Reference no: EM133227692

Secure Software Systems Assignment - Lab in secure software systems

Lab - Buffer Overflow

Exercise: Buffer Overflow

The Buffer Overflow vulnerability has been discovered as early as 1972, and has long been among the most critical application security flaws. It is still very relevant today. This vulnerability happens when a program writes in a buffer, and overrunns its boundaries, writing in the adjacent memory locations. Because data (buffers) and control (return addresses) storage are mixed, buffer overflows can allow malicious users to execute arbitrary pieces of code, for example. In this lab, you will get an experience of this attack, and understand how it works.

1. Lab setup

1.1 Buffer overflows

(a) The program in Figure 1 contains a buffer overflow vulnerability. Locate the line where it occurs. Which simple countermeasures could one take to fix the code?

(b) Suppose that str is composed of 20 characters. Draw the stack frame for bof. Mark the direction in which the stack grows. In which direction does strcpy write? How does the program know where to continue executing when it finishes executing bof?

(c) What happens when str is composed of 517 characters? Draw the stack. What will the program do when it finishes executing bof?

(d) Draw what the stack should look like for a successful buffer overflow attack. Note that badfile is controlled by the user, and contains your shellcode, ie. The malicious code that you want executed.

1.2 gdb

For this lab, you will need to use a disassembler. gdb is installed on the Linux VM. You can also use other tools if you are more familiar with them, but this does not exempt you from gdb-specific questions.

Save the code in Figure 1. Compile it and run it with gdb. What are the commands for the following tasks:

(a) Run the program

(b) List the registers

(c) List the functions

(d) Print the assembly code for a function

(e) Set a breakpoint

(f) Print a stack frame

1.3 Ubuntu security mechanisms

In Linux, several security mechanisms are implemented to hamper buffer overflow attacks. We first need to disable them.

(a) What is Address Space Randomization? Briefly explain how this mechanism helps against buffer overflow attacks.

Disable ASR: sysctl -w kernel.randomize_va_space=0

(b) StackGuard is a protection mechanism implemented by the GCC compiler. This set of patches will prevent buffer overflows from working. Which gcc option allows to compile a program with StackGuard disabled?

(c) Ubuntu used to allow executable stacks but for security reasons, a program now has to declare whether it requires executable stacks or not. The decision of making the stack executable or not is taken by the Kernel or the dynamic linker. What is the gcc option to mark an executable's header with the executable stack flag? The non-executable flag?

2. Attack

2.1 Preparing the attack

(a) For a buffer overflow attack, you need a shellcode. The shellcode you will use is stored in the variable below. What does it do?

Verify that the shellcode works by running the main function. When compiling it, make sure to enable the require executable stack option.

(b) What are Set-UID programs? What are they typically used for? Which commands can be used to make a regular program a Set-UID program?

(c) For the exploit to work, you will also need vulnerable code. Save the code from Figure 1 in vulnerable.c. Compile it, making sure that StackGuard is disabled and executable stacks are required. Set the executable's owner as root and make it Set-UID program. If, from a normal user account, you run the vulnerable program, with which privileges will it run?

(d) The badfile is under control of the user. Imagine that the file contains your shellcode. What should happen when the vulnerable program is run?

2.2 Exploiting the vulnerability

(a) To make your exploit work, you need to craft a suitable badfile. Complete the following code snippet so that your exploit works in gdb. Join your code to your report and detail why and how you crafted your payload. Screenshots are welcome.

(b) Does your exploit work when running it outside of gdb? Why? What could you do so that it works?

(c) What is the user id of your new process? What should you change to get a real root process? Explain why.

3. Securities

3.1 Address Randomization

(a) Enable ASR: sysctl -w kernel.randomize_va_space=2. What should happen when you run the vulnerable program?

(b) Your program will not work every time you run it. Why? What can you do to get it to work more often?

3.2 StackGuard

Make sure ASR is disabled: sysctl -w kernel.randomize_va_space=0.

(a) Recompile your vulnerable program without the disabled StackGuard option. Does your exploit still work? Report your observations.

3.3 Non-executable Stack

Make sure ASR is disabled: sysctl -w kernel.randomize_va_space=0.

(a) Recompile your vulnerable program with the non-executable flag on. Does the exploit work? Report your observations.

(b) Does the non-executable stack protection mechanism prevent any buffer overflow attack from working? If yes, explain why. If no, give a short example of a working attack.

4. Conclusion

Summarize what you learnt about the Buffer Overflow attack. Include the following observations:

What is it? Why is it dangerous?

What are the requirements to launch such an attack? (outside of security mechanism concerns)

What are the current protections in Ubuntu against buffer overflows? Can they prevent any type of buffer overflow attack?

What should a developer be especially wary about in order to avoid such attacks?

Attachment:- Secure Software Systems Assignment File.rar