(In)Security in C++

Attendees can expect to gain

• A basic understanding of the mindset of an exploit developer. - An understanding of assembly
• Good grasp of tooling that can be used to find vulnerable constructs
• Good idea of things to look for in code reviews
• Good overview of Secure Coding Practices in C++

Secure Coding Practices

The Secure Coding Practices taught are largely based on the C++ Core Guidelines, the Common Weakness Enumeration (CWE) and the SEI CERT Coding Standards for C++.

Prerequisites

The attendees are assumed to be proficient C++

Day 1 - Theme - Vulnerability

The first day is dedicated to learning ways to find vulnerabilities using tooling and fuzzing. We will go through common vulnerable constructs and show which tools can find them and how they can be fixed. We will use fuzzing to find the Heartbleed vulnerability. We round off the day looking at sandboxing as a tool to limit the impact of vulnerabilities.

Plan for the day:

• Introduction: Trainer
• Introduction: Specs
• Introduction: Tooling
• Introduction: UB and Compiler Optimizations
• Exploit: Heartbleed
• Theory: Fuzzing (on Linux)
• Theory: Fuzzing with AFL (on Linux)
• Exercise: Fuzzing (on Linux)
• Exploitable: Numbers
• Exercise: Numbers Dojo
• Practice: constexpr numbers
• Practice: Avoid the Pitfalls
• Practice: Functionality
• Theory: Linux Sandboxing (Chromium)

Day 2 - Theme - Exploitation

The second day is dedicated to understanding how vulnerabilities can be used in exploitation. We will write shellcode and study traditional stack buffer overflow exploits, and use that to understand the platform mitigations that have been introduced over the years. We will then look at memory exploitation and see how all of this can be used together in real life by looking at the Eternal Exploits. We will round off the day with some rules of thumb and discussion.

Plan for the day:

• Exploit: Shellcode 1 (on Linux)
• Exploit: Shellcode 2 (on Linux)
• Exercise: Shellcode (on Linux)
• Mitigations: Memory
• Exploitable: Memory 1 & 2
• Theory: Memory Managers (on Linux)
• Theory: Heap Exploitation
• Exploit: Eternal Exploits
• Exploitable: Modern C++
• Exercise: Memory Dojo
• Practice: Resource Management
• Practice: Prefer C++ to C
• Practice: I'd Really Rather You Didn't
• Discussion: Conclusion

Tools and Techniques

• Exploitation: Stack Overflow Exploit, Return Oriented Programming and Format String Exploit
• Vulnerability Mitigation: Static Analysis, Warnings, Sanitizers and Fuzzers Platform Mitigation: Stack Canaries, Address Space Layout Randomization (ASLR), Non-executable memory

Computer Setup

All attendees will need to bring their own laptops. The individual work will be in https://cyber-dojo.org so only a computer with a browser is required. Some work might be done on the trainers computer.