cert bff: from start to poc - carnegie mellon university€¦ · ppt file · web view ·...
TRANSCRIPT
![Page 1: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/1.jpg)
1CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Software Engineering InstituteCarnegie Mellon UniversityPittsburgh, PA 15213
© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
REV-03.18.2016.0
CERT BFF: From Start to PoCWill Dormann
![Page 2: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/2.jpg)
2CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Copyright
Copyright 2016 Carnegie Mellon University
This material is based upon work funded and supported by Department of Homeland Security under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center sponsored by the United States Department of Defense.
Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of Department of Homeland Security or the United States Department of Defense.
References herein to any specific commercial product, process, or service by trade name, trade mark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute.
NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
[Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution.
This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at [email protected].
CERT® is a registered mark of Carnegie Mellon University.
DM-0003661
![Page 3: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/3.jpg)
3CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
CERT BFF
Fuzzing Basics
![Page 4: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/4.jpg)
4CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Mutational Fuzzing
MutationFuzzer
MicrosoftWord
![Page 5: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/5.jpg)
5CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
The CERT BFF
* It’s not you, it’s me
![Page 6: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/6.jpg)
6CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
The CERT Basic Fuzzing Framework
* It’s not you, it’s me
![Page 7: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/7.jpg)
7CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
How BFF Works
1. Pick with a seed file
2. Mangle the file
3. Launch target application
4. Look for crashes
5. Analyze crash
6. Repeat
Do this blindly, but as as intelligently as possible
![Page 8: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/8.jpg)
8CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
CERT BFF In Action
![Page 9: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/9.jpg)
9CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
CERT BFF
Picking a Target
![Page 10: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/10.jpg)
10CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Oracle Outside In
“Oracle Outside In Technology provides software developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. From the latest office suites, such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software developers with the tools to transform unstructured files into controllable information.”
http://www.oracle.com/us/technologies/embedded/025613.htm
![Page 11: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/11.jpg)
11CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
What Uses Oracle Outside In?
• Microsoft Exchange
• Google Search Appliance• Guidance Encase Forensics• Access Data FTK• Novell Groupwise• Cisco Security Agent• McAfee GroupShield• Symantec Enterprise Vault• IBM WebSphere• …
![Page 12: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/12.jpg)
12CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Fuzzing Oracle Outside In
![Page 13: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/13.jpg)
13CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
CERT BFF
Investigating Results
![Page 14: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/14.jpg)
14CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Checking Results with tools/drillresults.py
![Page 15: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/15.jpg)
15CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Run tools/repro.py -e
![Page 16: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/16.jpg)
16CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Finding Matching Byte Pattern
![Page 17: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/17.jpg)
17CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Finding Matching Byte Pattern
![Page 18: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/18.jpg)
18CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Confirming Control of RET
![Page 19: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/19.jpg)
19CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
CERT BFF
Writing a PoC
![Page 20: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/20.jpg)
20CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Minimize to string
Standard minimization gives the minimally-different-from-seed-file test case. But which of those bytes are irrelevant to the crash?
We want to know:• Bytes required for processing (Structure)• Bytes required to trigger crash (Vulnerability)
![Page 21: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/21.jpg)
21CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
What Minimize-to-String Does
Known good seedfile – does not cause crash
Fuzzed file – causes crash, many changed bytes are not involved in the crash
Minimized-to-string file – causes same crash, replaces non-structure bytes
Fuzz
Minimize-to-string
insert shellcode here
original byte
fuzzed byte
crash byte
non-structure byte
![Page 22: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/22.jpg)
22CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Minimization to String, Visualized
![Page 23: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/23.jpg)
23CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Writing a Memory Corruption PoC
Two pieces of information are required:1. What bytes are under my control?2. How do I get there?
![Page 24: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/24.jpg)
24CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
The Crash
1. What bytes do I control?2. How do I get there?
![Page 25: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/25.jpg)
25CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Minimization-to-string
![Page 26: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/26.jpg)
26CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Return to the Stack
![Page 27: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/27.jpg)
27CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
The Shellcode
![Page 28: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/28.jpg)
28CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Return to the Stack
![Page 29: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/29.jpg)
29CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
What’s Going On Here?
![Page 30: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/30.jpg)
30CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
checksec.sh
![Page 31: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/31.jpg)
31CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
checksec.sh
![Page 32: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/32.jpg)
32CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Success!
![Page 33: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/33.jpg)
33CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
CERT BFF
Return-Oriented Programming
![Page 34: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/34.jpg)
34CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Bypassing NX
NX (or DEP on Windows): Only memory pages marked as executable can be executed.
Return-oriented programming: Chain together pieces of executable code to achieve your goal. Each piece is connected via a RETURN instruction (or equivalent)
![Page 35: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/35.jpg)
35CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
What Does My Shellcode Need?
• Set RAX to 0x3B : execve()• Set RDX to NULL• Set RDI to pointer to “/bin/sh”• Set RSI to pointer to pointer to
“/bin/sh”• Perform SYSCALL
![Page 36: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/36.jpg)
36CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Finding Gadgets With rp++
![Page 37: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/37.jpg)
37CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Finding Gadgets With rp++
![Page 38: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/38.jpg)
38CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Tracing Into First Gadget
![Page 39: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/39.jpg)
39CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Tracing Into First Gadget
![Page 40: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/40.jpg)
40CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Gadget Success!
![Page 41: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/41.jpg)
41CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Now to set RAX
POP RAX should do it
![Page 42: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/42.jpg)
42CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 43: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/43.jpg)
43CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 44: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/44.jpg)
44CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 45: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/45.jpg)
45CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 46: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/46.jpg)
46CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)• 0x0040e464: mov rdx, r13 ; mov rsi, r14 ; mov edi, r15d ; call
qword [rbx] ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 47: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/47.jpg)
47CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)• 0x0040e464: mov rdx, r13 ; mov rsi, r14 ; mov edi, r15d ; call
qword [rbx] ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 48: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/48.jpg)
48CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)• 0x0040e464: mov rdx, r13 ; mov rsi, r14 ; mov edi, r15d ; call
qword [rbx] ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 49: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/49.jpg)
49CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)• 0x0040e464: mov rdx, r13 ; mov rsi, r14 ; mov edi, r15d ; call
qword [rbx] ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 50: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/50.jpg)
50CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)• 0x0040e464: mov rdx, r13 ; mov rsi, r14 ; mov edi, r15d ; call
qword [rbx] ; (1 found)• 0x00402867: mov eax, edx ; ret ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 51: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/51.jpg)
51CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Never Give Up!
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)• 0x0040e464: mov rdx, r13 ; mov rsi, r14 ; mov edi, r15d ; call
qword [rbx] ; (1 found)• 0x00402867: mov eax, edx ; ret ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
![Page 52: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/52.jpg)
52CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
• 0x004032be: pop r13 ; ret ; (1 found)• 0x00403027: pop rbx ; ret ; (1 found)• 0x0040e464: mov rdx, r13 ; mov rsi, r14 ; mov edi, r15d ; call
qword [rbx] ; (1 found)• 0x00402867: mov eax, edx ; ret ; (1 found)
RAXRBXRCXRDX
RSIRDIR13R14R15
Success!
In 4 gadgets we achieved our goal of setting RAX to an arbitrary value
However:• We clobber RSI• We clobber RDI
![Page 53: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/53.jpg)
53CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Properties of Gadgets
• What it achieves (e.g. populate a register)• Collateral:
• What memory it must be able to read from• What memory it must be able to write to
![Page 54: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/54.jpg)
54CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
The Possibilities are Limitless
Sure you can do this all by hand, with trial and error. Or:
Q: Exploit Hardening Made Easy
https://users.ece.cmu.edu/~ejschwar/papers/usenix11.pdf
![Page 55: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/55.jpg)
55CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Putting All The Pieces Together
![Page 56: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/56.jpg)
56CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Get Your Own BFF
Mutational file fuzzing for Linux and OS X:
https://www.cert.org/vulnerability-analysis/tools/bff.cfm
Or FOE if Windows is your thing:
https://www.cert.org/vulnerability-analysis/tools/foe.cfm
![Page 57: CERT BFF: From Start to PoC - Carnegie Mellon University€¦ · PPT file · Web view · 2016-06-09CERT BFF: From Start To PoC. June 09, 2016 ... Mutational Fuzzing. Mutation Fuzzer](https://reader035.vdocuments.site/reader035/viewer/2022062908/5abfc85d7f8b9a8e3f8ebac9/html5/thumbnails/57.jpg)
57CERT BFF: From Start To PoCJune 09, 2016© 2016 Carnegie Mellon UniversityThis material has been approved for public release and unlimited distribution
Contact Information
Presenter / Point of Contact Will DormannSenior Vulnerability AnalystEmail: [email protected]: @wdormann
CERT Coordination CenterEmail: [email protected]: @certcc