312 lines
14 KiB
TeX
312 lines
14 KiB
TeX
\documentclass[usenames,dvipsnames]{beamer}
|
|
|
|
\usepackage{xcolor}
|
|
\usepackage[utf8]{inputenc}
|
|
\usepackage{listings}
|
|
\usepackage{tikz}
|
|
\usepackage[style=alphabetic,giveninits=true,terseinits=true]{biblatex}
|
|
\usepackage{graphicx}
|
|
|
|
\usetikzlibrary{matrix, positioning, decorations.pathreplacing, overlay-beamer-styles}
|
|
|
|
\definecolor{tumblue}{RGB}{0,101,189}
|
|
\definecolor{dkgreen}{rgb}{0,0.6,0}
|
|
\definecolor{mauve}{rgb}{0.58,0,0.82}
|
|
\lstset{
|
|
basicstyle=\footnotesize\ttfamily,%
|
|
columns=fullflexible,%
|
|
keywordstyle=\bfseries\color{blue},%
|
|
commentstyle=\color{dkgreen},%
|
|
stringstyle=\color{mauve},%
|
|
}
|
|
|
|
\DeclareFieldFormat{url}{\href{#1}{\resizebox{!}{2ex}{\lower3pt\hbox{\pgfuseimage{beamericononline}}}}}
|
|
\addbibresource{slides.bib}
|
|
|
|
\setbeamerfont{footnote}{size=\tiny}
|
|
\renewcommand\footnoterule{}
|
|
\usecolortheme{orchid}
|
|
\setbeamertemplate{navigation symbols}{}
|
|
\setbeamertemplate{sidebar right}{% also implies no navbar
|
|
\llap{\tikz\fill[tumblue,scale=.1] (0,0) ++(-5cm,-5cm) ++(-10cm,0)
|
|
+(0cm,0cm) -- +(4cm,0cm) -- +(4cm,-4cm) -- +(5cm,-4cm) -- +(5cm,0cm) --
|
|
+(10cm,0cm) -- +(10cm,-5cm) -- +(9cm,-5cm) -- +(9cm,-1cm) --
|
|
+(8cm,-1cm) -- +(8cm,-5cm) -- +(7cm,-5cm) -- +(7cm,-1cm) --
|
|
+(6cm,-1cm) -- +(6cm,-5cm) -- +(3cm,-5cm) -- +(3cm,-1cm) --
|
|
+(2cm,-1cm) -- +(2cm,-5cm) -- +(1cm,-5cm) -- +(1cm,-1cm) --
|
|
+(0cm,-1cm) -- cycle;}
|
|
% Slide number in triangle.
|
|
\vfill\llap{\tikz\path[fill=tumblue,inner sep=3pt] (0,0) -- ++(-1cm,0) -- +(1cm,1cm) -- cycle node[anchor=south east] {\usebeamerfont{footline}\color{white}\bfseries\insertframenumber};}%
|
|
% Variant without triangle
|
|
%\vfill\llap{\usebeamerfont{footline}\usebeamercolor[fg]{footline}\insertframenumber\hskip3pt}\vskip3pt%
|
|
}
|
|
|
|
\graphicspath{ {./images/} }
|
|
|
|
\title{CoPaaS - Compiler-oriented Programming as a Service}
|
|
\author{Simon Bußmann \and Johannes Maier}
|
|
\institute{School of Computation, Information, and Technology\\Technical University of Munich}
|
|
\date{Future}
|
|
|
|
\begin{document}
|
|
|
|
\begin{frame}
|
|
\titlepage
|
|
\end{frame}
|
|
|
|
\begin{frame}{The program}
|
|
\begin{itemize}
|
|
\item JIT-Compiler for toy ISA
|
|
\item Instructions: \lstinline{ADD, ADDI, SUB, COPY, LOADI}
|
|
\item Important: No jumps, branches, function calls, etc. for simplicity
|
|
\item Registers:
|
|
\only<1> {
|
|
\begin{tabular}{|l|l|l|}
|
|
\hline
|
|
\textbf Adelheid & \textbf Friedrich & \textbf Klaus \\
|
|
\hline
|
|
\textbf Berthold & \textbf Giesela & \textbf Liesbeth \\
|
|
\hline
|
|
\textbf Cornelia & \textbf Heinrich & \textbf Manfred \\
|
|
\hline
|
|
\textbf Dora & \textbf Irmgard & \textbf Norbert \\
|
|
\hline
|
|
\textbf Engelbert & \textbf Joachim & \\
|
|
\hline
|
|
\end{tabular}
|
|
}
|
|
\only<2-> {
|
|
\texttt A, \texttt B\dots \texttt N
|
|
}
|
|
\visible<3-> {
|
|
\item Seccomp jail for generated code
|
|
\item Except: \visible<4->{In premium mode activated by key}
|
|
}
|
|
\visible<5->{
|
|
\item NX, PIE, Full RERLO, Stack Canary
|
|
}
|
|
\end{itemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}{x86-64 Instruction Encoding Basics}
|
|
\begin{columns}
|
|
\begin{column}{0.35\textwidth}
|
|
|
|
Parts of an instruction:
|
|
\begin{itemize}
|
|
\item \textcolor<2>{blue}{Prefixes}
|
|
\item Opcode
|
|
\item \textcolor<3-5>{blue}{ModR/M}
|
|
\item SIB
|
|
\item Displacement
|
|
\item Immediate
|
|
\end{itemize}
|
|
\end{column}
|
|
\begin{column}{0.65\textwidth}
|
|
\begin{tikzpicture}[scale=0.75]
|
|
|
|
% REX.W prefix
|
|
\matrix (rex) at (0,0) [
|
|
matrix of nodes,
|
|
nodes={draw, minimum size=18pt, anchor=center},
|
|
column sep=-\pgflinewidth,
|
|
row sep=-\pgflinewidth,
|
|
ampersand replacement=\&
|
|
] {
|
|
0 \& 1\& 0 \& 0 \& \textcolor<2>{blue}{W} \& \textcolor<2>{blue}{R} \& X \& \textcolor<2>{blue}{B} \\
|
|
};
|
|
|
|
% ModR/M byte
|
|
\matrix (modrm) [
|
|
below=20pt of rex,
|
|
matrix of nodes,
|
|
nodes={draw, minimum size=18pt, anchor=center},
|
|
column sep=-\pgflinewidth,
|
|
row sep=-\pgflinewidth,
|
|
ampersand replacement=\&
|
|
] {
|
|
\textcolor<3>{blue}{1} \& \textcolor<3>{blue}{1} \& \textcolor<4>{blue}{0} \& \textcolor<4>{blue}{1} \& \textcolor<4>{blue}{0} \& \textcolor<5>{blue}{0} \& \textcolor<5>{blue}{0} \& \textcolor<5>{blue}{0} \\
|
|
};
|
|
|
|
% Labels
|
|
\node[anchor=east] at (rex.west) {REX.W};
|
|
\node[anchor=east] at (modrm.west) {ModR/M};
|
|
|
|
% Brackets for ModR/M parts
|
|
\draw[semithick, decorate, decoration={brace, amplitude=10pt, mirror, raise=4pt}, alt=<3>{blue}{black}] (modrm-1-1.south west) -- (modrm-1-2.south east) node[midway, below=14pt] {\textcolor<3>{blue}{Modifier}};
|
|
\draw[semithick, decorate, decoration={brace, amplitude=10pt, mirror, raise=4pt}, alt=<4>{blue}{black}] (modrm-1-3.south west) -- (modrm-1-5.south east) node[midway, below=14pt, xshift=-4pt] {\textcolor<4>{blue}{Reg}};
|
|
\draw[semithick, decorate, decoration={brace, amplitude=10pt, mirror, raise=4pt}, alt=<5>{blue}{black}] (modrm-1-6.south west) -- (modrm-1-8.south east) node[midway, below=14pt] {\textcolor<5>{blue}{RM}};
|
|
|
|
\end{tikzpicture}
|
|
\end{column}
|
|
\end{columns}
|
|
\end{frame}
|
|
|
|
\begin{frame}{The Bug}
|
|
\only<2-3> {
|
|
\begin{figure}
|
|
\centering
|
|
\includegraphics[scale=0.65]{bug}
|
|
\end{figure}
|
|
}
|
|
\visible<3>{No, not you...}
|
|
\only<4->{
|
|
\begin{itemize}
|
|
\item Faulty encoding of instructions using \lstinline{r[8-15]}
|
|
\item[$\Rightarrow$] Register ids are 4bit long
|
|
\item Example: encode ModR/M for \lstinline{mov r8, r9}
|
|
\item Register ids: $\text r8 = 0\text b1000, \text r9 = 0\text b1001$
|
|
\[\text{Mod R/M} = \textcolor<4>{blue}{0\text{b}1100\_0000} + \textcolor<5>{blue}{(\text{reg2\_id} \ll 3)} + \textcolor<6>{blue}{\text{reg1\_id}}\]
|
|
\end{itemize}
|
|
|
|
\begin{center}
|
|
\begin{tikzpicture}
|
|
\matrix (modrm) [
|
|
below=20pt of rex,
|
|
matrix of nodes,
|
|
nodes={draw, minimum size=18pt, anchor=center},
|
|
column sep=-\pgflinewidth,
|
|
row sep=-\pgflinewidth,
|
|
ampersand replacement=\&
|
|
] {
|
|
\textcolor<4>{blue}{\textcolor<5>{red}{\alt<5->{0}{1}}} \&
|
|
\textcolor<4>{blue}{\textcolor<5>{red}{\alt<5->{0}{1}}} \&
|
|
\textcolor<5>{blue}{0} \&
|
|
\textcolor<5>{blue}{\textcolor<6>{red}{\alt<6->{1}{0}}} \&
|
|
\textcolor<5>{blue}{\textcolor<6>{red}{\alt<5>{1}{0}}} \&
|
|
\textcolor<6>{blue}{0} \&
|
|
\textcolor<6>{blue}{0} \&
|
|
\textcolor<6>{blue}{0} \\
|
|
};
|
|
\end{tikzpicture}
|
|
\end{center}
|
|
}
|
|
\only<6>{
|
|
\begin{itemize}
|
|
\item Actually encoded instruction: \lstinline{mov [r8], r10}
|
|
\end{itemize}
|
|
}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Exploit Primitives}
|
|
But, what can we do with that?
|
|
% TODO: describe primitives further
|
|
\begin{itemize}
|
|
\item Arbitrary write: \lstinline{mov [reg1], reg2}
|
|
\only<1-2> {
|
|
\begin{itemize}
|
|
\item Use \lstinline{COPY} to generate \lstinline{mov}, overflow into modifier bits
|
|
\item Register id constraints: $\text{\textcolor{ForestGreen}{reg1\_id}} = 0\text{b}0\text{xxx}, \text{\textcolor{blue}{reg2\_id}}=0\text{b}1\text{xxx}$
|
|
\item Example: \texttt{mov \textcolor{ForestGreen}{rax}, \textcolor{blue}{r8}} $\Rightarrow$ \texttt{mov [\textcolor{ForestGreen}{rax}], \textcolor{blue}{r8}}
|
|
\end{itemize}
|
|
|
|
\begin{center}
|
|
\begin{tikzpicture}
|
|
\matrix (modrm) [
|
|
below=20pt of rex,
|
|
matrix of nodes,
|
|
nodes={draw, minimum size=18pt, anchor=center},
|
|
column sep=-\pgflinewidth,
|
|
row sep=-\pgflinewidth,
|
|
ampersand replacement=\&
|
|
] {
|
|
\textcolor<1>{black}{\textcolor<2>{red}{\alt<2>{0}{1}}} \&
|
|
\textcolor<1>{black}{\textcolor<2>{red}{\alt<2>{0}{1}}} \&
|
|
\textcolor<2>{blue}{0} \&
|
|
\textcolor<2>{blue}{0} \&
|
|
\textcolor<2>{blue}{0} \&
|
|
\textcolor<2>{ForestGreen}{0} \&
|
|
\textcolor<2>{ForestGreen}{0} \&
|
|
\textcolor<2>{ForestGreen}{0} \\
|
|
};
|
|
|
|
\draw[semithick, decorate, decoration={brace, amplitude=10pt, mirror, raise=4pt}] (modrm-1-1.south west) -- (modrm-1-8.south east) node[midway, below=14pt] {ModR/M Byte};
|
|
\end{tikzpicture}
|
|
\end{center}
|
|
}
|
|
|
|
\item Arbitrary read: \lstinline{mov reg1, [reg2]}
|
|
\only<3>{
|
|
\begin{itemize}
|
|
\item Actually: \lstinline{mov reg1, 0; add reg1, [reg2]}
|
|
\item Use same trick as for write
|
|
\item There exists multiple opcodes for add\footnote{Also for most other standard x86 operations.}, for example:
|
|
\item Opcode $= 0x1$: \lstinline{add [reg2], reg1}
|
|
\item Opcode $= 0x3$: \lstinline{add reg1, [reg2]}
|
|
\end{itemize}
|
|
}
|
|
|
|
\item Stack access
|
|
\only<4-5> {
|
|
\begin{itemize}
|
|
\item Achieved by overflow into \lstinline{reg2_id}
|
|
\item \lstinline{COPY G, B} should be compiled to: \lstinline{mov r8, rbx}
|
|
\item<5> Actually compiled: \lstinline{mov r8, rsp}
|
|
\end{itemize}
|
|
\begin{center}
|
|
\begin{tikzpicture}
|
|
\matrix (modrm) [
|
|
below=20pt of rex,
|
|
matrix of nodes,
|
|
nodes={draw, minimum size=18pt, anchor=center},
|
|
column sep=-\pgflinewidth,
|
|
row sep=-\pgflinewidth,
|
|
ampersand replacement=\&
|
|
] {
|
|
1 \&
|
|
1 \&
|
|
\textcolor<5>{red}{\alt<5>{1}{0}} \&
|
|
\textcolor<5>{red}{\alt<5>{0}{1}} \&
|
|
\textcolor<5>{red}{\alt<5>{0}{1}} \&
|
|
\textcolor<5>{blue}{0} \&
|
|
\textcolor<5>{blue}{0} \&
|
|
\textcolor<5>{blue}{0} \\
|
|
};
|
|
|
|
\draw[semithick, decorate, decoration={brace, amplitude=10pt, mirror, raise=4pt}] (modrm-1-1.south west) -- (modrm-1-8.south east) node[midway, below=14pt] {ModR/M Byte};
|
|
\end{tikzpicture}
|
|
\end{center}
|
|
}
|
|
\end{itemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}{The Exploit}
|
|
\only<1-4>{
|
|
Steps:
|
|
\begin{itemize}
|
|
\item Leak activation key
|
|
\only<2>{
|
|
\begin{itemize}
|
|
\item Activation key is located in the binary
|
|
\item Use stack access primitive to leak return address
|
|
\item Use arbitrary read primitive to leak the key byte by byte
|
|
\end{itemize}
|
|
}
|
|
\item Escape seccomp jail
|
|
\only<3>{
|
|
\begin{itemize}
|
|
\item Activate premium mode with the leaked key
|
|
\item \it{much wow great hacking}
|
|
\end{itemize}
|
|
}
|
|
\item Execute \lstinline{system("/bin/sh")}
|
|
\only<4>{
|
|
\begin{itemize}
|
|
\item Use stack access primitive to leak a libc address
|
|
\item Calculate \lstinline{system} and \lstinline{/bin/sh} addresses
|
|
\item Load \lstinline{/bin/sh} address into \lstinline{rdi}
|
|
\item Use arbitrary write primitive to overwrite saved rip
|
|
\end{itemize}
|
|
}
|
|
\end{itemize}
|
|
}
|
|
\only<5>{
|
|
\begin{figure}
|
|
\centering
|
|
\includegraphics[scale=0.22]{profit_penguin}
|
|
\end{figure}
|
|
}
|
|
\end{frame}
|
|
|
|
\end{document}
|