These notes are a random collection of links, talking points, simple explanations and interesting posts relating to Exploit Defence, i.e. mitigations and bypasses relating to arbitrary-code execution vulnerabilities.
This is not a tutorial, nor a review of any particular product or a critique of any specific technique, it's just a collection of interesting things related to the general field of exploit defence.
This is also not intended to be complete; it's more of a collection of things that came up in recent conversations, or that were interesting in some other way. If you're a friend of mine in this field and didn't get a specific reference, I'm sorry :( This is a work in progress, so, sections will be incomplete and you'll probably see yourself cited before too long :)
Shameless plug: if you're interested in these things, check out The Shellcoder's Handbook:
It's old (2007 old) but the basics are still the basics. Other great foundational books in this space are "Hacking: The Art of Exploitation" by Jon Erickson, and "Reversing: Secrets of Reverse Engineering" by Eldad Eilam.
The EDG Team at NCC created some excellent notes on exploit mitigations across platforms:
https://github.com/nccgroup/exploit_mitigations
- NCC: https://research.nccgroup.com/
- Project Zero: https://googleprojectzero.blogspot.com/ https://github.com/orgs/googleprojectzero/repositories
- Github Security Lab: https://securitylab.github.com/research/
- https://github.blog/tag/github-security-lab/
- MSRC: https://msrc.microsoft.com/blog/
- ZDI: https://www.thezdi.com/blog
- HackerOne: https://hackerone.com/hacktivity/overview
- Alex Ionescu's Blog: https://www.alex-ionescu.com
- lcamtuf's blogs: https://lcamtuf.blogspot.com https://lcamtuf.substack.com/
- phrack: http://phrack.org/
- POC||GTFO: https://pocorgtfo.hacke.rs
- BugTraq: https://seclists.org/bugtraq/
- Full Disclosure: https://seclists.org/fulldisclosure/
- Daily Dave: https://seclists.org/dailydave/
...with occasional CWE references (the CWE taxonomy is debatable but generally great)
- Buffer Overflow - https://cwe.mitre.org/data/definitions/120.html
- Stack Overflow
- Heap Overflow
- Buffer Underflow - https://cwe.mitre.org/data/definitions/786.html
- Out of Bounds Read / Write (single element)
- Off by One
- Null byte append
- Signedness index
- Wraparound index
- User-specified size/count
- Off by One
- Pointer arithmetic error
- Format String (yes, still)
- Use After Free (Expired Pointer Reference)
- Double Free
- Type Confusion - https://cwe.mitre.org/data/definitions/843.html
- Uninitialised pointer reference - https://cwe.mitre.org/data/definitions/824.html
- Information Leak
- Unclean buffer / reuse of previous allocation
- Buffer over-read - https://cwe.mitre.org/data/definitions/126.html
- Exception handling error : https://cwe.mitre.org/data/definitions/703.html
- NOP Sled, also nop equivalence as a concept
- Unhandled Exception Filter : https://www.blackhat.com/presentations/win-usa-04/bh-win-04-litchfield/bh-win-04-litchfield.ppt
- Ret to libc : (e.g. Nergal: http://phrack.org/issues/58/4.html )
- ROP (also RAP: RIP ROP https://pax.grsecurity.net/docs/PaXTeam-H2HC15-RAP-RIP-ROP.pdf )
- Weird Machines (halvar): http://www.dullien.net/thomas/weird-machines-exploitability.pdf
- Heap Spray
- Heap Feng Shui : https://www.blackhat.com/presentations/bh-europe-07/Sotirov/Presentation/bh-eu-07-sotirov-apr19.pdf
- Venetian : Unicode-expanded strings : https://github.com/chris-anley/papers/blob/main/ngs/unicodebo.pdf
- Blind Exploit Techniques : https://research.nccgroup.com/wp-content/uploads/2020/07/nisr.blindexploitation.pdf
- Null byte (off by one): https://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html
Use a pointer after the referenced memory has been free()d.
Example: WidgetAPI; allocWidget(), freeWidget(), getWidgetID(), setWidgetID(). Calling alloc, free, then get() returns whatever is in the location and set() sets whatever is in the location (e.g. a pointer)
Call, passing a pointer or handle of the wrong type. This allows data/pointer members to become accessible and shenanegans ensue.
Example: API for type A and B. We pass a handle to B to a call to an A method. Can be read, write primitive, or even call/jmp. Requires reverse engineering to understand the exact pattern of interactions with the data.
- Smashing The Stack For Fun And Profit: http://phrack.org/issues/49/14.html
- Advances in format string exploitation (gera, riq): http://phrack.org/issues/59/7.html
- The Bear in the Arena: http://phrack.org/issues/70/12.html
- https://heartbleed.com
- https://googleprojectzero.blogspot.com/2019/12/sockpuppet-walkthrough-of-kernel.html
- H26Forge: https://i.blackhat.com/BH-US-23/Presentations/US-23-Vasquez-The-Most-Dangerous-Codec.pdf
- Variants with QL: https://sensepost.com/blog/2019/the-power-of-variant-analysis-semmle-ql-cve-2019-15937-and-cve-2019-15938/
- Win10 Heap Exploits: https://www.rapid7.com/blog/post/2019/06/12/heap-overflow-exploitation-on-windows-10-explained/
- All of projectzero's root cause analysis: https://googleprojectzero.github.io/0days-in-the-wild/rca.html
- Registry https://googleprojectzero.blogspot.com/2024/04/the-windows-registry-adventure-1.html
- IDA: The industry standard: https://hex-rays.com/ida-pro/
- x64dbg: https://x64dbg.com
- ghidra: https://ghidra-sre.org
- radare: https://rada.re/n/
- Radare walkthrough: Reversing with Radare2: https://www.youtube.com/watch?v=317dNavABKo
- Hopper (superb for OSX): https://www.hopperapp.com
- unbounded copies, obvs. Not just strcat... consider the bound, where it comes from, whether it's always correct
- sprintf %s
- Fixed 'max size' output buffer is smaller than max possible output
- freeFoo(ptr->subPtr) without nulling (dangling ptr; use after free)
- Incorrect use of bound-limited copies, e.g. strlcpy, strncpy, eg with strlen(src) as max