Exploiting Format String Vulnerabilities Scutteam teso Outline n

Exploiting Format String Vulnerabilities Scut/team teso

Outline n n n Introduction The format functions Format string vulnerabilities Variations of Exploitation Conclusion

Introduction n Buffer Overflow vs. Format String Buffer Overflow Format String public since mid 1980's June 1999 danger realized 1990's June 2000 number of exploits considered as a few thousand a few dozen security threat programming bug techniques evolved and advanced visibility sometimes very difficult to spot basic techniques easy to find

Introduction(Cont. ) n Statistics Application Found by Impact years wu-ftpd 2. * security. is remote root >6 Linux rpc. statd security. is remote root >4 IRIX telnetd LSD remote root >8 Qualcomm Popper 2. 53 security. is remote user >3 Apache + PHP 3 security. is remote user >2 NLS / locale CORE SDI local root ? screen Jouko Pynn_onen local root >5 BSD chpass TESO local root ? Open. BSD fstat ktwo local root ?

The Format functions n Functionality n n n used to convert simple C datatypes to a string representation allow to specify the format of the representation process the resulting string (output to stderr, stdout, syslog, . . . )

The Format Functions(Cont. ) n How the format function works n n the format string controls the behaviour of the function it specifies the type of parameters that should be printed parameters are saved on the stack (pushed) saved either directly (by value), or indirectly (by reference)

The Format Functions(Cont) n The calling function n has to know how many parameters it pushes to the stack, since it has to do the stack correction, when the format function returns

The Format Functions(Cont) n Some format parameters parameter output passed as %d decimal (int) value %u unsigned decimal (unsigned int) hexadecimal (unsigned int) value %x value %s string ((const) (unsigned) char reference *) %n number of bytes written so far, reference (* int)

The Format Funtions(Cont) n The stack and its role at format strings printf ("Number %d has no address, number %d has: %08 xn“ A address of the format string , i, a, &a); i value of the variable i a value of the variable a &a address of the variable i

Format String Vulnerabilities n n n Vulnerable Type Viewing Process Memory Exploitation

Vulnerable Type n Type 1: char tmpbuf[512]; snprintf (tmpbuf, sizeof (tmpbuf), "foo: %s", user); tmpbuf[sizeof (tmpbuf) - 1] = ’’; syslog (LOG_NOTICE, tmpbuf); n Type 2: int Error (char *fmt, . . . ); int someotherfunc (char *user) { Error (user); }

Vulnerable Type(Solution) n Type 1: n n pscan or TESOgcc tools Type 2: n Manual check if format funtion or not.

Viewing Process Memory printf(“AAA 0_%08 x. %08 x“); n AAA 0_08048560. 4000 d 360. 40027154. 30414141. 3830255 f. 30252 e 7838. 2 e 783830 n

Exploitation n n Primarily concept: to change return address (Instrument Pointer). Exploit method n n Similar to common buffer overflows Through pure format strings

Similar to common buffer overflows { char outbuf[512]; char buffer[512]; sprintf (buffer, "ERR Wrong command: %400 s", user); sprintf (outbuf, buffer); } We assign user = "%497 dx 3 cxd 3xffxbf<nops><shellcode >" write a return address (0 xbfffd 33 c) n

Through pure format strings n n n printf(“AAA 0_%08 x. %n“); The %n writes to the address 0 x 30414141 that is represented by the string “AAA 0” So we can use “xc 0xc 8xffxbf” to replace “AAA 0”

Through pure format strings unsigned char canary[5]; unsigned char foo[4]; memset (foo, ’x 00’, sizeof (foo)); /* 0 * before */ strcpy (canary, "AAAA"); /* 1 */ printf ("%16 u%n", 7350, (int *) &foo[0]); /* 2 */ printf ("%32 u%n", 7350, (int *) &foo[1]); /* 3 */ printf ("%64 u%n", 7350, (int *) &foo[2]); /* 4 */ printf ("%128 u%n", 7350, (int *) &foo[3]); /* 5 * after */ printf ("%02 x%02 xn", foo[0], foo[1], foo[2], foo[3]); printf ("canary: %02 x%02 xn", canary[0], canary[1], canary[2], canary[3]);

Through pure format strings

Through pure format strings strcpy (canary, "AAAA"); printf ("%16 u%n%32 u%n%64 u%n", 1, (int *) &foo[0], 1, (int *) &foo[1], 1, (int *) &foo[2], 1, (int *) &foo[3]); printf ("%02 x%02 xn", foo[0], foo[1], foo[2], foo[3]); printf ("canary: %02 x%02 xn", canary[0], canary[1], canary[2], canary[3]);

Through pure format strings Offset pseudocode: write_byte += 0 x 100; already_written %= 0 x 100; padding = (write_byte - already_written) % 0 x 100; if (padding < 10) padding += 0 x 100; n

Through pure format strings A <stackpop><dummy-addr-pair * 4><write-code> n Stackpop n n Once the stackpop has been processed, the format function internal stack pointer points to the beginning of the dummy-addr-pair string. Dummy-addr-pair n Four pairs of dummy integer values and addresses to write to. The addresses are increasing by one with each pair, and can’t contain NUL bytes.

Througn pure format strings n Write-code n ‘%n’ is used to write this counter to the addresses that are within the dummy-addrpair part of string.

Variations of Exploitation n n Short Write Direct Parameter Access

Short Write n Use ‘%hn’ to replace ‘%n’ n n h =>cast the value supplied on the stack to a short type. It does not destroy data beside the address. This is useful for RISC based systems. printf ("%. 29010 u%hn%. 32010 u%hn", 1, (short int *) &foo[0], 1, (short int *) &foo[2]);

Direct Parameter Access char foo[4]; printf ("%1$16 u%2$n" "%1$16 u%3$n" "%1$32 u%4$n" "%1$64 u%5$n", 1, (int *) &foo[0], (int *) &foo[1], (int *) &foo[2], (int *) &foo[3]);

Conclusion n n Programming bug Easy to find