Exploiting nginx chunked overflow bug, the undisclosed attack vector Long Le longld@vnsecurity.net
About VNSECURITY.NET CLGT CTF team 2 VNSECURITY.NET
In this talk Nginx brief introduction Nginx chunked overflow bug The analysis The exploit The undisclosed attack vector x86-64 ROP tricks Demo 3 VNSECURITY.NET
Nginx [engine x] HTTP and reverse proxy server Fast, light-weight Popular 4 VNSECURITY.NET
Nginx architecture Non-blocking IO Event driven Single threaded Single master, multiple workers Resources efficient Highly modular ref: http://www.slideshare.net/joshzhu/nginx-internals 5 VNSECURITY.NET
Nginx architecture big picture ref: http://www.aosabook.org/images/nginx/architecture.png 6 VNSECURITY.NET
The vulnerability http://en.wikipedia.org/wiki/integer_overflow 7 VNSECURITY.NET
The analysis (1) HTTP header: Transfer-Encoding: chunked 8 VNSECURITY.NET
The analysis (2) 9 VNSECURITY.NET
The analysis (3) 10 VNSECURITY.NET
The analysis (4) stack based overflow 11 VNSECURITY.NET
The exploit Stack cookie bruteforcing May require hundred/thousand of connections Noisy error logs nginx < 1.4.1 binaries from nginx.org has no stack cookie ASLR return to binary Default is non PIE NX ROP https://github.com/danghvu/nginx-1.4.0/blob/master/exp-nginx.rb 12 VNSECURITY.NET
The humble mitigation 13 VNSECURITY.NET
Quick summary Default nginx settings (static contents) Stack based overflow Straight to exploit Stack cookie slows down attack 14 VNSECURITY.NET
Practical Nginx deployment Nginx + FastCGI backend E.g: Wordpress Nginx + Apache/Lighttpd Reverse proxy 15 VNSECURITY.NET
The undisclosed attack vector Same vulnerability Different configuration More targets Heap based overflow! No worry about stack cookie Not straight to exploit 16 VNSECURITY.NET
The analysis (1) 17 VNSECURITY.NET
The analysis (2) 18 VNSECURITY.NET
The analysis (3) 19 VNSECURITY.NET
The analysis (4) 20 VNSECURITY.NET
The analysis (5) heap based overflow 21 VNSECURITY.NET
POC trigger 22 VNSECURITY.NET
Crash dump 23 VNSECURITY.NET
The exploit Send enough data Crafted payload to pass some checks ROP stuff Run n Pray! It s unreliable 24 VNSECURITY.NET
The unreliable issue Interfered by events Connections coming Connections have data Connections closing Heap metadata corruption Nginx internal pool libc Difficult to debug Event driven 25 VNSECURITY.NET
Crash madness VNSECURITY.NET
Nginx internals (1) ref: http://www.slideshare.net/joshzhu/nginx-internals 27 VNSECURITY.NET
Nginx internals (2) 28 VNSECURITY.NET
Nginx internals (3) 29 VNSECURITY.NET
The solution Heap spraying Open many connections Force each connection to allocate large chunk Reserve contiguous memory Overflow the handler and trigger read_event_handler() Send more data to trigger read event 30 VNSECURITY.NET
The refined POC 31 VNSECURITY.NET
Heap spraying (1) 32 VNSECURITY.NET
Heap spraying (2) header N buffer N header N+1 buffer N+1 header N+2 33 VNSECURITY.NET
Overflow the handler (1) header N buffer N header N+1 buffer N+1 header N+2 34 VNSECURITY.NET
Overflow the handler (2) 35 VNSECURITY.NET
The refined exploit Open N connections (e.g N=32) All connections send the chunk trigger For connections from N/2 to N send same ROP payload Jump to controlled, contiguous memory before overflowing 36 VNSECURITY.NET
x86-64 ROP tricks (1) Use 32-bits gadgets Heap address is 32-bits xchg rsp, rax xchg esp, eax 37 VNSECURITY.NET
x86-64 ROP tricks (2) RET blocks RIP call [rax+0x30] RAX heap payload RAX RIP ret ret ret ret ret pop_ret xchg_ret real payload address growth 38 VNSECURITY.NET
x86-64 ROP tricks (3) Use less argument functions for ret2plt, ret2libc mprotect() vs mmap64() mmap64() rdi => address rsi => size rdx => proto rcx => flags r8 => fd r9 => offset mprotect() rdi => address rsi => size rdx => proto libc offset: mprotect mmap = 0x60 39 VNSECURITY.NET
Shellcode tricks Continue to serve normal HTTP requests fork() then parent exit() Advanced socket reuse stage-1: fd hunting loop read from fd 1 1024 check for tag jump to stage-2 with found fd stage-2: normal socket reuse shell 40 VNSECURITY.NET
Demo 41 VNSECURITY.NET
Conclusion We found another (now known) attack vector of the ngxin chunked overflow bug Not only stack based overflow Impact to almost practical deployments We built a reliable heap based overflow exploit No worry about stack cookie bruteforcing Fast to gain shell Exploit on x86 should be the same but easier 42 VNSECURITY.NET
Questions? 43 VNSECURITY.NET