Malware
● Rootkit: you cannot conclude that the machine has not been compromised through network traffic
tools. Because the malware can hide its own traffic from tools running on the compromised
machine. You could inspect network traffic using an external machine as a MitM between your
machine and the router. If it’s a BIOS rootkit, change PC, otherwise reinstall Os or swap HD.
● Avoid Signature detection: Employing polymorphism/metamorphism/obfuscation/packing. The idea
is to modify the payload of the malware, so as to evade the known signature, without changing its
malicious behavior.
● Known malware downloaded over HTTP: From the point of view of the company’s IT department,
enforcing all traffic to pass via a proxy and scan the payload with an AV could have prevented that.
Also, an AV on the endpoint given it was known malware. From the point of view of the software
house, deliver the update over HTTPS and\or implement a form of digital signature check of any
update package.
Memory errors
BOF -> String of arbitrary length copied in stack buffer; SOLUTION: scanf (“%15s”,s);
FS -> supplied directly from untrusted user through CLI; SOLUTION: printf(“%s”,s);
ASLR
Stack non ex.
Stack canary
Buffer overflows
No, address of the stack
randomized
No, we can’t jump to our
shellcode
No, see below
Format Strings
No
No
Yes
Solution
(attacker pov)
Must have a leak
Ret2libc => execute
system function in libc
to obtain a shell
Read the value (e.g. w a
disass.) and include it in
the exploit
Solution
(victim pov)
Do not leak
ASLR
Random value at
runtime + pushed on a
register
● STACK CANARY: The underlined code implements a stack canary as a mitigation against stack-based
buffer overflows. When writing past the end of a stack-allocated buffer, one would overwrite the
variable x before overwriting the saved EIP. Before returning from the function, the content of the
variable x is checked against the original value: if they differ, a buffer overflow is detected and the
program aborts without returning from the function (i.e., without triggering the exploit). In this case, the
stack canary is a static value (0xBAAAAAAD): if the binary is available, it is enough to retrieve this
value by reverse engineering the program; then, during the exploitation it is enough to overwrite the
stack canary with this (known) value. To fix this issue, the stack canary should be randomized at the
program startup and placed in a register.
● RET2LIBC: Write string ‘/bin/secret’ in buffer, overwrite sEIP with address of system(), then overwrite 8
bytes more for the system() EIP to exit and for the pointer to the buffer, so that when jumping into the
system() function, this pointer will be where system() expects the parameter and will complete
execution.
● If ASLR randomizes only the libraries and the stack\heap, using ROP with gadgets in the text section. If
the binary is PIE, we can bypass ASLR only if there’s another vulnerability which gives a leak of some
stack or libc address. In this case, we could use the format string vuln as a leak, but we would have
already sent the input to the program --- thus, in this case we have no way to bypass ASLR to exploit
the buffer overflow, unless we use more advanced techniques that are out of the scope of this course.
