The Shellcoder's Handbook - Chris Anley

. .

Résumé :

About the Authors vii

Acknowledgments xi

Introduction to the Second Edition xxiii

Part I Introduction to Exploitation: Linux on X 86

Chapter 1 Before You Begin 3

Basic Concepts 3

Memory Management 4

Assembly 6

Recognizing C and C++ Code Constructs in Assembly 7

Conclusion 10

Chapter 2 Stack Overflows 11

Buffers 12

The Stack 13

Functions and the Stack 15

Overflowing Buffers on the Stack 18

Controlling EIP 22

An Interesting Diversion 23

Using an Exploit to Get Root Privileges 25

The Address Problem 27

The NOP Method 33

Defeating a Non-Executable Stack 35

Return to libc 35

Conclusion 39

Chapter 3 Shellcode 41

Understanding System Calls 42

Writing Shellcode for the exit() Syscall 44

Injectable Shellcode 48

Spawning a Shell 50

Conclusion 59

Chapter 4 Introduction to Format String Bugs 61

Prerequisites 61

What Is a Format String? 61

What Is a Format String Bug? 63

Format String Exploits 68

Crashing Services 69

Information Leakage 70

Controlling Execution for Exploitation 75

Why Did This Happen? 84

Format String Technique Roundup 85

Conclusion 88

Chapter 5 Introduction to Heap Overflows 89

What Is a Heap? 90

How a Heap Works 91

Finding Heap Overflows 91

Basic Heap Overflows 93

Intermediate Heap Overflows 98

Advanced Heap Overflow Exploitation 105

Conclusion 107

Part II other Platforms-windows, Solaris, OS/X, and Cisco

Chapter 6 The Wild World of Windows 111

How Does Windows Differ from Linux? 111

Win32 API and PE-COFF 112

Heaps 114

Threading 115

The Genius and Idiocy of the Distributed Common Object Model and DCE-RPC 116

Recon 118

Exploitation 120

Tokens and Impersonation 120

Exception Handling under Win 32 122

Debugging Windows 124

Bugs in Win 32 124

Writing Windows Shellcode 125

A Hacker's Guide to the Win32 API 126

A Windows Family Tree from the Hacker's Perspective 126

Conclusion 127

Chapter 7 Windows Shellcode 129

Syntax and Filters 129

Setting Up 131

Parsing the PEB 132

Heapoverflow.c Analysis 132

Searching with Windows Exception Handling 148

Popping a Shell 153

Why You Should Never Pop a Shell on Windows 153

Conclusion 154

Chapter 8 Windows Overflows 155

Stack-Based Buffer Overflows 156

Frame-Based Exception Handlers 156

Abusing Frame-Based Exception Handling on Windows 2003 Server 161

A Final Note about Frame-Based Handler Overwrites 166

Stack Protection and Windows 2003 Server 166

Heap-Based Buffer Overflows 173

The Process Heap 173

Dynamic Heaps 173

Working with the Heap 173

How the Heap Works 174

Exploiting Heap-Based Overflows 178

Overwrite Pointer to RtlEnterCriticalSection in the PEB 178

Overwrite Pointer to Unhandled Exception Filter 185

Repairing the Heap 191

Other Aspects of Heap-Based Overflows 193

Wrapping Up the Heap 194

Other Overflows 194

.data Section Overflows 194

TEB/PEB Overflows 196

Exploiting Buffer Overflows and Non-Executable Stacks 197

Conclusion 203

Chapter 9 Overcoming Filters 205

Writing Exploits for Use with an Alphanumeric Filter 205

Writing Exploits for Use with a Unicode Filter 209

What Is Unicode? 210

Converting from ASCII to Unicode ...

Biographie:
Chris Anley is a founder and director of NGSSoftware, a security software, consultancy, and research company based in London, England. He is actively involved in vulnerability research and has discovered security flaws in a wide variety of platforms including Microsoft Windows, Oracle, SQL Server, IBM DB2, Sybase ASE, MySQL, and PGP.

John Heasman is the Director of Research at NGSSoftware. He is a prolific security researcher and has published many security advisories in enterprise level software. He has a particular interest in rootkits and has authored papers on malware persistence via device firmware and the BIOS. He is also a co-author of The Database Hacker's Handbook: Defending Database Servers (Wiley 2005).

Felix FX Linder leads SABRE Labs GmbH, a Berlin-based professional consulting company specializing in security analysis, system design creation, and verification work. Felix looks back at 18 years of programming and over a decade of computer security consulting for enterprise, carrier, and software vendor clients. This experience allows him to rapidly dive into complex systems and evaluate them from a security and robustness point of view, even in atypical scenarios and on arcane platforms. In his spare time, FX works with his friends from the Phenoelit hacking group on different topics, which have included Cisco IOS, SAP, HP printers, and RIM BlackBerry in the past.

Gerardo Richarte has been doing reverse engineering and exploit development for more than 15 years non-stop. In the past 10 years he helped build the technical arm of Core Security Technologies, where he works today. His current duties include developing exploits for Core IMPACT, researching new exploitation techniques and other low-level subjects, helping other exploit writers when things get hairy, and teaching internal and external classes on assembly and exploit writing. As result of his research and as a humble thank you to the community, he has published some technical papers and open source projects, presented in a few conferences, and released part of his training material. He really enjoys solving tough problems and reverse engineering any piece of code that falls in his reach just for the fun of doing it.