gruba

The rise of the undead (WebKit Heap Exploitation)

2011-03-04T12:46:00.011-03:00

I remember one day Pablo told me, "forget about attacking metadata, that just wont help you" (or something along those lines, sorry about the inaccuracy).
He was right, as he almost always is, in that case.

Long gone are the days where heap exploitation was all about attacking (overwriting) the internal structures of the heap allocator.

But are they really gone?

It is well known that nowadays, attacking metadata on Windows Heap it is a real pain in the rear. That's one of the reason most of the current heap research papers are focused on crafting the heap layout in order to exploit use-after-free conditions (there are some great exceptions, like Chris Valasek's research on the Low Fragmentation Heap).

But heap overflows are not restricted just to the operating system heap implementation. There are plenty of custom heap allocators in the world of Open Source Software and some of them are widely used (without most of the people noticing).

Our research case was TCMalloc. The reason? Mainly because it is used by WebKit, one of the most popular Web Browser engines out there. WebKit is responsible of rendering web pages in Chrome, Safari a huge amount of Smart Phones (yes Android uses it).
I don't like to lie to myself, owning Bas's phone was enough reason to do the research, the rest was just a bonus.

Understanding the heap allocator (as usual) was the first step in the right direction that drove the whole research to a good end.

TCMalloc is a heap allocator initially designed by Sanjay Ghemawat and Paul Menage from Google. It was designed with two main premises, speed and multi-threaded environments. This two premises drove the whole design of all the
internal structures to be almost lock free (in order to reduce lock contention) and thread local.
From an attacker perspective, this means that we are going to need to control a lot of factors if we need to succeed at exploiting vulnerabilities that involve corruption of information between threads.

The allocator itself it is not complex. It is divided in three main subsystems

Page Allocator
Central Cache Allocator
Thread Allocator

The main place where memory is obtained is at the Page Allocator. This layer of abstraction deals with the system level memory allocators. It can allocate memory from several places depending on which operating system you are on. The options are VirtualAlloc, sbrk, mmap or even /dev/mem.
At this level, memory is handled in integral multiples of a page. This groups of pages are called Spans in TCMalloc terminology.
A global array of list keeps track of each of the span the system has allocated. This array is indexed by the number of pages the span contains. That is, page_heap_freelist[N] will contain a list of free spans of N pages each.
There are 256 entries in the page_heap_freelist (this depends if you are looking at Chrome or Safari, etc.). Those spans with more than 256 pages are handled by another free list of what is called a "really large span".

The Spans serves for two main purposes:

to hold a large object
to be used by the central cache

Memory in multiples of the page size is a little bit inconvenient to use directly from the application. The Central Cache allocator is in charge of making those Spans usable by the application.
The central cache keeps track of the status of spans and also to split the spans into units that are more manageable by the application.
To do so, the central heap has an array of free lists indexed by size class. Each free list contains a set of spans which are spitted into objects of the corresponding size class.
Those objects could have been handed directly to the application, but remember that this allocator is thread oriented, so in order to serve multiple threads, many of the structures of the Central Heap should be guarded by a lock in order to prevent races and stuff that we *do not like*.

That's the reason why there is another level of abstraction. The Thread Heap is a per thread structure where the central allocator stores memory chunks. Because of the nature of per thread structures, there is no need to hold locks to access them.
The Thread Cache consists mainly of an array of free lists indexed by size class. These free lists are populated with objects by the Central Cache allocator and consumed by each thread that needs some objects.

That is basically how the algorithm and structures are tied together. With an in-depth understanding of how these subsystems interact we as attackers can start to make some assumptions about how we can force TCMalloc to be our bitch^H^H^H^H^H friend.

The next step is too take a look into where all this structures are placed and how are they connected to each other, but that my friend is something that we are going to go delve into at Infiltrate (and Immunity's Masters Class).

To give the readers a quick glance over what we have been doing lately, here is a screen-shot of a specially crafted heap layout used by a Canvas exploit to pwn your browser (yes, it will *penetrate* your phone, your windows and your fancy Mac):

To say the least, the outcome of this research was more than satisfying. From an attacker perspective, everything started to look exploitable.

Thanks for reading.

EOF

Capture The Flag!

2009-08-20T18:04:00.007-03:00

Bueno, el CTF de la Ekoparty termino. La verdad que estuvo muy interesante.
Los problemas no eran de una complejidad tecnica impresionante, sino mas bien, habia que ser un poco "creativos" si se quiere y pensar.

En mi caso particular me costaron bastante los problemas Web, no es mi campo de interes. Aunque debo decir, que bambu y RomanSoft me ayudaron bastante.

Felicitaciones a los ganadores, y el anio que viene nos encontraremos de nuevo.

http://ctf09.ekoparty.org/

Position	Username
1°	_rs_
2°	claw
3°	team_da
4°	administwitter
5°	jmbesnard
6°	bambu
7°	s3ntin3l
8°	crpdm_plus_scpx
9°	agustingianni
10°	coreadelnorte

QEMU Minimal Linux Kernel Config

2009-08-14T21:57:00.005-03:00

This is a minimal .config file for the Linux Kernel (2.6.30.4) that allows you to run this QEMU Image http://www.qemu.org/linux-0.2.img.bz2

Config File

One of the uses I gave to this minimal configuration is kernel development.
One of the benefits of using this .config file is that the compiling time is drastically reduced and also the code size of the kernel is reduced.

To run qemu with the bzImage of your kernel, copy the .config to your source directory
and compile as usual (make all, maybe). Then use the recently compiled image to run QEMU

gr00vy@kenny:~/OSDev/Qemu$ qemu -hda linux-0.2.img -kernel ../linux-2.6.30.4/arch/i386/boot/bzImage -k es -append "root=\"/dev/hda\" ro"

Django on Eclipse (PyDEV)

2009-08-07T19:38:00.004-03:00

This is a quickie.

To enable autocompletion in Eclipse (using Pydev plugin) you have to add the right path so the indexer can parse all the Django python files.
One way (that worked for me) is to:

gr00vy@kenny:~$ python
Python 2.6.2 (release26-maint, Apr 19 2009, 01:56:41)
[GCC 4.3.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import django
>>> print django
module 'django' from '/var/lib/python-support/python2.6/django/__init__.pyc'
>>>

Im my case, that directory has symlinks to the real files. I added that path and it did not work, there should be no reason for it to not work but it didn't.
So we have to add the path where the symlinks points, and that is:

gr00vy@kenny:~$ ls -l /var/lib/python-support/python2.6/django/
lrwxrwxrwx 1 root root 58 2009-08-01 18:29 __init__.py -> /usr/share/python-support/python-django/django/__init__.py

And that's it the correct path is: /usr/share/python-support/python-django/django/

Now we open Eclipse, we go into Windows->Preferences->Pydev->Interpreter-Python and we add that path to PYTHONPATH.

We hit apply or OK and there you have it!.

Math Challenges

2007-07-25T23:15:00.000-03:00

Hi! Now that I am in Winter vacations I have some spare time to play with www.projecteuler.net challenges.

Project Euler is a site that contains a about 160 mathematic/programming challenges that you have to solve. There is no time limit to solve them, you just submit the answer whenever you want.

This is a really nice game to enjoy/learn/practice. I hope you enjoy it as much as I do.

Cheers!

File Fuzzer

2006-11-21T01:34:00.000-03:00

Hello, now im writting to release a little file fuzzer.
It has been very useful for me, but now im bored of it, so its time for other people to play with it.

Characteristics:

- Can trace deep into child child's. (Fuzzer->Child0->Child1->...->ChildN) :)
- You can define the file structure and then pass it to the fuzzer.
- It can "learn" the file format (In the case of ASCII Input files).
- Pretty fast (Compared to other file fuzzers).
- Works on Linux (Full support) and FreeBSD (No ptrace support, but it is not difficult to make the port, just change some #defines and then you will be OK).
- No makefile :P

Sample Output:

gr00vy@kenny:~/ffuzer/src$ ./gwar -D -i ../iput.elf -o ../tmp/output.elf -r -52 -t 3 -m 5 "/usr/bin/readelf -a %FILENAME%"
[%] Logging to readelf.log
[%] Loaded 190 fuzzing variables
[%] Fuzzing from 0 to 52
[%] Number of files to be generated 10070
[%] Proceding with fuzzing
[%] Byte [ 52] FuzzString [ 0] Process [ 0] Bugs? [40]
[%] Time elapsed 79.000000
[%] Number of succesful executions 10070
[%] Skipped executions due to fuzzing string size 0
[%] Number of "bugs" found: 40

Sample Bug Report

[i] Signal: Unknown signal 127
[i] Fuzzing string: 186 Offset: 52
[i] Detail: address not mapped to object - Address of exception: 0x4949e961
Registers dump:
---------------

eax = 0x4949e961 ebx = 0x00004141 ecx = 0x00000000
edx = 0x0806853c esi = 0x00001274 edi = 0x0808921f
ebp = 0xbfb8a398 esp = 0xbfb8a360 eip = 0x080685bf

Stack frame dump:
-----------------

0xbfb8a360: 84 a3 b8 bf 5d 5c e4 b7 a4 a3 b8 bf 98 08 08 08 ....]\..........
0xbfb8a370: f4 cf f3 b7 04 00 00 00 1f 92 08 08 98 a3 b8 bf ................
0xbfb8a380: 03 68 e6 b7 c0 d4 f3 b7 8e 08 08 08 41 41 00 00 .h..........AA..
0xbfb8a390: 74 12 00 00 1f 92 08 08 t.......

Disassembly dump:
-----------------

806858d ADD [EAX], AL
806858f ADD CL, CH
8068591 CMPSD
8068592 ADD [EAX], EAX
8068594 ADD [EBX-0x49f0f7bb], CL
806859a ADD [EDI], CL
806859c MOV DH, 0xd0
806859e MOV EAX, [EBP+0x8]
80685a1 INC EAX
80685a2 MOVZX EAX, BYTE [EAX]
80685a5 MOVZX EAX, AL
80685a8 SHL EAX, 0x8
80685ab OR EAX, EDX
80685ad MOV [EBP-0x20], EAX
80685b0 MOV DWORD [EBP-0x1c], 0x0
80685b7 JMP 0x806873c
80685bc MOV EAX, [EBP+0x8]
EIP -> 80685bf MOVZX EAX, BYTE [EAX]

Thats all for now, if you have any suggestions, please leave a comment.

Web
Download

Visualizing Memory Graphs

2006-03-05T00:02:00.000-03:00

Visualizing Memory Graphs - Software Engineering Chair (Prof. Zeller) - Saarland University

I found this pdf article very cool. I think it is worth to take a read to it.

Ethical Hacking and Computer Forensics: Fuzzers - The ultimate list

2006-03-04T04:42:00.000-03:00

Ethical Hacking and Computer Forensics: Fuzzers - The ultimate list

This is a very cool page with links to many useful fuzzers. Well not all of them are useful, but, you can always read them and implement your own with the capabilities that best fits you.

David S. Miller's Linux Networking Homepage

2006-03-01T22:42:00.000-03:00

David S. Miller's Linux Networking Homepage

This web has a very interesting description about sk_buffer's and linux kernel networking internals.

IDA-Pro 5.0

2006-02-25T05:54:00.000-03:00

A preview of the next release of IDA, it seems to be great!. I can't wait to test it.

Preview!

Meeting

2005-11-28T23:33:00.000-03:00

Fotos de la meeting que se llevo a cabo en el Bloque II el dia Domingo :)

Pictures of the meeting that took place last Sunday.

Lo que el hambre se llevo

2005-11-13T01:26:00.000-03:00

Esperamos pero nadie llego,

arrancamos y nada ya quedo.

Fractals!

2005-10-31T23:30:00.000-03:00

Hello there, this post is about a little program I coded recently. Its about fractals, attractors and leaves, all generated by mathematical expressions. Its very nice to see how a mere formula can generate that kind of beautiful pictures.

The program is coded in c, using OpenGL, Gtk and Gtk widget extension. You might have problems with deps so try to look for gtkglext library.

I hope you like the demo images!

facturas-0.1.tar.gz

Whenever you start the program please click the clear button to fix the image, yes I know, im lazy, sorry ill fix it, but not now.

Classical Mandelbrot :) Thanks to beck for genbox.c!!!

A Mandelbrot but zoomed in!

Fire fire fire!!!

Mandelbrot with sin(x) :)

First post

2005-10-29T21:22:00.000-03:00

I dont know what to post so ill wait until something pops up (?)

This is a picture of me in South Park Colorado.