Library addresses to memory addresses with null bytes

Why null bytes?

• In C, Null bytes are string determinator
• strcpy, strcat, strncpu, sprintf

This means the addresses of the librarys can not be included in shell code, because they include nullbytes. That means they cannt be coppied. by strcpy and others.

Stack canary: Detects/blocks overflows

DEP: makes it impossible to execute uploaded code

ASLR makes it impossible to locate data

ASCII Armor: makes it impossible to insert certain data

ASLR (Address Space Layout Randomization) : System Level

DEP (Data Execution Prevention) :  System Level

Stack Canary: Per-program (3rd party programs?)