ROP Exploitation without Code Injection.pdf

(4147 KB) Pobierz

Return-oriented Programming:

Exploitation without Code Injection

Erik Buchanan, Ryan Roemer, Stefan Savage, Hovav Shacham

University of California, San Diego

Bad code versus bad behavior

“Bad”

Bad

behavior

“Good”

Good

behavior

Attacker

code

Application

code

Problem: this implication is

false!

The Return-oriented programming thesis

Return oriented

any sufficiently large program codebase

arbitrary attacker computation and behavior,

without

code injection

(in the absence of control-flow integrity)

Security systems endangered:

W-xor-X aka DEP

Linux, OpenBSD,

Linux OpenBSD Windows XP SP2 MacOS X

SP2,

Hardware support: AMD NX bit, Intel XD bit

Trusted computing

Code signing: Xbox

Binary hashing: Tripwire, etc.

… and others

Return-into-libc and W^X