Automatic Shellcode Transplant for Remote Exploits
Your Exploit is Mine:
Automatic Shellcode Transplant for
Remote Exploits
Tiffany Bao, Fish Wang, Yan Shoshitaishvili, David Brumley
Carnegie Mellon University & UC Santa Barbara
Exploits
•
Denial of Service Exploits
•
Web Applications Exploits
•
Remote Exploits
1
Control Flow Hijacking
A control flow hijacking exploit:
–
Deviates the control flow of the vulnerable
program, and
–
Leads the program to carry out the malicious
computation controlled by the attacker.
2
Control Flow Hijacking
A control flow hijacking exploit:
–
Deviates the control flow of the vulnerable
program, and
–
Leads the program to carry out the malicious
computation controlled by the attacker.
3
4
5
Install Malware
Shellcode
Replacement Shellcode
Shellcode Transplant
6
Install Malware
Shellcode
Modified Exploit
Shellcode Transplant
7
Install Malware
Shellcode
Replacement Shellcode
Modified Exploit
Shellcode Transplant
8
S
Previous Approach
[1]
: Symbolic Execution
9
[1] D. K. Sean Heelan. Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities.
10
1. Execute the program
with symbolic inputs.
Previous Approach: Symbolic Execution
Previous Approach: Symbolic Execution
11
1. Execute the program
with symbolic inputs.
Previous Approach: Symbolic Execution
12
1. Execute the program
with symbolic inputs.
2.
Concretize the input with
the replacement shellcode.
Previous Approach: Symbolic Execution
13
1. Execute the program
with symbolic inputs.
2.
Concretize the input with
the replacement shellcode.
f(s
2
) == 0x89,
…
Shellcode Constraints
s
k
== 2
Path Constraints
s
1
=0x80, s
2
=0x72, s
3
=0x08, s
4
=0xc3,
…
3. Solve the constraints.
Previous Approach: Limitation
14
1. Execute the program
with symbolic inputs.
2.
Concretize the input with
the replacement shellcode.
f(s
2
) == 0x89,
…
Shellcode Constraints
s
k
== 2
Path Constraints
if
(
s
k
== 2)
vuln();
s
k
== 1
Contradiction
s
k
f(s
k
)
Previous Approach: Limitation
15
1. Execute the program
with symbolic inputs.
2.
Concretize the input with
the replacement shellcode.
f(s
2
) == 0x89,
…
Shellcode Constraints
s
k
== 2
Path Constraints
if
(
s
k
== 2)
blah();
vuln();
s
k
== 1
Contradiction
s
k
f(s
k
)
Our Work: ShellSwap
16
1. Execute the program
with symbolic inputs.
2.
Concretize the input with
the replacement shellcode.
f(s
2
) == 0x89,
…
Shellcode Constraints
s
k
== 2
Path Constraints
if
(
s
k
== 2)
blah();
vuln();
s
k
== 1
s
k
f(s
k
)
Path Kneading
Layout Remediation
Our Work: ShellSwap
17
1. Execute the program
with symbolic inputs.
2.
Concretize the input with
the replacement shellcode.
f(s
2
) == 0x89,
…
Shellcode Constraints
s
k
== 2
Path Constraints
if
(
s
k
== 2)
blah();
vuln();
s
k
== 1
s
k
f(s
k
)
Path Kneading
Layout Remediation
Layout Remediation
18
Replacement Shellcode
Layout Remediation
19
s
k
== 1
Path Constraints
Layout Remediation
20
s
k
== 1
Path Constraints
Layout Remediation
21
s
k
== 1
Path Constraints
s
k
== 2
Shellcode Constraints
Layout Remediation
22
s
k
== 1
Path Constraints
s
k
== 2
Shellcode Constraints
Layout Remediation
23
s
k
== 1
Path Constraints
Shellcode Constraints
s
k
== 2
s
k+3
== 2
Layout Remediation May Fail
24
Not Enough Space!
s
k
Our Work: ShellSwap
25
1. Execute the program
with symbolic inputs.
2.
Concretize the input with
the replacement shellcode.
f(s
2
) == 0x89,
…
Shellcode Constraints
s
k
== 2
Path Constraints
if
(
s
k
== 2)
blah();
vuln();
s
k
== 1
s
k
f(s
k
)
Path Kneading
Layout Remediation
Path Kneading
26
s
k
== 1
Path Constraints
s
k
== 2
Shellcode Constraints
Path Exploration
Restricting Path Exploration
Explored paths are only allowed to deviate once.
27
Explored
Path
Original
Path
if
(
s
k
== 1)
blah()
vuln()
foo()
return(0)
yes
no
Path Kneading
28
s
k
== 1
Path Constraints
s
k
== 2
Shellcode Constraints
Path Exploration
Path Kneading
29
s
k
!= 1
Path Constraints
s
k
== 2
Shellcode Constraints
…
if
(
s
k
== 1)
blah();
vuln();
foo();
return(0);
Path Exploration
Evaluation
•
20 original exploits from the Cyber Grand Challenge
•
5 new shellcodes from 3 different authors
•
20 * 5 = 100 different cases
30
Effectiveness
31
31
[1] D. K. Sean Heelan. Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities.
Effectiveness
32
31
85
57
31
Efficiency
60/85 (>70%) exploits were generated within 3 minutes.
33
Conclusion
Reusing control flow hijacking exploits can be done
automatically.
–
Symbolic execution extensions made this possible.
•
Layout Remediation
•
Path Kneading
–
ShellSwap: 85% vs. Previous method: 31%
–
70%+ of the successful exploits can be automatically
generated in 3 minutes.
34
Thank You!
Questions?
35
Wait, Are We Too Evil?
•
Automatic Proof-of-Vulnerability
generation based on detected exploits from
the wild
•
Think about collateral damage
…
36
Related Work
•
Mayhem
•
The Other Work?
37
What is CGC?
•
8: the host 12: the CRS
38
Effectiveness
39
31
Previous Work
[1]
[1] D. K. Sean Heelan. Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities.
We find vulnerabilities in programs, and we write exploits to take advantages of them.
But writing exploits is like an art, which is time consuming even for skillful hackers.
So once we capture an exploit in the wild, it’ll be great if we can easily reuse it, instead of manually analyzing it, and developing a new one for ourselves.
How can we easily reuse their exploits?
This research delves into the intricate world of exploiting vulnerabilities in software systems, focusing on topics like control flow hijacking and shellcode transplanting. The study uncovers methods to manipulate the flow of vulnerable programs to execute malicious code and strategies for integrating new code into existing exploits.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Your Exploit is Mine: Automatic Shellcode Transplant for Remote Exploits Tiffany Bao, Fish Wang, Yan Shoshitaishvili, David Brumley Carnegie Mellon University & UC Santa Barbara
Exploits Denial of Service Exploits Web Applications Exploits Remote Exploits 1
Control Flow Hijacking A control flow hijacking exploit: Deviates the control flow of the vulnerable program, and Leads the program to carry out the malicious computation controlled by the attacker. 2
Control Flow Hijacking A control flow hijacking exploit: Deviates the control flow of the vulnerable program, and Leads the program to carry out the malicious computation controlled by the attacker. Shellcode 3
Steal a File Shellcode Existing Exploit 4
Steal a File Shellcode Install Malware Shellcode Existing Exploit Replacement Shellcode 5
Shellcode Transplant Steal a File Shellcode Install Malware Shellcode Existing Exploit Modified Exploit 6
Shellcode Transplant Steal a File Shellcode Install Malware Shellcode Existing Exploit Modified Exploit Replacement Shellcode 7
Shellcode Transplant f(S) S S While Executing Shellcode Existing Exploit 8
Previous Approach[1]: Symbolic Execution 9 [1] D. K. Sean Heelan. Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities.
Previous Approach: Symbolic Execution Captured Exploit 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. 10
Previous Approach: Symbolic Execution Captured Exploit 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. 23 f(s1) 90 f(s2) f(sn-1) f(sn) Memory 45 a0 11
Previous Approach: Symbolic Execution Captured Exploit 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. 23 f(s1) 90 f(s2) f(sn-1) f(sn) Memory 45 a0 2. Concretize the input with the replacement shellcode. 23 f(s1) 90 0x89 0xc4 f(sn) 45 a0 12
Previous Approach: Symbolic Execution Captured Exploit 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. f(sn-1) 23 f(s1) 90 f(s2) f(sn) Memory 45 a0 2. Concretize the input with the replacement shellcode. 23 f(s1) 90 0x89 0xc4 f(sn) 45 a0 Path Constraints Shellcode Constraints sk == 2 f(s2) == 0x89, 3. Solve the constraints. s1=0x80, s2=0x72, s3=0x08, s4=0xc3, 13
Previous Approach: Limitation Captured Exploit sk 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. f(sn-1) f(sk) 23 f(s1) 90 f(s2) f(sn) Memory 45 a0 2. Concretize the input with the replacement shellcode. 23 f(s1) 90 0x89 0xc4 f(sn) 45 a0 Path Constraints Shellcode Constraints if (sk == 2) vuln(); f(s2) == 0x89, Contradiction sk == 2 sk == 1 14
Previous Approach: Limitation Captured Exploit sk 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. f(sn-1) f(sk) 23 f(s1) 90 f(s2) f(sn) Memory 45 a0 2. Concretize the input with the replacement shellcode. 23 f(s1) 90 0x89 0xc4 f(sn) 45 a0 Path Constraints if (sk == 2) blah(); vuln(); Shellcode Constraints f(s2) == 0x89, Contradiction sk == 2 sk == 1 15
Our Work: ShellSwap Captured Exploit sk 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. f(sn-1) f(sk) 23 f(s1) 90 f(s2) f(sn) Memory 45 a0 2. Concretize the input with the replacement shellcode. 23 f(s1) 90 0x89 0xc4 f(sn) 45 a0 Path Constraints if (sk == 2) blah(); vuln(); Path Kneading Shellcode Constraints f(s2) == 0x89, Layout Remediation sk == 2 sk == 1 16
Our Work: ShellSwap Captured Exploit sk 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. f(sn-1) f(sk) 23 f(s1) 90 f(s2) f(sn) Memory 45 a0 2. Concretize the input with the replacement shellcode. 23 f(s1) 90 0x89 0xc4 f(sn) 45 a0 Path Constraints if (sk == 2) blah(); vuln(); Path Kneading Shellcode Constraints f(s2) == 0x89, Layout Remediation sk == 2 sk == 1 17
Layout Remediation Replacement Shellcode xor %esi,%esi mov %eax,0 push %ecx int 80 jmp jmp jmp jmp 18
Layout Remediation Path Constraints sk == 1 Replacement Shellcode 2 sk 19
Layout Remediation Path Constraints sk == 1 Replacement Shellcode 2 sk 20
Layout Remediation Path Constraints Shellcode Constraints sk == 1 sk == 2 Replacement Shellcode 2 sk 21
Layout Remediation Path Constraints Shellcode Constraints sk == 1 sk == 2 Replacement Shellcode 2 sk jmp 22
Layout Remediation Path Constraints Shellcode Constraints sk == 2 sk+3 == 2 sk == 1 Replacement Shellcode sk 2 jmp 23
Layout Remediation May Fail Replacement Shellcode sk 2 jmp Not Enough Space! 24
Our Work: ShellSwap Captured Exploit sk 23 s1 s2 sn-1 a0 sn 90 45 1. Execute the program with symbolic inputs. f(sn-1) f(sk) 23 f(s1) 90 f(s2) f(sn) Memory 45 a0 2. Concretize the input with the replacement shellcode. 23 f(s1) 90 0x89 0xc4 f(sn) 45 a0 Path Constraints if (sk == 2) blah(); vuln(); Path Kneading Shellcode Constraints f(s2) == 0x89, Layout Remediation sk == 2 sk == 1 25
Path Kneading Path Constraints Shellcode Constraints sk == 1 sk == 2 2 sk if (sk == 1) blah(); vuln(); foo(); return(0); Path Exploration 26
Restricting Path Exploration Explored paths are only allowed to deviate once. if (sk == 1) Original Path Explored Path yes no blah() vuln() foo() return(0) 27
Path Kneading Path Constraints Shellcode Constraints sk == 1 sk == 2 2 sk if (sk == 1) blah(); vuln(); foo(); return(0); Path Exploration 28
Path Kneading Path Constraints Shellcode Constraints sk != 1 sk == 2 2 sk if (sk == 1) blah(); vuln(); foo(); return(0); Path Exploration 29
Evaluation 20 original exploits from the Cyber Grand Challenge 5 new shellcodes from 3 different authors 20 * 5 = 100 different cases 30
Effectiveness Previous Work 100 80 60 40 31 20 0 31 [1] D. K. Sean Heelan. Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities.
Effectiveness Previous Work Layout Remediation 100 85 80 Path Kneading 57 60 40 31 31 20 0 32
Efficiency 60/85 (>70%) exploits were generated within 3 minutes. Time for Shellcode Transplant 100000 Time in Seconds 10000 1000 100 10 1 1 6 11 16 21 26 31 36 41 46 51 56 61 66 71 76 81 Generated Exploits (Sorted by Time in Ascending Order) 33
Conclusion Reusing control flow hijacking exploits can be done automatically. Symbolic execution extensions made this possible. Layout Remediation Path Kneading ShellSwap: 85% vs. Previous method: 31% 70%+ of the successful exploits can be automatically generated in 3 minutes. 34
Thank You! Questions? 35
Wait, Are We Too Evil? Automatic Proof-of-Vulnerability generation based on detected exploits from the wild Think about collateral damage 36
Effectiveness Previous Work 100 80 60 40 31 20 0 Previous Work[1] 39 [1] D. K. Sean Heelan. Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities.
