►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Exploiting Buffer Overflows on RISC-V - Christina Quast, None
Almost 10 years ago, work on the RISC-V ISA specification began. Since around a year, we had the first hardware showing up, and since this year, this hardware is even affordable. With this development, the first products and also the first exploits will show up. This talk will give an introduction to the RISC-V architecture and how exploitation differs from Intel and ARM. Afterward, examples of how to overflow a buffer, create shellcode in assembler language, and finally, how to perform ret2libc are shown. Basic understanding of assembly and C is a plus.
https://sched.co/Nrsm
A
So
maybe
it's
an
words
about
me:
I'm
yeah,
Cristina
class
I'm
working
as
an
embedded
systems,
developer,
I
studied
Electrical
Engineering
at
tu,
Berlin
and
now
I'm
living
in
France
and
nice,
and
my
university
I
played
IT
security
CTF
and
that's
how
I
got
interested
in
security
and
that's
what
this
talk
would
be
about.
Partly
so
that's
what
I
will
be
covering
after
the
introduction.
I
will
give
you
an
architectural
overview
over
the
architecture.
A
Risk
5
I
will
tell
you
about
the
differences
to
arm
and
x86
are,
and
then
we
will
directly
dive
into
hands-on
examples:
how
to
exploit
the
buffer
overflow,
how
to
write
your
own
child
code,
first,
brisk
fight
and
how
to
perform
red
tulip,
see
and
I
hope.
All
those
words
will
make
more
sense
to
you
once
this
presentation
is
over.
A
It
was
started
2010
at
the
University
of
California
and
broccoli,
but
since
then,
it
has
seen
many
contributions
and
in
since
2018
VF
ports
out
there
in
hardware,
because
before
it
was
just
a
software
written
a
program,
but
you
could
flash
on
to
your
FPGA
to
simulate
an
CPU
but
yeah.
Nowadays
you
have
hardware
and
since
March
2019
diversion
to
to
a
stable
of
this
instruction
set
architecture,
and
you
can
start
using
it
in
your
doctor
development
projects
and
to
see
how
important
this
project
actually
is.
A
A
Yes,
basically
like
dimension
language,
which
describes
what
your
key
was
capable
of
carrying
out,
and
so
what
you
have
CPU
actually
understands
is
binary
data
and
that's
what,
but
it
also
make
it
easier
for
us
programmers.
Yes,
the
assembly
in
demonic
language,
which
we
see
here,
for
example,
this
one
means
at
the
immediate
559
to
whatever
is
stored
in
the
register,
a
five
and
stored
back
into
a
five,
but
what
the
CPU
actually
sees
as
just
binary
data,
which
means
the
same,
and
so
why
do
we
care
that
there
is
an
open
hardware
implementation
now?
A
Why
do
we
want
to
have
an
open
hardware,
processor
or
CPU
yeah
for
one?
It's
the
license
fees,
I
managed
nowadays,
for
example,
if
you
want
to
implement
your
own
ARM
architecture,
you
would
need
to
pay
a
royalty
fees
to
arm
or
so.
If,
for
example,
a
start-up
wants
to
make
a
quick
prototype
or
university
wants
to
use
an
architecture
to
teach
it
to
the
students,
there
was
nothing
on
the
market
until
now.
A
So
that's
where
s5
comes,
for
example,
interplay
and
the
idea
behind
describes
also
dude
democratize
and
the
process.
So
you
have
documentation
to
the
chip
and
anybody
can
join
the
risk
right,
Foundation
and
discuss
and
find
a
consensus
how
what
kind
of
features
to
include
in
the
architecture
in
which
node
and
anybody
can
join,
which
means
be
it
a
company
or
an
individual.
A
One
possibility
would
have
been
to
yeah
I
take
up
one
of
the
boards,
but
I
thought
it
would
be
easier
to
just
emulators
in
qmo,
so
I
downloaded
the
image
from
the
federal
website
and
launched
it
on
ready,
I
had
a
usable
risk,
5
system
with
toolchains,
where
I
had
to
build
it
and
nipsey
the
gdb,
which
I
didn't
need
to
try
to
cross,
compile
or
anything.
But
the
problem
is
it's
quite
resource
hungry.
So
it's
on
my
system,
for
example,
it
needs
three
minutes
to
startup.
A
It's
a
reduced
instruction
set
computer,
which
means
you
have
small
instructions
which
are
not
complex
with
just
to
one
task
until,
for
example,
has
push
and
pop
operations
to
put
things
on
a
stack
and
take
things
from
the
deck
brisk
Park
doesn't
have
that
you
need
to
address
your
stack
relative
to
your
memory
and
your
program
counter
cannot
be
directly
written.
Instead,
you
have
to
play
around
with
the
returned
stack,
which
is
usually
put
on
a
stack,
and
you
have
to
override
that.
A
A
The
risk
five
has
a
modular
approach,
which
means
there's
only
one
minimal
instruction
set
which
is
obligatory
to
implement,
and
everything
is
everything
besides.
That
is
optional.
The
minimal
instruction
set
has
jumps,
branches,
logical
operations
or
add
and
subtract
operations,
but
you
can
also
add
multiplications
on
integers
floating
point
operations
vector
operations.
A
You
can
add
a
64
bit
instruction
set
on
top
of
that
and
and
100
128
bit
instruction
size
know
an
instruction
set
as
in
works
right
now
and
also
you
can
use
compress
and
instructions
which
the
compress
and
extension
uses
to
byte
for
one
instructions
and
set
up
for
so
what
else
are
differences
between
architectures
so
on
risk?
Five,
as
well
as
an
arm
you
would
have.
You
can
use
your
registers
a
zero
to
a
seven
to
pass
functions
to
parameters
to
a
function
in
x86
32-bit.
A
A
Most
of
the
instructions
have
access
to
memory,
so
you
can
perform
your
ads
or
sub
directly
on
a
memory
address,
whereas
on
arm
and
risk
height
you
first
need
to
load
the
value
from
memory
into
a
register
then
perform
whatever
operation
you
want
to
perform
and
then
put
it
back
into
memory
so
yeah.
This
guy
is
therefore
called
a
load
store
architecture.
Why
x86
as
a
riggis
is
a
register
memory
architecture,
then
risk
5
instructions
are
or
memory
accesses,
byte
aligned,
while
instruction
act,
access
to
instructions,
a
memory
is
route
aligned.
A
And
risk
life
get
inspired
by
many
successful
CPUs,
which
are
already
on
the
market
like
spark
and
Power,
PC
or
MIPS,
or
on
an
autumn,
has
have
a
fixed.
This
instruction
set,
while,
for
example,
Intel
as
known
to
have
variable
size
instructions
which
are
harder
to
schedule
or
pilot
through
fetch
and
decode,
and
the
CPU
and
all
those
CPUs
have
a
vast
number
of
registers,
so
that
you
do.
A
So
this
is
the
important
registers
we
will
be
looking
at
later
in
our
assembler
code,
for
example,
we
have
the
zero
register,
which
is
basically
only
zero,
which
is
useful
in
programming
in
general,
for
example.
Sometimes
you
want
to
compare
a
better
pointer
is
null
or
whether
a
value
of
zero,
and
you
already
have
just
register
at
hand
while
in
other
architectures,
you
would
need
to
clear
this
register
first
before
you
can
use
it
for
comparison
and,
furthermore,
having
the
zero
register
also
reduces
the
instruction
set,
because
you
can
use
it
for
negation.
A
A
A
So
he
stores
back
the
you
turn
address
and
the
frame
pointer
and
yeah
distracts
the
stack
and
jumps
to
this
address
which
was
yeah
stored
before
so
that's
how
it
looks
like
on
a
buffer.
It
says
that
this
is
your
stack
and
stack
grows
downwards.
First,
address
space,
groans
upwards,
so
basically
after
lower
address
here,
for
example,
0
X
naught
0,
0
and
here
the
bigger
address
0xffff.
A
And
so
what
happens?
If
you
have
local
variables,
they
are
basically
just
stored
after
this
a
frame
pointer.
So
if
you
have
a
local
variable
and
in
a
which
is
5
you
stored
here
and
B
as
you
stored
afterwards
on
your
stack
and
maybe
at
this
point
you
can,
if
you
have
a
function
like
mem
copy
or
string
copy,
it
will
still
start
from
the
lower
address
and
will
overwrite
to
the
upper
address
and
I
guess.
At
this
point
you
can
imagine
how
a
buffer
overflow
can
overwrite
your
attend
address,
which
you
will
use
later.
A
So,
for
me,
hacking
is
like
basically
are
searching
some
blocks
of
Lego
or
DUPLO,
and
you
build
up
your
Tower
to
create
an
exploit
and
that's
what
we
are
gonna.
Do
we're
gonna
search
for
stones
to
build
up
our
Tower,
let's
start
with
a
buffer
overflow.
So,
for
example,
they
have
dysfunction
which
is
yeah
well
number
two
buffer
overflow,
because
you
have
a
buffer
of
eight
byte
and
you're,
not
checking
the
size
of
the
buffer.
A
You
just
over
writing
whatever
was
passed
to
a
function
in
our
Creek
and
then,
let's
assume
you
have
this
magic
function,
give
shell,
which
just
opens
a
shell
for
you,
and
you
can
do
whatever
operation
you
want
to
do
afterwards,
and
so
what
you
want
to
do
is
use
a
buffer
overflow
to
override
the
veto,
an
address
of
the
usual
function
with
our
gift,
shell
function,
which
gives
us
all
their
rights,
and
so
basically,
after
the
buffer
overflow.
We
don't
care
about
us
in
the
buffer.
A
We
want
to
put
any
valid
address
into
the
safe
frame
pointer
or
depends.
Sometimes
you
don't
care,
and
we
just
want
to
be
sure
that
in
this
address
on
the
stack
you
have
the
gift
shell
address
later,
and
so
how
do
we
go
about?
How
do
we
approach
this
problem?
The
first
of
all,
we
have
to
find
the
address
of
crab
shell
and
you
can
use
object,
dump
and
decode
for
that.
So
we
have
our
address
and
then
we
just
play
around
with
gdb.
A
So
we
pass
some
input
into
the
our
program
and
see
where
it
crashes.
So,
in
our
case,
it
crashes
at
this
address
and
for
those
have
played
around
with
hex
a
lot
that
is
basically
hex
byte
zero
X
41
is
basically
just
a
in
hex,
and
you
wonder
right
why
this
one
is
a
40.
Instead
of
a
41
as
I
said,
risk
five
access
to
instructions
is
always
at
least
two
byte
aligned
or
half
word
aligned.
That's
why
you
can
never
have
a
warning
here.
A
So,
but
what
do
we
do?
If
you
happen?
You
don't
have
this
magical
gift?
Shell
function.
What
do
you
do
to
get
a
shell?
In
this
case
that
case
you
can
write
shell
code.
What
a
shell
code
shellcode
is
some
hex
bytes.
You
can
pass
to
the
CPU
which
will
spawn
a
shell
for
you.
It
will
basically
do
the
equivalent
of
system
with
the
string,
business
H
in
it
or
something
and
normally
for
known
architectures.
You
can
download
most
of
your
shell
code
from
shell
storm
a
website
but
simpler
scribe.
A
As
a
new
architecture,
you
have
to
do
it
by
hand
this
time
so
yeah.
So
this
is
the
basic
idea
you
find
some
executable
area
in
your
memory
like
the
stack
or
the
heap.
Sometimes
you
have
to
leak
the
address
that,
in
our
example,
to
make
it
easy.
The
program
will
just
give
us
the
address,
and
then
you
write
some
assembler
code
put
your
shellcode
into
your
buffer
overwrite.
A
So
this
is
that's
our
vulnerable
function.
In
this
case
again
we
have
a
buffer
which
in
this
case
it's
128,
byte
big
and
that's
approximately
that's
a
place.
The
in
space
we
have
to
put
our
shellcode,
it
can
be
up
to
128
bytes
in
size
and
again
we
have
a
string
copy
which
does
not
check
for
any
size
of
your
buffer
and
just
overrides
whatever
it
finds
and
again
because
of
the
arc
v1
arguments
or
whatever
is
passed
to
your
program,
and
so
how
do
we
go
about?
A
A
If
you
don't
care
so
first,
you
have
to
find
out
also
execute
a
source
code,
so
we
have
to
find
out
the
Cisco
number
and
for
that
we
can
either
look
into
the
header
and
see
okay,
let's
just
call
number
221,
or
we
can
again
look
at
Lipsy
and
see
how
how
this
function
is
called
and
Lipsey
will
just
load
the
number
two
and
21
into
through
justa,
a
seven
which
is
designated,
as
is
just
call
number
or
juicer,
and
then
called
the
instruction
ecole
so
yeah.
So
that's
what
we
basically
want
to
do.
A
A
So
this
is
my
C
function
and
this
is
the
resulting
shell
code
and
as
I
as
you
can
see
that
that's
basically
the
prologue
and
the,
but
we
don't
have
an
epilogue
in
this
case
because
we
don't
care
what
happens.
Let's
attack
afterwards,
but
here
you
see
the
prologue
fee
so
on
the
beginning.
But
the
problem
now
is.
A
Yeah,
but
in
that
compile
function
is
using
the
P
ot.
The
procedure
linkage
table,
which
is
an
mechanism
where
a
program
kind
can
find
dynamic.
Reaver
Lipsy
functions
are
located,
so
basically
it's
like
a
trampoline.
It
goes
to
a
place,
searches
for
the
address
of
the
real
exit
v
and
jumps
there
later
and
yeah.
So,
instead
of
going
round
circles,
we
can
just
directly
put.
A
Whatever
the
execute
function
does
in
there
and
half
our
salting
shell
code
yeah,
then
you
compile
it
and
you
execute
it
and
you
double
check
that
it
works.
But
at
this
point
you
have
a
problem
because
you
have
snail
bites
and
you
know
what
happens
with
string
copy.
If
you
pass
something
which
has
now
bytes,
it
stops
copying
exactly
so.
You
won't
have
any
nail
bytes
in
your
shellcode,
because
you
will
not
copy
the
whole
shellcode
down.
So
after
having
this
base
of
the
shellcode,
you
want
to
remove
all
the
nail
bytes.
A
And
how
can
you
do
that?
Yeah?
For
example,
in
the
original
version
it
used
power
of
two
num
number
in
order
to
adjust
the
stack.
You
can
use
an
odd
number,
let's
say
in
the
base
2
system
in
order
to
F
a
function
which
doesn't
use
no
bytes
and
then
ya
later
have
to
adjust
the
offset
when
you're
referencing
a
zero
as
well,
but.
A
Then
here,
for
example,
we
are
loading,
the
immediate
value
of
0
X
687
into
our
register,
a
five,
and
instead
of
doing
that,
we
can
take
a
larger
byte,
a
larger
number
2
remove
null
lights,
and
then
we
have
to
account
for
the
offset
we
created
by
doing
more
operation,
which
makes
our
shellcode
bigger,
but
at
least
moved
now,
bytes
and
then
the
last
probably
has
is
eco
instruction
and
you
have
to
perform
it.
S
is
so
in
order
to
remove
that.
A
A
So
what
you
see
here
is
exactly
the
shellcode
me
just
created
and
that's
exactly
what
we
want
to
pass
a
pass
into
our
buffer
yeah.
So
you
find
it
here
again
same
shellcode,
and
so
we
overwrite
the
buffer
of
the
shellcode
and
then
the
rest
of
the
buffer
size.
We
fill
up
a
face
because
we
don't
care.
This
is
where
the
frame
pointer
would
be
located,
and
this
is
the
address
we
want
to
jump
to,
because
luckily
our
main
program
just
gave
us
the
address
where
the
buffer
is
located,
where
our
shellcode
starts.
A
So
we
can
just
come
there
and
we
are
greeted
from
our
shell
here
and
so.
But
what
happens
if
our
stack
or
heap
is
not
executable,
because
that's
what
a
program
nominee
is
right.
You
don't
want
anybody
to
execute
code
on
your
stack.
Then
you
can
perform
route
to
a
red
tulip
C,
which
is
a
technique
of
Rob
or
via
return-oriented
programming.
A
So
yeah,
let's
assume
that's
our
vulnerable
program
and
it
just
reads
in
whatever
it
finds
in
the
file
we
pass
over
FD
and
yeah.
That's
it
and
our
stake
is
not
executable.
We
can
try
to
perform
rock
now
and
Rob
means
you
basically
search.
You
know
what
slip
C
version
is
running
on
your
system,
so
you
know
what
possibility
M
the
instructions
we
have
in
this
Lipsy
and
you're
searching
for
assembly
instructions.
A
So,
for
example,
in
our
case,
we
want
to
execute
the
function
system
which
again
we
pass
the
string,
business,
age
and
so
yeah.
First,
we
have
to
find
a
rope
get
it
again.
We
use
object,
dump
D
code
for
that
we
grab
around
and
out
of
the
1000
gadgets.
I
found
this
one,
it's
nice,
because
what
we
want
to
have
after
our
buffer
overflow
is
having
the
address
of
system
in
our
register.
Ra
the
return
address
register.
A
A
So
next
step
is.
We
have
to
find
out
where
the
address
of
system
is.
Actually,
we
use
object,
dump
for
that
again
and
then
there's
the
Python
script,
which
will
generate
D
file
with
the
exploited.
So
we
fill
the
buffer
with
face
because
we
don't
care.
This
is
the
frame
pointer
again,
and
this
is
the
gadget
address
we
found
so
the
shell
code
I
showed
you
which
basically
initializes
the
you
an
address
and
a
zero
for
us
and
then
on
this
stack
further.
You
find
the
address
of
this
string.
H
yeah.
A
The
listeth
the
generated
that
the
file
colored
Explorer
generated
by
Python
code,
which
is
read
in
for
a
program
into
the
buffer.
So
obviously
this
is
the
ACE,
for
example
the
beast
and
the
addresses
you
know
any
code
as
well,
so
we
just
passes
to
our
function
ball
and
it
opens
a
shell
for
us
and
actually
I
used
like
normally.
A
If
you
want
to
try
out
your
exploit
in
this
case
in
gdb,
the
problem
is
that
gdb
puts
environment
variables
into
your
stack,
like
vironment
variables
are
located
on
the
stack,
so
it
will
move
around
where
your
buffer
is
located
in
the
end.
So
in
order
to
facilitate
that,
you
can
either
remove
it
by
hand
or
you
use
this
fancy.
Script
called
fixed
ends
which
you
can
get
from
github
and
it
will
adjust
your
stack
for
you
yeah.
A
That's
basically
it
if
you
have
any
questions,
feel
free,
but
otherwise
I'm
giving
away
some
risk
5,
ports
and
hardware.
If
you
have
some
fancy
project,
come
talk
to
me
and
I
will
hand
you
a
board
and
maybe
tweet
about
what
you
want
to
do
to
motivate
you
more
yeah.
That's,
oh!
Do
you
have
any
questions.
B
A
The
other
is,
for
example,
in
L
register
or
the
return
address,
register
or
frame
pointer
yeah.
So
basically
they
are
used,
but
they
are
not
used
from
argument
passing
or
temporary
registers
where
you
just
store
values,
but
you
don't.
They
are
not
defined.
As
passing
two
functions
registers
yeah
there
was
another
question,
I
think
nope.