\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 03, King's College London}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (3)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

  \normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Buffer Overflow Attacks}

\begin{center}

\begin{columns}[b]

\begin{column}{.4\textwidth}

\centering

\includegraphics[scale=0.3]{../pics/barrier.jpg}\\

lectures so far

\end{column}

\begin{column}{.4\textwidth}

\centering

\includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\

today

\end{column}

\end{columns}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Smash the Stack for Fun\ldots}

\begin{itemize}

\item \alert{\bf Buffer Overflow Attacks (BOAs)} or\\ 

{\bf Smashing the Stack Attacks}\medskip

\item unfortunately one of the most popular attacks\\ 

($>$ 50\% of security incidents reported at CERT are related 

to buffer overflows)

\begin{flushright}

\small\url{http://www.kb.cert.org/vuls}

\end{flushright}

\medskip

\item made popular in an article from 1996 by Elias Levy

(also known as Aleph One):\\

\begin{center}

{\bf ``Smashing The Stack For Fun and Profit''}

\end{center}\medskip

\begin{flushright}

\small\url{http://phrack.org/issues/49/14.html}

\end{flushright} 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A Long Printed ``Twice''}

\mbox{}\\[-10mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C0.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Printing Out ``Zombies''}

\mbox{}\\[-10mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C1.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Login'' Function (1)}

\mbox{}\\[-10mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C2a.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Login'' Function (2)}

\mbox{}\\[-10mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=-3mm]{../progs/C2b.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{What the Hell Is Going On?}

\begin{itemize}

\item Let's start with a very simple program:

\end{itemize}

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/example1.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Memory}

\begin{itemize}

\item each process will get a chunk of memory that is

      organised as follows: 

\end{itemize}

\begin{center}

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-3) grid (3,3);

  \draw[line width=1mm] (-2, -3) rectangle (2,3);

  \draw[line width=1mm] (-2,1) -- (2,1);

  \draw[line width=1mm] (-2,-1) -- (2,-1);

  \draw (0,2) node {\large\tt text};

  \draw (0,0) node {\large\tt heap};

  \draw (0,-2) node {\large\tt stack};

  \draw (-2.7,3) node[anchor=north east] {\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};

  \draw (-2.7,-3) node[anchor=south east] {\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};

  \draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);

  \draw (2.7,-2) node[anchor=west] {\tt grows};

  \draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};

  \draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};

  \draw[|->, line width=1mm] (2.5,-3) -- (2.5,-1);

  \end{tikzpicture}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Stack}

\begin{textblock}{7}(1,1)

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-1) grid (3,8);

  \draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);

  \draw[line width=1mm] (-1,-1.2) -- (-1,7.4);

  \draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);

  \draw (0,-1) node[anchor=south] {\tt main};

  \draw[line width=1mm] (-1,0) -- (1,0);

  \draw (0,0) node[anchor=south] {\tt arg$_3$=3};

  \draw[line width=1mm] (-1,1) -- (1,1);

  \draw (0,1) node[anchor=south] {\tt arg$_2$=2};

  \draw[line width=1mm] (-1,2) -- (1,2);

  \draw (0,2) node[anchor=south] {\tt arg$_1$=1};

  \draw[line width=1mm] (-1,3) -- (1,3);

  \draw (0,3.1) node[anchor=south] {\tt ret};

  \draw[line width=1mm] (-1,4) -- (1,4);

  \draw (0,4) node[anchor=south] {\small\tt last sp};

  \draw[line width=1mm] (-1,5) -- (1,5);

  \draw (0,5) node[anchor=south] {\tt buf$_1$};

  \draw[line width=1mm] (-1,6) -- (1,6);

  \draw (0,6) node[anchor=south] {\tt buf$_2$};

  \draw[line width=1mm] (-1,7) -- (1,7);

  \draw (2,6.1) node[anchor=south] {\code{$esp}};

  \draw[<-,line width=0.5mm] (1.1,7) -- (2.5,7);

  \draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5) -- (1.8, 0) -- (1.1,0); 

  \draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);

  \draw (2.6,3.1) node[anchor=south west] {\tt back to main()};

  \draw[->,red,line width=2mm] (2.5,0.1) -- (4.2,0.1);

\end{tikzpicture}

\end{textblock}

\begin{textblock}{7}(6.4,8)

\begin{bubble}[6.8cm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=5mm]{../progs/example1.c} 

\end{bubble}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Behind the Scenes}

\only<2->{

\begin{textblock}{7}(1,0.6)

\begin{bubble}[6.8cm]

\footnotesize

\lstinputlisting[language=C,

                 xleftmargin=5mm,

                 belowskip=-1mm,

                 aboveskip=-1mm]{../progs/example1.c} 

\end{bubble}

\end{textblock}}

\only<2>{

\begin{textblock}{7}(0.5,6.6)

\footnotesize

\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl},xleftmargin=5mm,numbers=none]{../progs/example1a.s} 

\end{textblock}}

\only<3>{

\begin{textblock}{7}(0.5,6.6)

\footnotesize

\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl,movw},xleftmargin=5mm,numbers=none]{../progs/example1b.s} 

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Overwriting the Stack}

\begin{textblock}{7}(1,2)

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-1) grid (3,8);

  \draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);

  \draw[line width=1mm] (-1,-1.2) -- (-1,6.4);

  \draw[line width=1mm] ( 1,-1.2) -- ( 1,6.4);

  \draw (0,-1) node[anchor=south] {\tt main};

  \draw[line width=1mm] (-1,0) -- (1,0);

  \draw (0,0) node[anchor=south] {\tt arg$_3$=3};

  \draw[line width=1mm] (-1,1) -- (1,1);

  \draw (0,1) node[anchor=south] {\tt arg$_2$=2};

  \draw[line width=1mm] (-1,2) -- (1,2);

  \draw (0,2) node[anchor=south] {\tt arg$_1$=1};

  \draw[line width=1mm] (-1,3) -- (1,3);

  \draw (0,3.1) node[anchor=south] {\tt ret};

  \draw[line width=1mm] (-1,4) -- (1,4);

  \draw (0,4) node[anchor=south] {\small\tt last sp};

  \draw[line width=1mm] (-1,5) -- (1,5);

  \draw (0,5) node[anchor=south] {\tt buf};

  \draw[line width=1mm] (-1,6) -- (1,6);

  \draw (2,5.1) node[anchor=south] {\code{$esp}};

  \draw[<-,line width=0.5mm] (1.1,6) -- (2.5,6);

  \draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5);

  \draw (2.5,4.1) node[anchor=south] {\code{BBBB}};

  \draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);

  \draw (2.6,3.1) node[anchor=south west] {\tt jump to \code{\\x080483f4}};

\end{tikzpicture}

\end{textblock}

\begin{textblock}{7}(1,13.5)

\code{char buf[8] = "AAAAAAAABBBB\\xf4\\x83\\x04\\x08\\x00"}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{C-Library Functions}

\begin{itemize}

\item copy everything up to the zero byte

\end{itemize}\medskip

{\small

\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Payloads}

\begin{itemize}

\item the idea is that you store some code in the buffer (the payload)

\item you then override the return address to execute this payload\medskip

\item normally you want to start a shell\pause

\item difficulty is to guess the right place where to ``jump''

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Starting a Shell}

\small

\lstinputlisting[language=C,numbers=none,xleftmargin=-6mm]{../progs/o2.c}

\begin{textblock}{7}(5,7.5)

\begin{bubble}[7cm]

\lstinputlisting[language=C,numbers=none,xleftmargin=-0mm]{../progs/shell.c}

\end{bubble}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Avoiding \texttt{$\backslash$x00}}

\begin{itemize}

\item another difficulty is that the code is not allowed to contain \texttt{$\backslash$x00}:

\begin{center}

\texttt{xorl   \%eax, \%eax}

\end{center}

\end{itemize}\bigskip\bigskip

{\small

\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{String from the Web}

{\small

\lstinputlisting[language=C,numbers=none,xleftmargin=-6mm]{../progs/o1.c}}

\bigskip\bigskip

\noindent 

More ``interesting'' shell programs can be found at 

\begin{center}

\url{http://shellblade.net/shellcode.html}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Overflow.c}

\mbox{}\\[-10mm]

\small

\lstinputlisting[language=C,xleftmargin=-4mm,numbers=none]{../progs/overflow.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Optimising Success}

\begin{center}

\begin{tabular}{l@{\hspace{2cm}}l}

  \begin{tikzpicture}[scale=0.6]

  \draw[line width=1mm] (-2, -1) rectangle (2,3);

  \draw[line width=1mm,fill=blue!30] (-2, 1.9) rectangle (2,3);

  \draw (0,2.5) node {\small\tt shell code};

  \draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);

  \draw[->,line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --

  (-3,-1.7) -- (-3, 3.7) -- (-1.9, 3.7) -- (-1.9, 3.1);

   \end{tikzpicture}

&

 \onslide<2>{

 \begin{tikzpicture}[scale=0.6]

  \draw[gray!50,fill=red!30] (-2,0.3) rectangle (2,3);

  \draw[line width=1mm] (-2, -1) rectangle (2,3);

  \draw[line width=1mm,fill=blue!30] (-2, 0.3) rectangle (2, -0.7);

  \draw (0,-0.2) node {\small\tt shell code};

  \draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);

  \draw [line width=0.5,decoration={brace,amplitude=2mm},decorate] 

    (2.3,3) -- (2.3,0.3);

  \draw[line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --

  (3,-1.7) -- (3,1.65) -- (2.6, 1.65);

  \end{tikzpicture}}

\end{tabular}

\end{center}\bigskip

\onslide<2>{  

fill up the red part of the string with \pcode{NOP} operations

(Intel \texttt{$\backslash$x90})}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Why BOAs Work?}

\begin{itemize}

\item stack grows from higher addresses to lower addresses

\item library functions copy memory until a zero-byte is 

encountered

\end{itemize}

\begin{center}

\begin{tabular}{@{\hspace{-7mm}}c@{\hspace{2mm}}c@{}}

\small

\begin{tikzpicture}[scale=0.45]

  %\draw[step=1cm] (-3,-3) grid (3,3);

  \draw[line width=1mm] (-2, -3) rectangle (2,3);

  \draw[line width=1mm] (-2,1) -- (2,1);

  \draw[line width=1mm] (-2,-1) -- (2,-1);

  \draw (0,2) node {\tt text};

  \draw (0,0) node {\tt heap};

  \draw (0,-2) node {\tt stack};

  \draw (-2.7,3) node[anchor=north east] 

     {\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};

  \draw (-2.7,-3) node[anchor=south east] 

     {\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};

  \draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);

  \draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};

  \draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};

  \draw[|->, line width=1mm] (2.5,-3.09) -- (2.5,-1);

  \end{tikzpicture}

&  

\raisebox{1.3cm}{\footnotesize

\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}

\end{tabular}  

\end{center}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Variants}

There are many variants:

\begin{itemize}

\item return-to-lib-C attacks

\item heap-smashing attacks\\

\textcolor{gray}{\small(Slammer Worm in 2003 infected 90\% of vulnerable systems within 10 minutes)}\bigskip

\item ``zero-days-attacks'' (new unknown vulnerability)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}

            Protections against\\

            Buffer Overflow Attacks