Memory Analysis RECon2010. Looking In The Eye Of The Bits By Assaf Nativ

Transcription

1 Memory Analysis RECon21 Looking In The Eye Of The Bits By Assaf Nativ

2 Who am I?

3

4

5

6 Wandering in memory land A B C D E F A 11 FF 1F FF 1F FF 1F FF 18F FF 1F FF 1F FF 1F FF 1F 11 FF FF FF F8F FF 8F42 FF F41 FF F41 FF F8F FF FF FF FF 9 11 FF 414 FF 414 FF 414 FF 44 FF 414 FF 4241 FF F8F FF FF 11 FF 44 FF 44 FF 44 FF 4141 FF 418F FF 42F FF FF FF 8FF FF 44 FF 44 FF 4141 FF 428F FF FF FF FF FF FF FF FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

7 A hint...

8 Memory land A B C D E F A 11 FF 1F FF 1F FF 1F FF 18F FF 1F FF 1F FF 1F FF 1F 11 FF FF FF F8F FF 8F42 FF F41 FF F41 FF F8F FF FF FF FF 9 11 FF 414 FF 414 FF 414 FF 44 FF 414 FF 4241 FF F8F FF FF 11 FF 44 FF 44 FF 44 FF 4141 FF 418F FF 42F FF FF FF 8FF FF 44 FF 44 FF 4141 FF 428F FF FF FF FF FF FF FF FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

9 Memory land A B C D E F A 11 FF 1F FF 1F FF 1F FF 18F FF 1F FF 1F FF 1F FF 1F 11 FF FF FF F8F FF 8F42 FF F41 FF F41 FF F8F FF FF FF FF 9 11 FF 414 FF 414 FF 414 FF 44 FF 414 FF 4241 FF F8F FF FF 11 FF 44 FF 44 FF 44 FF 4141 FF 418F FF 42F FF FF FF 8FF FF 44 FF 44 FF 4141 FF 428F FF FF FF FF FF FF FF FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

10 Memory land A B C D E F A 11 FF 1F FF 1F FF 1F FF 18F FF 1F FF 1F FF 1F FF 1F 11 FF FF FF F8F FF 8F42 FF F41 FF F41 FF F8F FF FF FF FF 9 11 FF 414 FF 414 FF 414 FF 44 FF 414 FF 4241 FF F8F FF FF 11 FF 44 FF 44 FF 44 FF 4141 FF 418F FF 42F FF FF FF 8FF FF 44 FF 44 FF 4141 FF 428F FF FF FF FF FF FF FF FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF 1F FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

11 MS SQL Server

12 MS SQL Server - User Info A18 1A 59939D 14 C 11D9D4AA 11D9D4AA F : sa (unicode) c 5F3C F B8 5F3FF...8< : p......?..

13 MS SQL Server - User Info A18 1A 59939D 14 C 11D9D4AA 11D9D4AA F : sa (unicode) 59939B8: master (unicode) c 5F3C F B8 5F3FF...8< : p......?..

14 MS SQL Server - User Info A18 1A 59939D 14 C 11D9D4AA 11D9D4AA F : sa (unicode) 59939B8: master (unicode) : mypa55word (unicode) c 5F3C F B8 5F3FF...8< : p......?..

15 MS Response From our investigation it appears that to locate any of the authentication information administrator level privileges are required. This tends to fall under Rule 6 of the 1 Immutable Laws of Security ( ) where basically you have to trust your administrators.

16 The Web Response

17 Passwordizer Pass-what? How does it work Current status

18 How does it work? session =... INFO_OFFSETS = \ [xe, x18, x1d4, x**, x**] # MSSQL build #$%^ info = mint.resolveoffsetslist(session, INFO_OFFSETS)[-1] username = mint.readdword(info + x28) username_len, username = \ ((username >> 16), username & xffff) print 'User name:', mint.readstring(info + username, \ isunicode=true) password = mint.readdword(info + x2c) password_len, password = \ ((username >> 16), username & xffff) print 'Password:', mint.readstring(info + password, \ isunicode=true)

19 Current status SQL Server 2 SQL Server 25 SQL Server 28 SQL Server 28r2 (AKA: 21)

20 Definition of Memory Software Analysis Recovering internal implementation by reading the memory of a running process. Without disassembling machine code.

21 The Hedgehog connection Database activity monitoring

22 More reasons to read memory Not everyone can do SRE, while everyone knows C++ It's a great new useful method Avoiding conflicts with the law

23 Can be used for Security / Monitoring Debugging Cheating in games

24 Wait a minute, this ain't new. Game cheating engines Analysis of crash dumps

25 The Environment

26 Tools for the task Remote process memory reader Python is just the best PyDbg Mint Any other debugger

27 API needed Read memory Search Differential search Recursive search Wandering around

28 Reading memory A B C D E F 6C B 747B B7B C47B 7C 147C 76A C63 C63 C63 C63 C63 C63 6C29 387B 747B 887B C47B D87B 147C 76A C63 C63 C63 C63 C63 C B 4C7B 887B 9C7B D87B EC7B C63 C63 C63 C63 C63 C63 4C7B 67B 9C7B B7B EC7B 7C C63 C63 C63 C63 C63 C63 l)v.l)v {..8{......l{..l{.....`{.. `{... t{..t{......{...{......{...{.....{...{....{...{......{...{......{...{

29 Reading memory a b c d e f A76296C 1 3C67B6 3C67B74 3C67BB 3C67BC4 3C67C 3C67C14 A76296C 3C67B38 3C67B74 3C67B88 3C67BC4 3C67BD8 3C67C14 1 3C67B38 3C67B4C 3C67B88 3C67B9C 3C67BD8 3C67BEC 3C67B4C 3C67B6 3C67B9C 3C67BB 3C67BEC 3C67C l)v.l)v {..8{......l{..l{.....`{.. `{... t{..t{......{...{......{...{.....{...{....{...{......{...{......{...{

30 Reading memory c c a b4 c8 dc f A76296C 3C67B38 3C67B4C 3C67B6 3C67B74 3C67B88 3C67B9C 3C67BB 3C67BC4 3C67BD8 3C67BEC 3C67C 3C67C14 A76296C 3C67B38 3C67B4C 3C67B6 3C67B74 3C67B88 3C67B9C 3C67BB 3C67BC4 3C67BD8 3C67BEC 3C67C 3C67C14 1 1

31 Reading memory Next c c a b4 c8 dc f A76296C 3C67B38 3C67B4C 3C67B6 3C67B74 3C67B88 3C67B9C 3C67BB 3C67BC4 3C67BD8 3C67BEC 3C67C 3C67C14 Prev A76296C 3C67B38 3C67B4C 3C67B6 3C67B74 3C67B88 3C67B9C 3C67BB 3C67BC4 3C67BD8 3C67BEC 3C67C 3C67C14 Num items 1 2 * Dont Know 1

32

33

34

35 Recursive Search

36 Let's take a trip to memory land

37 What lives in the memory realm? Pointers Data Text Time stamp Complete Random Code

38 Data types (Session data) 8B EA374 37EA E FEEEB B 5B8DEA9A 4 7C6F9AD9 2E2A EA E6 8 F1E71 9D8B F8717C2F 8 9 FB145 9D8B FB145 9D8B a EC866 9D8B 2 b F8717C2F 8 39 c 3D5 d e f D5 F 11 4E 4E 12 4E 13 11DA8F 14 F8717C2F B8ED6 TC...t.~.t.~....X O..EG...[..o p q.../ q... E...E... / q N...N... N....../ q.....[...

39 Data types: Data 8B EA374 37EA E FEEEB B 5B8DEA9A 4 7C6F9AD9 2E2A EA E6 8 F1E71 9D8B F8717C2F 8 9 FB145 9D8B FB145 9D8B a EC866 9D8B 2 b F8717C2F 8 39 c 3D5 d e f D5 F 11 4E 4E 12 4E 13 11DA8F 14 F8717C2F B8ED6 TC...t.~.t.~....X O..EG...[..o p q.../ q... E...E... / q N...N... N....../ q.....[...

40 Data types: Pointers 8B EA374 37EA E FEEEB B 5B8DEA9A 4 7C6F9AD9 2E2A EA E6 8 F1E71 9D8B F8717C2F 8 9 FB145 9D8B FB145 9D8B a EC866 9D8B 2 b F8717C2F 8 39 c 3D5 d e f D5 F 11 4E 4E 12 4E 13 11DA8F 14 F8717C2F B8ED6 TC...t.~.t.~....X O..EG...[..o p q.../ q... E...E... / q N...N... N....../ q.....[...

41 Where this memory belongs to Data section Code section Stack Heap OS

42 Data types: Time stamp 8B EA374 37EA E FEEEB B 5B8DEA9A 4 7C6F9AD9 2E2A EA E6 8 F1E71 9D8B F8717C2F 8 9 FB145 9D8B FB145 9D8B a EC866 9D8B 2 b F8717C2F 8 39 c 3D5 d e f D5 F 11 4E 4E 12 4E 13 11DA8F 14 F8717C2F B8ED6 TC...t.~.t.~....X O..EG...[..o p q.../ q... E...E... / q N...N... N....../ q.....[...

43 Data types: Random 8B EA374 37EA E FEEEB B 5B8DEA9A 4 7C6F9AD9 2E2A EA E6 8 F1E71 9D8B F8717C2F 8 9 FB145 9D8B FB145 9D8B a EC866 9D8B 2 b F8717C2F 8 39 c 3D5 d e f D5 F 11 4E 4E 12 4E 13 11DA8F 14 F8717C2F B8ED6 TC...t.~.t.~....X O..EG...[..o p q.../ q... E...E... / q N...N... N....../ q.....[...

44 Data types: Code A B C D E F A B75 5E8B B8 E8E8 8A5D 684 C74 B1F4 14C5 C E8 98B 233 C74 4DFC 1 C5FF FE 16C5 88A FF8B B2F4 26A 85E6 FF55 C CD 8B45 FF8B C3F6 1BC DB74 E55D 3368 B6 8BEC 45FC 3D9 E8C9 8D D856 83C 228B B1 C C4 81EC 833D C76D 14C5 FCFE C4C 8D8D 83C4 8D D8C 5E8B 8B B CC7 2 FF8B FFFF 3DFE FCFE C83 FCFE E8CA C76D 4DFC 159 5E8B 6878 CC3 6D E55D 6A FFFF FE2 FFFF 68D 25B 33CD C76D 4DFC A C C21 5E B 52B9 85 C744 E841 25B 33CD ^.M.3...]...h...j.P. E4...E...=...r...SP...VQ...u...vk.]...V...R. h@2...#p..h....th..t"...m.[.d...^.m.3..a...]...m.[.d...^.m.3.

45 Data types: Code A B C D E F A B75 5E8B B8 E8E8 8A5D 684 C74 B1F4 14C5 C E8 98B 233 C74 4DFC 1 C5FF FE 16C5 88A FF8B B2F4 26A 85E6 FF55 C CD 8B45 FF8B C3F6 1BC DB74 E55D 3368 B6 8BEC 45FC 3D9 E8C9 8D D856 83C 228B B1 C C4 81EC 833D C76D 14C5 FCFE C4C 8D8D 83C4 8D D8C 5E8B 8B B CC7 2 FF8B FFFF 3DFE FCFE C83 FCFE E8CA C76D 4DFC 159 5E8B 6878 CC3 6D E55D 6A FFFF FE2 FFFF 68D 25B 33CD C76D 4DFC A C C21 5E B 52B9 85 C744 E841 25B 33CD ^.M.3...]...h...j.P. E4...E...=...r...SP...VQ...u...vk.]...V...R. h@2...#p..h....th..t"...m.[.d...^.m.3..a...]...m.[.d...^.m.3.

46 Data types: Virtual table c 1BF767C 1BF B9 1CF93D 1CF96 1CB78 145AA92 1CF9C7 145AC1F FF8B9 5653EC8B 8BF98B57 2A A8875 AC3985F 8B BC55 25D8B B 14D39C9 3C F178B

47 Data types: Virtual table c 1BF767C 1BF B9 1CF93D 1CF96 1CB78 145AA92 1CF9C7 145AC1F FF8B9 5653EC8B 8BF98B57 2A A8875 AC3985F 8B BC55 25D8B B 14D39C9 3C F178B

48 Example Searching for sessions table

49 Step 1

50 Step 2

51 Step 3

52 Step 4

53 Step 5

54 Step 6

55 Step 7

56 Step 8

57 Step 9

58 Step A

59 Step B

60 Step C

61 Step D a b c d e f 65ea6 58ba6 65ee5 65fa2 65fc18 37ea454 37ea464 37ea474 37ea484 37ea494 37ea4a4 37ea4b4 37ea4c4 37ea4d4 37ea4e4 37ea4f4 4 65ea6 65ec58 65ee5 65f48 65f63 37ea454 37ea464 37ea474 37ea484 37ea494 37ea4a4 37ea4b4 37ea4c4 37ea4d4 37ea4e4 37ea4f c `.P.`.P... `...X.P... P.P.P.P....P.H.P.....P..P... T.~.T.~... d.~.d.~... t.~.t.~.....~...~.....~...~.....~...~.....~...~.....~...~.....~...~.....~...~.....~...~...

62 Step E

63 Step F

64 What did we get? A pointer to a table set in a global address (In the data section) All currently connected sessions A struct with information about every session, such as session id, user name, password...

65 Version proofed Everything is lost with each new update o Is it? o Hardly ever, because when they add something to a class / struct they add it to the end of it. o They hardly ever change the basic stuff o It just doesn't happen

66 Patterns

67 Automating Update Proof Lets say that there are changes in memory structures o The patterns survive o x86 vs AMD64 vs IA64 vs all the others

68 Candy Python environment to define memory patterns o Patterns of shape Name Range Data type Extra check function

69 Range One of three: 1. End range 2. (start, end) 3. (start, end, step) x1 (x1, x2) (x1, x2, 4)

70 Data Types NUMBER (const value / range / enum, size) BUFFER (const value / anything goes, size) STRING (Nullterm, is_unicode, isprintable, const value) TIME_STAMP(datetime) POINTER POINTER_TO_STRUCT STRUCT ARRAY

71 Shape example SHAPE( "name", (x1, x2), STRING("RECon") )

72 Example of pattern a b c d e f 25DB8 C52D15 33 B 2E 29D E2 4 8 c 29E28 3 2B57C C52CA 45F189 3E C6BFD 45E57C EC8C 2668A4 2668A F2F E2 29E2 4BC8E4 41..].( W.., E...> A......A...A E....Pss.... i`

73 Example of pattern Pattern = [ SHAPE("pssSlotsTable", x1, POINTER_TO_STRUCT( [ SHAPE("next",, POINTER()), SHAPE("prev",, POINTER()), SHAPE("name", (x5, x1), STRING("Pss")) ] ] # Shape is (Name, Place, Data type, Extra check function)

74 Search on Windows 32bit

75 How about Solaris SPARC 64bit?

76 Example of complicated pattern A1C 24A6CB 24A FF 2A1D 24A68 24A6E 24A7C 8 2A1E 24E88 24A696 24A6ED 24A71E c ADF 24A6A1 24A6F7 24A723...`%.X% N......hJ `ij.jj.lj.nj.nj poj.pj.pj.qj rj

77 Pattern #2 Pattern = [ SHAPE("cache", (, x1), STRUCT([ SHAPE("table_size",, NUMBER((x1, x1))), SHAPE("table1",, POINTER()), SHAPE("table2",, POINTER(), extracheck = lambda context: context.table2 == context.table1 + ((context.table_size + 1) * PSIZE)))]))] # Shape is (Name, Place, Data type, Extra check function)

78 The Real World

79

80

81 What's next? Web Servers Monitoring Anti-Virus Flash debugger Open sourcing everything Coffe...

82 FIN Questions?

83 A trick to uncover asterisks passwords

84 Step 2

85 Step 3

86 Step 4