HackSim : An Automation of Penetration Testing POSTECH HPC Lab. 이 승민 2004-07-29 Hacksim

HackSim : An Automation of PenetrHackSim : An Automation of Penetration Testingation Testing

POSTECH HPC Lab.POSTECH HPC Lab.이 승민이 승민

2004-07-292004-07-29

HacksimHacksim

2004-07-29 HackSim Project 2/24

ContentsContents

Introduction

Tutorials for Two Issues

• Safe Pen-Test for Windows

• Remote Exploit Codes for Windows

Demo (?)


IntroductionIntroduction

주제 : Windows 취약점 증명 기술 연구 (2004 년 )

연구 내용• Worm 과 같은 악성 코드에 사용되는 Windows 공격 기술에 대한 분석 • 버퍼오버플로우와 같이 원격 공격 가능한 취약점에 대해 연구• 공개된 원격 공격 코드에 대한 분석 및 모의 해킹 실험

• 여러 공격 코드 간의 코드 재사용이 가능한 프레임워크를 제안

• 전년도에 구현된 Solaris 에 대한 Pen-Test 도구를 Windows 로 확장

이전 과제 : Solaris 취약점 증명 기술 연구• 취약점 증명 프레임워크에 대한 연구 (2002 년 )

• 취약점 증명 프레임워크 확장에 대한 연구 (2003 년 )

지원 기관 : 국가보안기술연구소

Safe Pen-Test for WindowsSafe Pen-Test for Windows


Contents of Safe Pen-TestContents of Safe Pen-Test

Introduction

Using Kernel Service

Jump to the Shellcode• Brute Force & Offline Attack• Safe Jump

Conclusion

Future Works


IntroductionIntroduction

Application Crash• After attack, Application often ends with a crash.• Such behavior may be easily notified and the attack may be detected.• In some cases it may influence the whole system stability.• In multithreaded application, the whole application is terminated.

Each stage must work correctly.• Loading shellcode to the target host• Jumping to the start address of shellcode• Using kernel service• Termination


Using Kernel ServiceUsing Kernel Service

System call in Windows• Windows support system calls but it is limited.• Use Windows API functions located in DLL.

To use Windows API Functions• Load DLL (Dynamic Linked Library)• Base address of DLL• Offset of API functions in DLL

Solution• Find kernel32.dll base address using PEB.• Get offset from PE EDT.


Jump to the ShellcodeJump to the Shellcode

What we need to know• Buffer size• Start address of shellcode

How to know• Brute force attack• Offline attack

0xFFFFFFFF

0x00000000

Return address

Start Address

Buffer


Brute Force & Offline AttackBrute Force & Offline Attack

Windows do not allow Brute force attack. Process or Thread creation uses CreateProcess/CreateThread function.

• Internally calls BaseProcessStart/BaseThreadSTart in kernel32.dll.

Knowing buffer size is trivial in offline attack. Knowing start address of buffer in memory

• Thread stack allocates consecutively in multithread.• Start address dependes on versions of Windows and service packs.

VOID BaseProcessStart(PROCESS_START_ROUTINE pfnStartAddr) {

__try {

ExitThread((pfnStartAddr)());

}

__except(UnhandledExceptionFilter(GetExceptionInformation())) {

ExitProcess(GetExceptionCode());

}

}

Jump to the Shellcode (2/4)


Safe JumpSafe Jump

Use ‘jmp esp’ instruction• 0xFFE4 in kernel32.dll

void g() {

char buf[8];

strcpy(buf,shellcode);

}

void f() {

char buf[200];

g();

}

Before strcpy After strcpy

espstack of g()

0xFFFFFFFF

Return Address

Return Address

stack of f()

ebp

0x00000000

espstack of g()

0xFFFFFFFF

Return Address

stack of f()

ebp

0x00000000

0x77E44BBD

0xFFE4 0x77E44BBD

0x9090…9090



Safe Jump (Cont.)Safe Jump (Cont.)

After Return

Large Buffer Case

esp

stack of g()

0xFFFFFFFF

Return Address

stack of f()

ebp

0x00000000

0x77E44BBD

0xFFE4 0x77E44BBD

0x9090…9090

esp

stack of g()

0xFFFFFFFF

Return Address

stack of f()

ebp

0x00000000

0x77E44BBD

0xFFE4 0x77E44BBD

SUB ESP, 0xCC

0xFFE4


void g() {

char buf[200];

strcpy(buf,shellcode);

}

void f() {

char buf[8];

g();

}


ConclusionConclusion

Windows doesn’t allow brute force attack.

The image of ‘jmp esp’ makes it easy to guess the start address of shellcode in multithread envionment.

• Load shellcode in caller stack

• One more jump to the callee stack

It might work well in dynamic stack method.

But ‘jmp esp’ instruction locates different from versions of Windows and service packs.


Future WorksFuture Works

Safe Jump• Survey the image of ‘jmp esp/ebx’.• Implement powerful OS Fingerprinting tools.

Safe Termination• ExitThread function works well currently.• We need to verify this method.

Remote Exploit CodesRemote Exploit Codesfor Windowsfor Windows


Contents of Remote ExploitContents of Remote Exploit

Get the Remote Shell• Issues for Getting the Remote Shell

Get the Remote Exploit • Public Exploit Codes

• Candidate RPC DCOM LSASS

• Analysis Process

Future Work


Issues for Getting the Remote ShellIssues for Getting the Remote Shell

Loading ws2_32.dll using LoadLibrary()• Push the string “ws2_32” to stack.• Call LoadLibraryA() function.

Redirecting standard input, output and error to socket• Set the value of hStdInput, hStdOutput, hStdError to connected s

ocket in STARTUPINFO struct.• Set the value bInheritHandles to true among arguments of Create

Process() function.

Implementation• Bind Shellcode• Reverse Shellcode

Get the Remote ShellGet the Remote Shell


Bind ShellcodeBind Shellcode

shellcodestackoverflow

listenport 4320

commandshell

vulnerable host attacker

achievecommand

shell

connect 4320



Reverse ShellcodeReverse Shellcode

shellcodestackoverflow

listenport 4320

commandshell

vulnerable host attacker



Mechanism of Reverse ShellcodeMechanism of Reverse Shellcode

find_kernel32

startup

kernel32_symbol_hashes

ws2_32_symbol_hashes

find_function

resolve_kernel32_symbols

resolve_symbols_for_dll

resolve_winsock_symbols : Call LoadLibraryA

initialize_winsock : Call WSAStartup

create_socket : Call WSASocket

do_connect : Call connect

initialize_process

execute_process : Call CreateProcessA

wait_for_exit : Call WaitForSingleObject

close_fd : Call closesocket

exit_thread : Call ExitThread

kernel32.dll 과 관련되 있는 symbol(function) 들의 address 를 알아낸다 .

ws2_32.dll 과 관련되 있는 symbol(function) 들의 address 를 알아낸다 .

attacker 에게 command 창을 건네준다 .

attacker’s command 창이 종료되길 기다린다 .

client socket 을 닫는다 .

공격 code 를 끝마친다 .

attacker 에게 접속할 socket 를 만든다 .

attacker 에게 접속한다 .

shell command 를 만들기 위한 process 를 초기화 시킨다 .여기서 Local shellcode 와 다른 점은 STARTUPINFO struct 의hStdInput, hStdOutput, hStdError 의 값을 socket 으로 설정해야 한다 .또한 , CreateProcess 의 bInheritHandles 를 True 로 지정한다 .

socket 를 만들기 위해 필요한 준비를 한다 . (windows programming)

kernel32.dll 의 base address 를 알아낸다 .



Mechanism of Bind ShellcodeMechanism of Bind Shellcode

find_kernel32

startup

kernel32_symbol_hashes

ws2_32_symbol_hashes

find_function

resolve_kernel32_symbols

resolve_symbols_for_dll

resolve_winsock_symbols : Call LoadLibraryA

initialize_winsock : Call WSAStartup

create_socket : Call WSASocket

bind : Call bind

listen : Call listen

accept : Call accept

execute_process : Call CreateProcessA

wait_for_exit : Call WaitForSingleObject

close_fd : Call closesocket

exit_thread : Call ExitThread

kernel32.dll 과 관련되 있는 symbol(function) 들의 address 를 알아낸다 .

ws2_32.dll 과 관련되 있는 symbol(function) 들의 address 를 알아낸다 .

attacker 에게 command 창을 건네준다 .

attacker’s command 창이 종료되길 기다린다 .

client socket 과 server socket 을 닫는다 .

공격 code 를 끝마친다 .

attacker 가 접속할 socket 를 만든다 .

attacker 의 접속을 기다릴 준비를 한다 .

attacker 의 접속을 기다린다 .

attacker 의 접속을 받아들인다 .

socket 를 만들기 위해 필요한 준비를 한다 . (windows programming)

kernel32.dll 의 base address 를 알아낸다 .

initialize_process shell command 를 만들기 위한 process 를 초기화 시킨다 .



Public Exploit CodesPublic Exploit Codes

RPC DCOM

RPC Locator Service

MSSQL2000 UDP

Real Player Server

Workstation Service

Telnet Service

Samba Share Resource

LSASS

RPC DCOM

LSASS

Get the Remote Exploit Get the Remote Exploit


CandidateCandidate

RPC DCOM Vulnerability• Blaster worm is a worm that exploits the DCOM RPC vulnerability

described in Microsoft Security Bulletin MS03-026 and MS03-039.

• Port 135(epmap : DCE endpoint resolution)

LSASS Vulnerability• Sasser worm is a worm that attempts to exploit the vulnerability

described in Microsoft Security Bulletin MS04-011.• Port 445(microsoft-ds : Microsoft-DS)

Why we do select them ?• Exploit codes for general system services• Used in popular worms



Analysis ProcessAnalysis Process

Checkpoint• shellcode• return address

DCOM exploit• It operated for english windows XP.• We found the image of return address in english windows.• We got the address of the image in korean windows.• Using the address, it operates for korean windows.

LSASS exploit• The image is “jmp esp” or “jmp ebx” in kernel32.dll, etc.• We used the address of them as a return address.



Future WorkFuture Work

Survey more vulnerabilities.

Analyze & modularize selected exploit codes.• RPC DCOM • LSASS

Propose a pen-testing framework for windows.

Adapt exploit codes in linux environments.

Documents

HackSim : An Automation of Penetration Testing POSTECH HPC Lab. 이 승민 2004-07-29 Hacksim