Skip to content

Commit eff962b

Browse files
committed
Add two-stage key_generator demo for Pentests
Signed-off-by: Bu Jianlin <jianlinx.bu@intel.com>
1 parent 2874f8e commit eff962b

File tree

28 files changed

+1573
-4
lines changed

28 files changed

+1573
-4
lines changed

cczoo/penetration_testing/.gitignore

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
*.sig
2+
*.sgx
3+
*.token
4+
*.manifest
5+
*.so
6+
*.o
7+
*.rdb
8+
*.log
9+
*.tmp
10+
core.*

cczoo/penetration_testing/README.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Penetration Testing
2+
3+
## Introduction
4+
5+
This penetration testing aims to show how SGX protects the runtime confidentiality of applications while face privileged malware memory attacks.
6+
7+
Usually a complete penetration test is divided into two stages, namely unauthorized access and data theft.
8+
9+
The first stage is to gain server privileges through unauthorized access, such as implanting privileged backdoors and obtaining privileged shells.
10+
11+
In the second stage, in order to verify the memory confidentiality of SGX runtime, memory attacks will be performed on high-value data applications through privileged applications or shells to steal their runtime memory data.
12+
13+
## Two-stage overview
14+
15+
1. Unauthorized Access:
16+
- Redis
17+
18+
Please refer to [unauthorized_access/redis/README.md](unauthorized_access/redis/README.md) for detail.
19+
20+
2. Memory Attack:
21+
- Key generator
22+
23+
This application is generating keys in memory and implemented based on the Intel SGX SDK.
24+
25+
It will use the same source code to compile SGX applications and non-SGX applications, and perform memory attacks on them to verify the confidentiality of SGX runtime memory.
26+
27+
Please refer to [memory_attack/sgx/key_generator/README.md](memory_attack/sgx/key_generator/README.md) for detail.

cczoo/penetration_testing/memory_attack/sgx/key_generator/.cproject

Lines changed: 216 additions & 0 deletions
Large diffs are not rendered by default.
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<projectDescription>
3+
<name>Cxx11SGXDemo</name>
4+
<comment></comment>
5+
<projects>
6+
</projects>
7+
<buildSpec>
8+
<buildCommand>
9+
<name>org.eclipse.cdt.managedbuilder.core.genmakebuilder</name>
10+
<triggers>clean,full,incremental,</triggers>
11+
<arguments>
12+
</arguments>
13+
</buildCommand>
14+
<buildCommand>
15+
<name>org.eclipse.cdt.managedbuilder.core.ScannerConfigBuilder</name>
16+
<triggers>full,incremental,</triggers>
17+
<arguments>
18+
</arguments>
19+
</buildCommand>
20+
</buildSpec>
21+
<natures>
22+
<nature>org.eclipse.cdt.core.cnature</nature>
23+
<nature>org.eclipse.cdt.managedbuilder.core.managedBuildNature</nature>
24+
<nature>org.eclipse.cdt.managedbuilder.core.ScannerConfigNature</nature>
25+
<nature>org.eclipse.cdt.core.ccnature</nature>
26+
<nature>com.intel.sgx.sgxnature</nature>
27+
</natures>
28+
</projectDescription>
Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
/*
2+
* Copyright (C) 2011-2020 Intel Corporation. All rights reserved.
3+
*
4+
* Redistribution and use in source and binary forms, with or without
5+
* modification, are permitted provided that the following conditions
6+
* are met:
7+
*
8+
* * Redistributions of source code must retain the above copyright
9+
* notice, this list of conditions and the following disclaimer.
10+
* * Redistributions in binary form must reproduce the above copyright
11+
* notice, this list of conditions and the following disclaimer in
12+
* the documentation and/or other materials provided with the
13+
* distribution.
14+
* * Neither the name of Intel Corporation nor the names of its
15+
* contributors may be used to endorse or promote products derived
16+
* from this software without specific prior written permission.
17+
*
18+
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19+
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20+
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21+
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22+
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23+
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24+
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25+
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26+
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27+
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28+
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29+
*
30+
*/
31+
32+
33+
#include <stdio.h>
34+
#include <string.h>
35+
#include <assert.h>
36+
37+
# include <unistd.h>
38+
# include <pwd.h>
39+
# define MAX_PATH FILENAME_MAX
40+
41+
#include "sgx_urts.h"
42+
#include "App.h"
43+
#include "Enclave_u.h"
44+
45+
/* Global EID shared by multiple threads */
46+
sgx_enclave_id_t global_eid = 0;
47+
48+
typedef struct _sgx_errlist_t {
49+
sgx_status_t err;
50+
const char *msg;
51+
const char *sug; /* Suggestion */
52+
} sgx_errlist_t;
53+
54+
/* Error code returned by sgx_create_enclave */
55+
static sgx_errlist_t sgx_errlist[] = {
56+
{
57+
SGX_ERROR_UNEXPECTED,
58+
"Unexpected error occurred.",
59+
NULL
60+
},
61+
{
62+
SGX_ERROR_INVALID_PARAMETER,
63+
"Invalid parameter.",
64+
NULL
65+
},
66+
{
67+
SGX_ERROR_OUT_OF_MEMORY,
68+
"Out of memory.",
69+
NULL
70+
},
71+
{
72+
SGX_ERROR_ENCLAVE_LOST,
73+
"Power transition occurred.",
74+
"Please refer to the sample \"PowerTransition\" for details."
75+
},
76+
{
77+
SGX_ERROR_INVALID_ENCLAVE,
78+
"Invalid enclave image.",
79+
NULL
80+
},
81+
{
82+
SGX_ERROR_INVALID_ENCLAVE_ID,
83+
"Invalid enclave identification.",
84+
NULL
85+
},
86+
{
87+
SGX_ERROR_INVALID_SIGNATURE,
88+
"Invalid enclave signature.",
89+
NULL
90+
},
91+
{
92+
SGX_ERROR_OUT_OF_EPC,
93+
"Out of EPC memory.",
94+
NULL
95+
},
96+
{
97+
SGX_ERROR_NO_DEVICE,
98+
"Invalid SGX device.",
99+
"Please make sure SGX module is enabled in the BIOS, and install SGX driver afterwards."
100+
},
101+
{
102+
SGX_ERROR_MEMORY_MAP_CONFLICT,
103+
"Memory map conflicted.",
104+
NULL
105+
},
106+
{
107+
SGX_ERROR_INVALID_METADATA,
108+
"Invalid enclave metadata.",
109+
NULL
110+
},
111+
{
112+
SGX_ERROR_DEVICE_BUSY,
113+
"SGX device was busy.",
114+
NULL
115+
},
116+
{
117+
SGX_ERROR_INVALID_VERSION,
118+
"Enclave version was invalid.",
119+
NULL
120+
},
121+
{
122+
SGX_ERROR_INVALID_ATTRIBUTE,
123+
"Enclave was not authorized.",
124+
NULL
125+
},
126+
{
127+
SGX_ERROR_ENCLAVE_FILE_ACCESS,
128+
"Can't open enclave file.",
129+
NULL
130+
},
131+
{
132+
SGX_ERROR_NDEBUG_ENCLAVE,
133+
"The enclave is signed as product enclave, and can not be created as debuggable enclave.",
134+
NULL
135+
},
136+
};
137+
138+
/* Check error conditions for loading enclave */
139+
void print_error_message(sgx_status_t ret)
140+
{
141+
size_t idx = 0;
142+
size_t ttl = sizeof sgx_errlist/sizeof sgx_errlist[0];
143+
144+
for (idx = 0; idx < ttl; idx++) {
145+
if(ret == sgx_errlist[idx].err) {
146+
if(NULL != sgx_errlist[idx].sug)
147+
printf("Info: %s\n", sgx_errlist[idx].sug);
148+
printf("Error: %s\n", sgx_errlist[idx].msg);
149+
break;
150+
}
151+
}
152+
153+
if (idx == ttl)
154+
printf("Error: Unexpected error occurred.\n");
155+
}
156+
157+
/* Initialize the enclave:
158+
* Call sgx_create_enclave to initialize an enclave instance
159+
*/
160+
int initialize_enclave(void)
161+
{
162+
sgx_status_t ret = SGX_ERROR_UNEXPECTED;
163+
164+
/* Call sgx_create_enclave to initialize an enclave instance */
165+
/* Debug Support: set 2nd parameter to 1 */
166+
ret = sgx_create_enclave(ENCLAVE_FILENAME, SGX_DEBUG_FLAG, NULL, NULL, &global_eid, NULL);
167+
if (ret != SGX_SUCCESS) {
168+
print_error_message(ret);
169+
return -1;
170+
}
171+
172+
return 0;
173+
}
174+
175+
/* OCall functions */
176+
void ocall_print_string(const char *str)
177+
{
178+
/* Proxy/Bridge will check the length and null-terminate
179+
* the input string to prevent buffer overflow.
180+
*/
181+
printf("%s", str);
182+
}
183+
184+
185+
/* Application entry */
186+
int SGX_CDECL main(int argc, char *argv[])
187+
{
188+
(void)(argc);
189+
(void)(argv);
190+
191+
/* Initialize the enclave */
192+
if(initialize_enclave() < 0){
193+
printf("initialize_enclave failed ...\n");
194+
printf("press any key to exit ...\n");
195+
getchar();
196+
return -1;
197+
} else {
198+
printf("initialize_enclave successed ...\n");
199+
200+
ecall_init();
201+
202+
printf("press any key to exit ...\n");
203+
getchar();
204+
205+
ecall_free();
206+
207+
/* Destroy the enclave */
208+
sgx_destroy_enclave(global_eid);
209+
return 0;
210+
}
211+
}
212+
Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
/*
2+
* Copyright (C) 2011-2020 Intel Corporation. All rights reserved.
3+
*
4+
* Redistribution and use in source and binary forms, with or without
5+
* modification, are permitted provided that the following conditions
6+
* are met:
7+
*
8+
* * Redistributions of source code must retain the above copyright
9+
* notice, this list of conditions and the following disclaimer.
10+
* * Redistributions in binary form must reproduce the above copyright
11+
* notice, this list of conditions and the following disclaimer in
12+
* the documentation and/or other materials provided with the
13+
* distribution.
14+
* * Neither the name of Intel Corporation nor the names of its
15+
* contributors may be used to endorse or promote products derived
16+
* from this software without specific prior written permission.
17+
*
18+
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19+
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20+
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21+
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22+
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23+
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24+
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25+
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26+
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27+
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28+
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29+
*
30+
*/
31+
32+
#ifndef _APP_H_
33+
#define _APP_H_
34+
35+
#include <assert.h>
36+
#include <stdio.h>
37+
#include <stdlib.h>
38+
#include <stdarg.h>
39+
40+
#include "sgx_error.h" /* sgx_status_t */
41+
#include "sgx_eid.h" /* sgx_enclave_id_t */
42+
43+
#ifndef TRUE
44+
# define TRUE 1
45+
#endif
46+
47+
#ifndef FALSE
48+
# define FALSE 0
49+
#endif
50+
51+
#if defined(__GNUC__)
52+
# define TOKEN_FILENAME "enclave.token"
53+
# define ENCLAVE_FILENAME "enclave.signed.so"
54+
#endif
55+
56+
extern sgx_enclave_id_t global_eid; /* global enclave id */
57+
58+
#if defined(__cplusplus)
59+
extern "C" {
60+
#endif
61+
62+
void ecall_init(void);
63+
void ecall_free(void);
64+
65+
#if defined(__cplusplus)
66+
}
67+
#endif
68+
69+
#endif /* !_APP_H_ */

0 commit comments

Comments
 (0)