RIP ROP: CET Internals in Windows 20H1
windows-internals.com
RIP ROP: CET Internals in Windows 20H1
1–10 of 42 posts
Re: RIP ROP: CET Internals in Windows 20H1
#2 TLDR? Why does this matter?
"As a reminder, Intel CET is a hardware-based mitigation that addresses the two types of control-flow integrity violations commonly used by exploits: forward-edge violations (indirect CALL and JMP instructions) and backward-edge violations (RET instructions). "
Why are these important
Re: RIP ROP: CET Internals in Windows 20H1
#3TLDR? Why does this matter? "As a reminder, Intel CET is a hardware-based mitigation that addresses the two types of control-flow integrity violations commonly used by exploits: forward-edge violations (indirect CALL and JMP instructions) and backward-edge violations (RET instructions). " Why are these important
It's a mitigation for a software exploitation technique called Return Oriented Programming (ROP). The mitigation is referred to as 'Control Flow Integrity' (CFI).
https://software.intel.com/content/www/us/en/develop/article...
Essentially an attacker who has the ability to exploit the first stage of a vulnerability will be able to stitch together "gadgets" from the program to build up a second stage of the exploit.
Control flow integrity, to my understanding, applies a validation or restriction of the program's call graph. This limits the attackers ability to just stitch up their own arbitrary call graph. There are 'forward edge' protections (calling a function) and 'reverse edge' protections (ret). But of course there are more ways to control the flow of a program, as this document discusses - like longjmp.
I won't try to get more detailed as I'm not an expert. Hopefully this will help you find more information.
Re: RIP ROP: CET Internals in Windows 20H1
#4TLDR? Why does this matter? "As a reminder, Intel CET is a hardware-based mitigation that addresses the two types of control-flow integrity violations commonly used by exploits: forward-edge violations (indirect CALL and JMP instructions) and backward-edge violations (RET instructions). " Why are these important
IDK, but it's because security.
Judging by the title, it helps avoiding ROP: "Return-oriented programming is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing." (Wikipedia)
Re: RIP ROP: CET Internals in Windows 20H1
#5TLDR? Why does this matter? "As a reminder, Intel CET is a hardware-based mitigation that addresses the two types of control-flow integrity violations commonly used by exploits: forward-edge violations (indirect CALL and JMP instructions) and backward-edge violations (RET instructions). " Why are these important
Using ROP techniques in a binary bypasses a lot of stuff such as ASLR, canaries and even DEP (I think...).
I’ve seen ROP exploitation in binaries and is pretty handy when there is no other way to get a setuid binary to give you a shell as root.
Watch Rope from ippsec on YT (on my phone atm).
Re: RIP ROP: CET Internals in Windows 20H1
#6TLDR? Why does this matter? "As a reminder, Intel CET is a hardware-based mitigation that addresses the two types of control-flow integrity violations commonly used by exploits: forward-edge violations (indirect CALL and JMP instructions) and backward-edge violations (RET instructions). " Why are these important
Using ROP techniques in a binary bypasses a lot of stuff such as ASLR, canaries and even DEP (I think...). I’ve seen ROP exploitation in binaries and is pretty handy when there is no other way to get a setuid binary to give you a shell as root. Watch Rope from ippsec on YT (on my phone atm).
ROP does not bypass ASLR or canaries. It does bypass DEP/NX in the sense that it executes code that already exists in executable memory.
Re: RIP ROP: CET Internals in Windows 20H1
#7TLDR? Why does this matter? "As a reminder, Intel CET is a hardware-based mitigation that addresses the two types of control-flow integrity violations commonly used by exploits: forward-edge violations (indirect CALL and JMP instructions) and backward-edge violations (RET instructions). " Why are these important
TLDR ROP is common technique for making programs do bad things so this prevents a whole bunch of bad things from happening.
Re: RIP ROP: CET Internals in Windows 20H1
#8Earlier quoted context omitted.
Using ROP techniques in a binary bypasses a lot of stuff such as ASLR, canaries and even DEP (I think...). I’ve seen ROP exploitation in binaries and is pretty handy when there is no other way to get a setuid binary to give you a shell as root. Watch Rope from ippsec on YT (on my phone atm).
ROP does not bypass ASLR or canaries. It does bypass DEP/NX in the sense that it executes code that already exists in executable memory.
Agree re: canaries, but when I learned about ROP I was told that ASLR typically is not employed on the text segment (due to lack of position independence) which is why ROP effectively acts a bypass for ASLR on the stack / heap and why we need things like control flow enforcement. Is this not the case or no longer the case?
Re: RIP ROP: CET Internals in Windows 20H1
#9TLDR? Why does this matter? "As a reminder, Intel CET is a hardware-based mitigation that addresses the two types of control-flow integrity violations commonly used by exploits: forward-edge violations (indirect CALL and JMP instructions) and backward-edge violations (RET instructions). " Why are these important
It's a mitigation for a software exploitation technique called Return Oriented Programming (ROP). The mitigation is referred to as 'Control Flow Integrity' (CFI). https://software.intel.com/content/www/us/en/develop/article... Essentially an attacker who has the ability to exploit the first stage of a vulnerability will be able to stitch together "gadgets" from the program to build up a second stage of the exploit. C…
I'll add on since this is the most informative post so far (and I've written a static binary re-writer to add shadow stack protection to an existing binary).
A shadow stack is a limited subset of the call stack that only stores return addresses. In normal operation, Every time your compiled program makes a function call, it stores the return address on the main call stack (modulo certain compiler optimizations) so that when the called function returns, your program can resume executing directly after the point at which it called the function.
With a shadow stack, when a function is called, the return address is copied to a separate "shadow" stack as well as the call stack. When the called function returns, the return address on the two stacks are compared and the program fails if they are different.
In new Intel microprocessors, the shadow stack is implemented in hardware. The numerous corner cases require software support that the article describes.
Re: RIP ROP: CET Internals in Windows 20H1
#10Earlier quoted context omitted.
ROP does not bypass ASLR or canaries. It does bypass DEP/NX in the sense that it executes code that already exists in executable memory.
Agree re: canaries, but when I learned about ROP I was told that ASLR typically is not employed on the text segment (due to lack of position independence) which is why ROP effectively acts a bypass for ASLR on the stack / heap and why we need things like control flow enforcement. Is this not the case or no longer the case?
ASLRing text segments is optional, but possible. There are negative performance tradeoffs.