BUFFER OVERFLOW ATTACKS: DETECT, EXPLOIT, PREVENT
CONTENTS PART 1 EXPANDING ON BUFFER OVERFLOWS CHAPTER 1 BUFFER OVERFLOWS: THE ESSENTIALS INTRODUCTION THE CHALLENGE OF SOFTWARE SECURITY MICROSOFT SOFTWARE IS NOT BUG FREE THE INCREASE IN BUFFER OVERFLOWS EXPLOITS VSBUFFER OVERFLOWS MADONNA HACKED! DEFINITIONS HARDWARE SOFTWARE SECURITY SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 UNDERSTANDING SHELLCODE AN OVERVIEW OF SHELLCODE THE TOOLS THE ASSEMBLY PROGRAMMING LANGUAGE ANALYSIS WINDOWS VSUNIX ASSEMBLY THE ADDRESSING PROBLEM USING THE "CALL" AND "JMP"TRICK PUSHING THE ARGUMENTS THE NULL BYTE PROBLEM IMPLEMENTING SYSTEM CALLS SYSTEM CALL NUMBERS SYSTEM CALL ARGUMENTS SYSTEM CALL RETURN VALUES REMOTE SHELLCODE PORT-BINDING SHELLCODE SOCKET DESCRIPTOR REUSE SHELLCODE LOCAL SHELLCODE EXECVE SHELLCODE SETUID SHELLCODE CHROOT SHELLCODE LINKS TO SITES MAILING LISTS CHAPTER 3 WRITING SHELLCODE SHELLCODE EXAMPLES THE WRITE SYSTEM CALL REVERSE CONNECTION SHELLCODE SOCKET REUSING SHELLCODE REUSING FILE DESCRIPTORS ENCODING SHELLCODE REUSING PROGRAM VARIABLES OPEN SOURCE PROGRAMS CLOSED SOURCE PROGRAMS OS-SPANNING SHELLCODE UNDERSTANDING EXISTING SHELLCODE CHAPTER 4 WIN32 ASSEMBLY APPLICATION MEMORY LAYOUT APPLICATION STRUCTURE MEMORY ALLOCATION-STACK MEMORY ALLOCATION-HEAP HEAP STRUCTURE WINDOWS ASSEMBLY REGISTERS INDEXING REGISTERS STACK REGISTERS OTHER GENERAL-PURPOSE REGISTERS EIP REGISTER DATA TYPE OPERATIONS HELLO WORLD SECTION 1 CASE STUDIES CASE STUDY 11 FREEBSD NN EXPLOIT CODE OVERVIEW EXPLOITATION CODE DUMP REFERENCES CASE STUDY 12 XLOCKMORE USER SUPPLIED FORMAT STRING VULNERABILITY XLOCKMORE VULNERABILITY DETAILS CASE STUDY 13 FRONTPAGE DENIAL OF SERVICE UTILIZING WINSOCK CODE DUMP APPLICATION DEFENSE HACKH CODE DUMP CASE STUDY 14 CURL BUFFER OVERFLOW ON FREEBSD EXPLOIT CODE PART II EXPLOITING BUFFER OVERFLOWS CHAPTER 5 STACK OVERFLOWS INTEL X86 ARCHITECTURE AND MACHINE LANGUAGE BASICS STACKS AND PROCEDURE CALLS STORING LOCAL VARIABLES CALLING CONVENTIONS AND STACK FRAMES INTRODUCTION TO THE STACK FRAME PASSING ARGUMENTS TO A FUNCTION STACK FRAMES AND CALLING SYNTAXES PROCESS MEMORY LAYOUT STACK OVERFLOWS AND THEIR EXPLOITATION SIMPLE OVERFLOW CREATING AN EXAMPLE PROGRAM WITH AN EXPLOITABLE OVERFLOW WRITING OVERFLOWABLE CODE DISASSEMBLING THE OVERFLOWABLE CODE PERFORMING THE EXPLOIT GENERAL EXPLOIT CONCEPTS BUFFER INJECTION TECHNIQUES METHODS TO EXECUTE PAYLOAD DESIGNING PAYLOAD WHAT IS AN OFF-BY-ONE OVERFLOW? FUNCTIONS THAT CAN PRODUCE BUFFER OVERFLOWS FUNCTIONS AND THEIR PROBLEMS, OR NEVER USE GETS() GETS() AND FGETS() STRCPY() AND STRNCPY(), STRCAT(), AND STRNCAT() (V)SPRINTF() AND (V)SNPRINTF() SSCANF(), VSCANF(), AND FSCANF() OTHER FUNCTIONS CHALLENGES IN FINDING STACK OVERFLOWS LEXICAL ANALYSIS SEMANTICS-AWARE ANALYZERS APPLICATION DEFENSE! OPENBSD 28 FTPD OFF-BY-ONE APACHE HTPASSWD BUFFER OVERFLOW CHAPTER 6 HEAP CORRUPTION SIMPLE HEAP CORRUPTION USING THE HEAP-MALLOC(), CALLOC(), REALLOC() SIMPLE HEAP AND BSS OVERFLOWS CORRUPTING FUNCTION POINTERS IN C++ ADVANCED HEAP CORRUPTION-DOUG LEA MALLOC OVERVIEW OF DOUG LEA MALLOC MEMORY ORGANIZATION-BOUNDARY TAGS, BINS, ARENAS THE FREE() ALGORITHM FAKE CHUNKS EXAMPLE VULNERABLE PROGRAM EXPLOITING FRONTLINK() OFF-BY-ONE AND OFF-BY-FIVE ON THE HEAP ADVANCED HEAP CORRUPTION-SYSTEM V MALLOC SYSTEM V MALLOC OPERATION TREE STRUCTURE FREEING MEMORY THE REALFREE() FUNCTION THE T_DELETE FUNCTION-THE EXPLOITATION POINT FIXING HEAP CORRUPTION VULNERABILITIES IN THE SOURCE CHAPTER 7 FORMAT STRING ATTACKS WHAT IS A FORMAT STRING? C FUNCTIONS WITH VARIABLE NUMBERS OF ARGUMENTS ELLIPSIS AND VA_ARGS FUNCTIONS OF FORMATTED OUTPUT USING FORMAT STRINGS PRINTF() EXAMPLE FORMAT TOKENS AND PRINTF() ARGUMENTS TYPES OF FORMAT SPECIFIERS ABUSING FORMAT STRINGS PLAYING WITH BAD FORMAT STRINGS DENIAL OF SERVICE DIRECT ARGUMENT ACCESS READING MEMORY WRITING TO MEMORY SIMPLE WRITES TO MEMORY MULTIPLE WRITES CHALLENGES IN EXPLOITING FORMAT STRING BUGS FINDING FORMAT STRING BUGS WHAT TO OVERWRITE DESTRUCTORS IN DTORS GLOBAL OFFSET TABLE ENTRIES STRUCTURED EXCEPTION HANDLERS OPERATING SYSTEM DIFFERENCES DIFFICULTIES IN EXPLOITING DIFFERENT SYSTEMS THE WHITEBOX AND BLACKBOX ANALYSIS OF APPLICATIONS CHAPTER 8 WINDOWS BUFFER OVERFLOWS BACKGROUND BASIC STACK OVERFLOW WRITING WINDOWS SHELLCODE OVERCOMING SPECIAL CHARACTERS (EXAMPLE: NULL) CLIENT SERVER APPLICATION USING/ABUSING THE STRUCTURED EXCEPTION HANDLER SECTION 2 CASE STUDIES CASE STUDY 21 CURL BUFFER OVERFLOW ON LINUX CASE STUDY 22 SSLV2 MALFORMED CLIENT KEY REMOTE BUFFER OVERFLOW VULN OPENSSL VULNERABILITY DETAILS EXPLOITATION DETAILS THE COMPLICATION IMPROVING THE EXPLOIT MUCH IMPROVED… BUT MORE TO COME! COMPLETE EXPLOIT CODE FOR OPENSSL SSLV2 MALFORMED CLIENT KEY REMOTE BUFFER OVERFLOW CASE STUDY 23 X11R6 42 XLOCALEDIR OVERFLOW XLOCALEDIR VULNERABILITY DETAILS AND ANALYSIS CASE STUDY 24 MICROSOFT MDAC DENIAL OF SERVICE CASE STUDY 25 LOCAL UUX BUFFER OVERFLOW ON HPUX PART III FINDING BUFFER OVERFLOWS CHAPTER 9 FINDING BUFFER OVERFLOWS IN SOURCE SOURCE CODE ANALYSIS FREE OPEN SOURCE TOOLS APPLICATION DEFENSE SNAPSHOT RATS FLAWFINDER FLAWFINDER TEXT OUTPUT ITS4 APPLICATION DEFENSE-ENTERPRISE DEVELOPER SECURE SOFTWARE ARCHITECTURE AND DEPLOYMENT VULNERABILITY KNOWLEDGEBASE USING CODEASSURE SETTING UP PROJECTS PERFORMING THE ANALYSIS VULNERABILITY REVIEW AND REPORTING MANAGING RESULTS REMEDIATION OUNCE LABS PREXIS' SCIENCE OF AUTOMATED ANALYSIS PREXIS ARCHITECTURE PREXIS ASSESSMENT CAPABILITY PREXIS REPORTING AND REMEDIATION CAPABILITIES PREXIS IN ACTION VULNERABILITY ASSESSMENT WITH PREXIS PROJECT CONFIGURATION RUNNING AN ASSESSMENT EXAMINING ASSESSMENT RESULTS FILTERING ASSESSMENTS FORTIFY SOFTWARE FORTIFY'S SOURCE CODE ANALYSIS SUITE USING THE SOURCE CODE ANALYSIS ENGINE INTEGRATING WITH THE BUILD PROCESS RUNNING THE ANALYSIS UNDERSTANDING THE RAW OUTPUT AUDIT WORKBENCH AUDIT GUIDE SOFTWARE SECURITY MANAGER SECTION 3 CASE STUDIES CASE STUDY 31 INLINEEGG I INLINE EGG CODE CASE STUDY 32 INLINEEGG II CASE STUDY 33 SETI@HOME EXPLOIT CODE CASE STUDY 34 MICROSOFT CODEBLUE EXPLOIT CODE