Practical Data-Only Attack Generation

As control-flow hijacking is getting harder due to increasingly sophisticated CFI solutions, recent work has instead focused on automatically building data-only attacks, typically using symbolic execution, simplifying assumptions that do not always match the attacker's goals, manual gadget chaining, or all of the above. As a result, the practical adoption of such methods is minimal. In this work, we abstract away unnecessary complexities and instead use a lightweight approach that targets the vulnerabilities that are both the most tractable for analysis, and the most promising for an attacker. In particular, we present EINSTEIN, a data-only attack exploitation pipeline that uses dynamic taint analysis policies to: (i) scan for chains of vulnerable system calls (e.g., to execute code or corrupt the filesystem), and (ii) generate exploits for those that take unmodified attacker data as input. EINSTEIN discovers thousands of vulnerable syscalls in common server applications-well beyond the reach of existing approaches. Moreover, using nginx as a case study, we use EINSTEIN to generate 944 exploits, and we discuss two such exploits that bypass state-of-the-art mitigations. Step 1: Exploit a memory write vulnerability. Step 2: Steer the execution to a gadget's entry point. Step 3: Execute some payload via a gadget chain. (a) Steps in any non-control (or control) data attack. Goal 1: Automatically model an arbitrary memory write vulnerability. Goal 2: Automatically identify an arbitrary gadget entry point. Goal 3: Automatically produce a full gadget chain.