mirror of
https://github.com/rapid7/metasploit-framework
synced 2024-11-05 14:57:30 +01:00
808 lines
22 KiB
TeX
808 lines
22 KiB
TeX
% $Header$
|
|
|
|
\documentclass{beamer}
|
|
\usepackage{graphicx}
|
|
\usepackage{color}
|
|
|
|
|
|
\mode<presentation>
|
|
{
|
|
% \usetheme{}
|
|
% or ...
|
|
|
|
% \usecolortheme{seahorse}
|
|
% \usecolortheme{crane}
|
|
% \useinnertheme{inmargin}
|
|
|
|
% \setbeamercovered{transparent}
|
|
% or whatever (possibly just delete it)
|
|
|
|
}
|
|
|
|
\usepackage[english]{babel}
|
|
\usepackage[latin1]{inputenc}
|
|
\usepackage{times}
|
|
\usepackage[T1]{fontenc}
|
|
% \usepackage{beamerthemeshadow}
|
|
|
|
% Love from spoon
|
|
\newcommand{\pdfpart}[1]{\label{pdfpart-#1}\pdfbookmark[0]{#1}{pdfpart-#1}\part{#1}}
|
|
\newenvironment{sitemize}{\vspace{1mm}\begin{itemize}\itemsep 4pt\small}{\end{itemize}}
|
|
|
|
% Presentation meta-information
|
|
\title{Advances in Exploit Technology}
|
|
\author[hdm \& spoonm] {hdm \& spoonm}
|
|
\date[CSW 2005] {CanSecWest, 2005}
|
|
\subject{Advances in Exploit Technology}
|
|
|
|
% Add a spacer between each part
|
|
\AtBeginPart{\frame{\partpage}}
|
|
|
|
% Turn off the navigation on the bottom yo
|
|
\setbeamertemplate{navigation symbols}{}
|
|
|
|
% Kick this sucker open
|
|
\begin{document}
|
|
|
|
% Throw down the title
|
|
\begin{frame}
|
|
\titlepage
|
|
\end{frame}
|
|
|
|
|
|
%--------------------------------------%
|
|
\pdfpart{Introduction}
|
|
%--------------------------------------%
|
|
|
|
\section{Who are we?}
|
|
\begin{frame}
|
|
\frametitle{Who are we?}
|
|
|
|
\begin{sitemize}
|
|
\item spoonm
|
|
\begin{sitemize}
|
|
\item Full-time student at a Canadian university
|
|
\item Metasploit developer since late 2003
|
|
\end{sitemize}
|
|
\end{itemize}
|
|
|
|
\begin{itemize}
|
|
\item H D Moore
|
|
\begin{sitemize}
|
|
\item Full-time employee at a network security firm
|
|
\item Metasploit project founder and developer
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{What is Metasploit?}
|
|
\begin{frame}
|
|
\frametitle{What is Metasploit?}
|
|
\begin{sitemize}
|
|
\item Research project with 8 members
|
|
\begin{sitemize}
|
|
\item Focused on improving the state of security
|
|
\item Provide information and tools for researchers
|
|
\item Resource for IDS and security tool vendors
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\begin{sitemize}
|
|
\item Created the Metasploit Framework
|
|
\begin{sitemize}
|
|
\item Open-source exploit dev platform
|
|
\item Includes 60 exploits and 70 payloads
|
|
\item Implements ideas from everywhere
|
|
\item Currently four primary developers
|
|
\item Handful of external contributors
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{What is this about?}
|
|
\begin{frame}
|
|
\frametitle{What is this about?}
|
|
\begin{sitemize}
|
|
\item Recent advances in exploit technology
|
|
\item Exploiting Windows XP SP2 and Mac OS X
|
|
\item New research, techniques, and code
|
|
\item Metasploit Framework 3.0 architecture
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
%--------------------------------------%
|
|
\pdfpart{Windows Exploitation}
|
|
%--------------------------------------%
|
|
|
|
\section{Exploit Trends}
|
|
\begin{frame}
|
|
\frametitle{Exploit Trends}
|
|
\begin{sitemize}
|
|
\item Public Windows exploits are still terrible...
|
|
\begin{sitemize}
|
|
\item Tons of ugly, inflexible, hardcoded crap
|
|
\item Demonstrate no knowledge of underlying flaw
|
|
\item Rarely use information leakage for system targetting
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\begin{sitemize}
|
|
\item ...but they have improved over the last year!
|
|
\begin{sitemize}
|
|
\item More exploits are supporting multiple payloads
|
|
\item Return addresses are more reliable
|
|
\item Payloads are getting slightly less ghetto
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{PoC Community}
|
|
|
|
\begin{sitemize}
|
|
\item The number of people capable of writing exploits is going up...
|
|
\begin{sitemize}
|
|
\item The number of PoC writers is picking up steam
|
|
\item Nearly 250 PoC authors in 2004 (packetstorm, etc)
|
|
\item Win32 exploit dev information has hit critical mass
|
|
\item Exploit development training is in high demand ;-)
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\begin{sitemize}
|
|
\item ...but the number of "hard" exploits made public is the same
|
|
\begin{sitemize}
|
|
\item People are lazy, skilled people tend to horde their code
|
|
\item Example: Microsoft ASN.1 Bit String Heap Corruption
|
|
\item Most "difficult" exploits are disclosed due to leaks
|
|
\item Win32 kernel exploits are still the domain of a few :-)
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Windows XP SP2}
|
|
\begin{frame}
|
|
\frametitle{Windows XP SP2}
|
|
\begin{sitemize}
|
|
\item Microsoft's "patch of the year" for 2004
|
|
\begin{sitemize}
|
|
\item SP2 included a handful of anti-exploit changes
|
|
\item The important ones were already in 2003
|
|
\item Page protection is dependent on hardware
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\begin{sitemize}
|
|
\item Most of the SP2 protections can be avoided
|
|
\begin{sitemize}
|
|
\item David Litchfield demonstrated SEH exploitation
|
|
\item Matt Conover continues to dismantle the heap
|
|
\item Third-party applications basically unaffected
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{Metasploit and SP2}
|
|
\begin{sitemize}
|
|
\item Exploit development barely affected by SP2
|
|
\item Third-parties are not using Visual Studio 7
|
|
\item Registered SEH has yet to be encountered
|
|
\item A handful of nice XP SP2 and 2003 addresses
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\begin{sitemize}
|
|
\item Still too early to guess effectiveness
|
|
\begin{sitemize}
|
|
\item Not many remote Windows XP OS vulnerabilities
|
|
\item XXX fill in more stuff here
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
%--------------------------------------%
|
|
\pdfpart{Mac OS X Exploitation}
|
|
%--------------------------------------%
|
|
|
|
\section{PowerPC Constraints}
|
|
\begin{frame}
|
|
\frametitle{PowerPC Contraints}
|
|
\begin{sitemize}
|
|
\item Mac OS X runs on PowerPC
|
|
\item PowerPC is a RISC-platform
|
|
\item Independent instruction and data caches
|
|
\item Fixed-width 32-bit insutrctions
|
|
\item Stack overflows need to return twice to be explotable
|
|
\item (Similar to exploits on SPARCs, etc)
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Exploits are annoying}
|
|
\begin{frame}
|
|
\frametitle{Exploits are annoying }
|
|
\begin{sitemize}
|
|
\item Double-return means having to patch other pointers
|
|
\item Code which calls \_exit before sometimes unexploitable
|
|
\item Shellcode must be placed into location not in i-cache
|
|
\item Exploits can have different results between diff CPUs
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Shellcode issues}
|
|
\begin{frame}
|
|
\frametitle{Shellcode issues }
|
|
\begin{sitemize}
|
|
\item Double-return means having to patch other pointers
|
|
\item Shellcode must be placed into location not in i-cache
|
|
\item Exploits can have different results between diff CPUs
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
%--------------------------------------%
|
|
\pdfpart{Return Addresses}
|
|
%--------------------------------------%
|
|
|
|
\section{Reliability}
|
|
\begin{frame}
|
|
\frametitle{Return Address Reliability}
|
|
\begin{sitemize}
|
|
\item An exploit is only as good as the return address it uses
|
|
\item Many vulnerabilities only allow one exploit attempt
|
|
\item Returning directly to shellcode is not always possible
|
|
\begin{sitemize}
|
|
\item Most Windows exploits use a "bounce" address
|
|
\item Indirect returns are useful on other platforms as well
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Windows Addresses}
|
|
\begin{frame}
|
|
\frametitle{Windows Return Addresses}
|
|
\begin{sitemize}
|
|
\item Windows stack addresses are usually not predictable
|
|
\item Executable and library address {\em are} predictable
|
|
\begin{sitemize}
|
|
\item System libraries are often static between patch levels
|
|
\item Application libraries change even less frequently
|
|
\item Executable addresses only change between app versions
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\begin{sitemize}
|
|
\item Static system libraries can go a long way...
|
|
\pause
|
|
\item A great example is the "ws2help.dll" library:
|
|
\begin{sitemize}
|
|
\item Static across all versions of Windows 2000
|
|
\item Static across Windows XP SP0 and SP1
|
|
\item Used in dozens of exploits in the Framework
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{The Magic SEH}
|
|
\begin{sitemize}
|
|
\item Stack overflows rarely exploit return address overwrites
|
|
\item Overwriting the structured exception handler (SEH) is easier
|
|
\item The first exception causes smashed SEH to be called
|
|
\item SEH frame can exist before or after the return address
|
|
\end{sitemize}
|
|
{\footnotesize
|
|
\begin{verbatim}
|
|
/* Struction Exception Handler */
|
|
typedef struct _EXCEPTION_REGISTRATION
|
|
{
|
|
struct _EXCEPTION_REGISTRATION* prev;
|
|
PEXCEPTION_HANDLER handler;
|
|
} EXCEPTION_REGISTRATION, *PEXCEPTION_REGISTRATION;
|
|
\end{verbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{The Magic SEH}
|
|
\begin{sitemize}
|
|
\item Overwrite the frame, trigger exception, got EIP :-)
|
|
\item The prototype for the SEH function is:
|
|
\end{sitemize}
|
|
{\footnotesize
|
|
\begin{verbatim}
|
|
EXCEPTION_DISPOSITION
|
|
__cdecl _except_handler(
|
|
struct _EXCEPTION_RECORD *ExceptionRecord,
|
|
void * EstablisherFrame,
|
|
struct _CONTEXT *ContextRecord,
|
|
void * DispatcherContext );
|
|
\end{verbatim}
|
|
}
|
|
\pause
|
|
\begin{sitemize}
|
|
\item \texttt{EstablisherFrame} points 4 bytes before handler address
|
|
\pause
|
|
\item Can return back to code via \texttt{pop reg, pop reg, ret}
|
|
\pause
|
|
\item The pop/pop/ret combination is easy to find in memory
|
|
\pause
|
|
\item Registered SEH on Windows XP/2003 has some restrictions
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Unix Addresses}
|
|
\begin{frame}
|
|
\frametitle{Unix Return Addresses}
|
|
|
|
\begin{sitemize}
|
|
\item Linux and BSD
|
|
\begin{sitemize}
|
|
\item Library addresses are usually not predictable
|
|
\item Every executable has a static load address
|
|
\begin{sitemize}
|
|
\item Every distribution has compiled its own executable
|
|
\item Exploits must target specific versions and operating systems
|
|
\item Commercial (binary-only) applications are mostly static
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\begin{sitemize}
|
|
\item Commercial Unix
|
|
\begin{sitemize}
|
|
\item Library addresses are sometimes predictable
|
|
\item Every executable has a static load address
|
|
\begin{sitemize}
|
|
\item These addresses are static per package version
|
|
\item Windows-style return addresses work well
|
|
\item This includes Mac OS X, Solaris, HP-UX, AIX, etc
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
|
|
\section{Analysis Tools}
|
|
\begin{frame}
|
|
\frametitle{Analysis Methods}
|
|
\begin{sitemize}
|
|
\item Finding solid return addresses involves a few steps
|
|
\begin{sitemize}
|
|
\item Load the executable or library into memory
|
|
\item Determine all permutations of the desired opcode
|
|
\item Search memory contents to find these bytes
|
|
\item Determine the virtual address for each offset
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\begin{sitemize}
|
|
\item Many people use a debugger to accomplish this task
|
|
\begin{sitemize}
|
|
\item This is a tedious process to do manually
|
|
\item Limited to one version at a time, even with a plugin
|
|
\item Requires the installation of each tested version
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{The Metasploit msfpescan utility}
|
|
\begin{sitemize}
|
|
\item msfpescan - a utility included in the Metasploit Framework
|
|
\begin{sitemize}
|
|
\item Can analyze any PE executable or DLL in offline mode
|
|
\item Simple to automate and cross-reference results
|
|
\item Does not require a Windows system to run
|
|
\item Easily analyze multiple versions on the command line
|
|
\item Capable of dumping other information as well
|
|
\begin{sitemize}
|
|
\item Imports, Exports, and IAT addresses
|
|
\item Resource information, internal versions
|
|
\item Standard PE header information
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{Using msfpescan to find addresses}
|
|
\begin{sitemize}
|
|
\item Install the Metasploit Framework (2.3 or newer)
|
|
\item Place your target executable or DLL into some directory
|
|
\item Use msfpescan to quickly find return addresses:
|
|
\end{sitemize}
|
|
|
|
{\footnotesize
|
|
\begin{verbatim}
|
|
# Locate any form of pop/pop/ret opcodes
|
|
$ msfpescan -f mod_oiplus.dll -s
|
|
0x1001413c esi edi ret
|
|
0x10009ea2 esi ecx ret
|
|
0x100113bd esi ebx ret
|
|
|
|
# Locate any opcodes that take us to [eax]
|
|
$ msfpescan -f mod_oiplus.dll -j eax
|
|
0x1000969d push eax
|
|
0x100141a3 jmp eax
|
|
0x10010e69 call eax
|
|
\end{verbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{Opcode Databases}
|
|
\begin{sitemize}
|
|
\item Contains opcodes across every executable and DLL in Windows
|
|
\item The new version includes over nine million records
|
|
\item Data is generated directly from the files themselves
|
|
\item Quickly cross-reference return address over the entire DB
|
|
\item Publicly available from http://www.metasploit.com/
|
|
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{Current Development}
|
|
\begin{sitemize}
|
|
\item Executable analysis tools for Solaris, Mac OS X, Linux, BSD
|
|
\item Usefulness limited compared to Windows platform
|
|
\item Static libraries are great for cross-version exploits
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
%--------------------------------------%
|
|
\pdfpart{Post-Exploitation}
|
|
%--------------------------------------%
|
|
|
|
\section{Windows Payloads}
|
|
|
|
\begin{frame}
|
|
\frametitle{The Meterpreter}
|
|
\begin{sitemize}
|
|
\item Windows version uses in-memory DLL injection techniques
|
|
\item Dynamically extensible over the network
|
|
\item Extensions are standard Windows DLLs
|
|
\item Loading an extension updates available commands
|
|
\item Support for network encryption
|
|
\item Huge feature set in the public version
|
|
\begin{sitemize}
|
|
\item Upload, download, and list files
|
|
\item List, create, and kill processes
|
|
\item Spawn "channelized" commands in the background
|
|
\item Create port forwarding channels to pivot attacks
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{Ordinal-based Stagers}
|
|
\begin{sitemize}
|
|
\item Technique from Oded's lightning talk from core04
|
|
\item 92 bytes and works on every Windows version/SP
|
|
\item Staging system can chain vnc injection or Meterpreter
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{PassiveX}
|
|
\begin{sitemize}
|
|
\item Payload modifies registry and launches IE
|
|
\item IE loads custom ActiveX control to stage the payload
|
|
\item Communications channel is via HTTP requests
|
|
\item Can be used to inject VNC, Meterpreter, etc
|
|
\item Uses IE settings to bypass firewalls (proxy, auth, etc)
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
\section{Unix Payloads}
|
|
|
|
\begin{frame}
|
|
\frametitle{Non-standard Network Stagers}
|
|
\begin{sitemize}
|
|
\item UDP-based stager and network shell for Linux
|
|
\item UDP-based DNS request staging system
|
|
\item ICMP-based listener and "reverse" payloads
|
|
\item Find and recv socket re-use stagers
|
|
\item Source code in MSF, but many not integrated
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
|
|
%--------------------------------------%
|
|
\pdfpart{Improving Randomness in Attacks}
|
|
%--------------------------------------%
|
|
|
|
\begin{frame}
|
|
\frametitle{Outline}
|
|
\tableofcontents
|
|
\end{frame}
|
|
|
|
\section{Introduction}
|
|
\begin{frame}
|
|
\frametitle{Randomness, who cares?}
|
|
\begin{sitemize}
|
|
\item NOTE: this slide can probably be trashed.. just temp for now
|
|
\item Adding randomness to exploits
|
|
\begin{sitemize}
|
|
\item Less to signature / anti-nids
|
|
\item Helps to uncover bugs in your exploit
|
|
\end{sitemize}
|
|
\pause
|
|
|
|
\item Adding randomness to exploit code
|
|
\begin{sitemize}
|
|
\item Modify attacks by setting protocol options (frags)
|
|
\item All padding data can be randomized (englishtext)
|
|
\item Helper functions to generate types of random data
|
|
\end{sitemize}
|
|
|
|
\item Adding randomness to machine code
|
|
\begin{sitemize}
|
|
\item Less to signature / anti-nids
|
|
\item Increased robustness (bad chars / bad regs)
|
|
\item Street credz? :-)
|
|
\end{sitemize}
|
|
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Conservative Polymorphism}
|
|
|
|
\newcommand{\incshi}[1]{\includegraphics[height=3in]{#1}}
|
|
|
|
\begin{frame}
|
|
\frametitle{R0x Iterationz}
|
|
\only<9>{\incshi{shi8}}
|
|
\only<8>{\incshi{shi7}}
|
|
\only<7>{\incshi{shi6}}
|
|
\only<6>{\incshi{shi5}}
|
|
\only<5>{\incshi{shi4}}
|
|
\only<4>{\incshi{shi3}}
|
|
\only<3>{\incshi{shi2}}
|
|
\only<2>{\incshi{shi1}}
|
|
\only<1>{\incshi{shi0}}
|
|
\end{frame}
|
|
|
|
\section{Building a Nop Sled}
|
|
|
|
\subsection{Tekneek}
|
|
|
|
\begin{frame}
|
|
\frametitle{Multibyte Sled Concept}
|
|
\begin{sitemize}
|
|
\item Optyx released multibyte generator at Interz0ne 1
|
|
\item Generates instructions 1 to 6 bytes long, and 0x66 prefix
|
|
\item 1 byte aligned, land anywhere, end at the same byte
|
|
\end{sitemize}
|
|
\begin{sitemize}
|
|
\pause
|
|
\item Builds the sled from back to front
|
|
\item Continually prepending byte (opcode) to sled
|
|
\item Generates random byte and check against tables
|
|
\pause
|
|
\begin{sitemize}
|
|
\item Is the instruction length too long?
|
|
\item Is it a valid instruction?
|
|
\item Does it have any bad bytes?
|
|
\item Does it modify don't-smash registers?
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{Backwardz}
|
|
{\footnotesize
|
|
\begin{semiverbatim}
|
|
\textbf<11>{bb} \textbf<10,11>{b0} \textbf<9,10,11>{bf} \textbf<8,9,11>{2c} \textbf<7,8,9,11>{b6} \textbf<6,7,9>{27} \textbf<5,9>{67} \textbf<4,5>{2F} \textbf<3>{4A} \textbf<2>{1b} \textbf<1,2>{f9} --- shellcode
|
|
| | | | | | | | | | | \textbf<1>{... stc}
|
|
| | | | | | | | | |____^ \textbf<2>{. sbb edi,ecx}
|
|
| | | | | | | | | \textbf<3>{......... dec edx}
|
|
| | | | | | | | \textbf<4>{............ das}
|
|
| | | | | | |____^ \textbf<5>{.......... a16 das}
|
|
| | | | | | \textbf<6>{.................. daa}
|
|
| | | | |____^ \textbf<7>{................ mov dh, 0x27}
|
|
| | | |____^ \textbf<8>{................... sub al, 0xb6}
|
|
| | |_____________^ \textbf<9>{............. mov edi, 0x6727b62c}
|
|
| |____^ \textbf<10>{......................... mov al, 0xbf}
|
|
|_____________^ \textbf<11>{................... mov ebx, 0xb62cbfb0}
|
|
\end{semiverbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
\subsection{Implementation}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{OptyNop2 Output}
|
|
{\footnotesize
|
|
\begin{verbatim}
|
|
$ ./waka 1000 4 5 | ndisasm -u - | head -700 | tail -20
|
|
000003B6 05419F40D4 add eax,0xd4409f41
|
|
000003BB 711C jno 0x3d9
|
|
000003BD 9B wait
|
|
000003BE 2C98 sub al,0x98
|
|
000003C0 37 aaa
|
|
000003C1 24A8 and al,0xa8
|
|
000003C3 27 daa
|
|
000003C4 E00D loopne 0x3d3
|
|
000003C6 6692 xchg ax,dx
|
|
000003C8 2F das
|
|
000003C9 49 dec ecx
|
|
000003CA B34A mov bl,0x4a
|
|
000003CC F5 cmc
|
|
000003CD BA4B257715 mov edx,0x1577254b
|
|
000003D2 700C jo 0x3e0
|
|
000003D4 C0D6B0 rcl dh,0xb0
|
|
000003D7 A9FD469342 test eax,0x429346fd
|
|
000003DC 67BBB191B23D a16 mov ebx,0x3db291b1
|
|
000003E2 1D9938FCB6 sbb eax,0xb6fc3899
|
|
000003E7 43 inc ebx
|
|
\end{verbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
|
|
|
|
\subsection{Analysis}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{ADMmutate and optyx-mutate Gzip'd}
|
|
{\footnotesize
|
|
\begin{verbatim}
|
|
# ADMmutate
|
|
|
|
$ time ./nops 1000000| gzip -v >/dev/null
|
|
27.3%
|
|
real 0m0.241s
|
|
|
|
# optyx's interz0ne mutate
|
|
|
|
$ time ./driver nop 1000000 | gzip -v >/dev/null
|
|
29.7%
|
|
real 0m0.467s
|
|
\end{verbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{OptyNop2 Gzip'd}
|
|
{\footnotesize
|
|
\begin{verbatim}
|
|
# C version, save ESP and EBP
|
|
|
|
$ time ./waka 1000000 4 5 | gzip -v >/dev/null
|
|
12.2%
|
|
real 0m11.900s
|
|
|
|
# save just ESP
|
|
|
|
$ time ./waka 1000000 4 | gzip -v >/dev/null
|
|
11.7%
|
|
real 0m11.277s
|
|
|
|
# save nothing (good way to crash process)
|
|
|
|
$ time ./waka 1000000 | gzip -v >/dev/null
|
|
8.3%
|
|
real 0m12.404s
|
|
\end{verbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{ADMmutate Distribution - 1}
|
|
\include{admtable}
|
|
\end{frame}
|
|
\begin{frame}[fragile]
|
|
\frametitle{ADMmutate Distribution - 2}
|
|
\include{admtable2}
|
|
\end{frame}
|
|
\begin{frame}[fragile]
|
|
\frametitle{OptyNop2 Distribution - 1}
|
|
\include{optytable}
|
|
\end{frame}
|
|
\begin{frame}[fragile]
|
|
\frametitle{OptyNop2 Distribution - 2}
|
|
\include{optytable2}
|
|
\end{frame}
|
|
|
|
\subsection{Conclusion}
|
|
\begin{frame}
|
|
\frametitle{Benefits}
|
|
\begin{sitemize}
|
|
\item Not very difficult to gain lots more randomness
|
|
\item NIDS is far, far, behind
|
|
\item Added robustness (bad char / bad regs)
|
|
\item More versatile sled generation (nop stuffing, etc)
|
|
\end{sitemize}
|
|
\end{frame}
|
|
\begin{frame}
|
|
\frametitle{Possible Improvements}
|
|
\begin{sitemize}
|
|
\item Support processor flags (nop stuffing)
|
|
\item Support 2-byte opcodes / escape groups (not worth it)
|
|
\item Improved scoring systems, look-ahead, etc
|
|
\item Try to output according to a given byte distribution
|
|
\item Make it faster and use less memory
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
\section*{Summary}
|
|
|
|
|
|
\begin{frame}
|
|
\frametitle<presentation>{Summary}
|
|
|
|
% Keep the summary *very short*.
|
|
\begin{sitemize}
|
|
\item
|
|
The \alert{first main message} of your talk in one or two lines.
|
|
\item
|
|
The \alert{second main message} of your talk in one or two lines.
|
|
\item
|
|
Perhaps a \alert{third message}, but not more than that.
|
|
\end{sitemize}
|
|
|
|
% The following outlook is optional.
|
|
\vskip0pt plus.5fill
|
|
\begin{sitemize}
|
|
\item
|
|
Outlook
|
|
\begin{sitemize}
|
|
\item
|
|
Something you haven't solved.
|
|
\item
|
|
Something else you haven't solved.
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
|
|
|
|
% All of the following is optional and typically not needed.
|
|
\appendix
|
|
\section<presentation>*{\appendixname}
|
|
\subsection<presentation>*{For Further Reading}
|
|
|
|
\begin{frame}[allowframebreaks]
|
|
\frametitle<presentation>{For Further Reading}
|
|
|
|
\begin{thebibliography}{10}
|
|
|
|
\beamertemplatebookbibitems
|
|
% Start with overview books.
|
|
|
|
\bibitem{Author1990}
|
|
A.~Author.
|
|
\newblock {\em Handbook of Everything}.
|
|
\newblock Some Press, 1990.
|
|
|
|
|
|
\beamertemplatearticlebibitems
|
|
% Followed by interesting articles. Keep the list short.
|
|
|
|
\bibitem{Someone2000}
|
|
S.~Someone.
|
|
\newblock On this and that.
|
|
\newblock {\em Journal of This and That}, 2(1):50--100,
|
|
2000.
|
|
\end{thebibliography}
|
|
\end{frame}
|
|
|
|
\end{document}
|
|
|
|
|