Your Exploit is Mine: Automatic Shellcode Transplant for Remote Exploits

• Published in: 2017 IEEE Symposium on Security and Privacy (SP) pp. 824 - 839
• Main Authors: Bao, Tiffany, Ruoyu Wang, Shoshitaishvili, Yan, Brumley, David
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.05.2017
• Subjects: Engines; Generators; Layout; Lenses; Security; Software; Systematics
• ISSN: 2375-1207
• DOI: 10.1109/SP.2017.67

Developing a remote exploit is not easy. It requires a comprehensive understanding of a vulnerability and delicate techniques to bypass defense mechanisms. As a result, attackers may prefer to reuse an existing exploit and make necessary changes over developing a new exploit from scratch. One such adaptation is the replacement of the original shellcode (i.e., the attacker-injected code that is executed as the final step of the exploit) in the original exploit with a replacement shellcode, resulting in a modified exploit that carries out the actions desired by the attacker as opposed to the original exploit author. We call this a shellcode transplant. Current automated shellcode placement methods are insufficient because they over-constrain the replacement shellcode, and so cannot be used to achieve shellcode transplant. For example, these systems consider the shellcode as an integrated memory chunk and require that the execution path of the modified exploit must be same as the original one. To resolve these issues, we present ShellSwap, a system that uses symbolic tracing, with a combination of shellcode layout remediation and path kneading to achieve shellcode transplant. We evaluated the ShellSwap system on a combination of 20 exploits and 5 pieces of shellcode that are independently developed and different from the original exploit. Among the 100 test cases, our system successfully generated 88% of the exploits.