SlideShare ist ein Scribd-Unternehmen logo

You didnt see it’s coming? "Dawn of hardened Windows Kernel"

•Als PPTX, PDF herunterladen•
•
P
Peter Hlavaty

Past few years our team was focusing on different operating systems including Microsoft windows kernel. Honestly our first pwn at Windows kernel was not that challenging. Number of available targets with friendly environment for straightforward pwn, from user up to reliable kernel code execution. However, step by step, security policies continue to evolve, and it becomes more troublesome to choose ideal attack surface from various sandboxes. In addition, what steps to follow for digging security holes is highly dependent upon the chosen target. In general, a few common strategies are available for researchers to choose: e.g choose “unknown” one which hasn’t been researched before; Select well fuzzed or well audited one, or research on kernel module internals to find “hidden” attack surfaces which are not explicitly interconnected. In the first part of the talk we introduce our methodology of selecting, alongside with cost of tricks around to choose seemingly banned targets, illustrated by notable examples. After getting hands on potential bug available from targeted sandbox, it is time for Microsoft windows taking hardening efforts to put attacker into corner. Strong mitigations are being introduced more frequently than ever, with promising direction which cuts lots of attack surface off, and a several exploitation techniques being killed. We will show difficulties of developing universal exploitation techniques, and demonstrate needed technical level depending on code quality of target. We will examine how different it becomes with era of Redstone and following versions even with those techniques and good vulnerability in hand. How it changed attacker landscape and how it will (and will not) kill those techniques and applications. However will it really change the game or not?

Technologie
1 von 62
You didnt see it’s coming? “Dawn of hardened Windows Kernel”
$whoami Peter • @zer0mem • Windows kernel research at KeenLab, Tencent • pwn2own winner (2015 / 2016), pwnie nominee (2015) • fuzzing focus : state • wushu player
agenda Kernel attack surface Fuzzing Exploitation techniques Mitigations
windows sandbox kernel attack surface
path of less resistance - w32k* • resides in ring 0 • natural := ( level < medium ) -> SYSTEM (/kernel code exec) escape • huge attack surface • huge in comparsion to ntoskrnl counterpart or in-ring3-sandbox interface • state logic, window callbacks, hidden syscalls, directx, format parsing, ... • accessible from sandbox-es • nowdays more or less => big success! • easy develepoing of exploitation techniques
w32k vs 2016
what is going on ? • huge numbers of syscalls • lot of objects • lot of hardcore graphics stuffs • lot of things i dunno
w32k vs Qilin • Qilin - internal multi-platform fuzzing framework • Target – gdi - part of w32k • Technique : • knowledge based • random driven • interconnection aware • Results in graph • technique ++ code coverage • feedback + knowledge based (ongoing) Collisions 23% ReadVa, nullptr 24% reported 35% queue 18% bugz so far #13~16 Collisions ReadVa, nullptr reported queue http://www.slideshare.net/PeterHlavaty/rainbow-over-the-windows-more-colors-than-you-could-expect
from bug to take over SYSTEM • except huge code base with lot of space for bugs • huge code base with lof of space for missusing existing mechanisms • valuable arsenal • virtual tables and alikes • unprotected lengths • plain state members • buffer pointers • prequisites : • call syscalls
W32k kernel io : _gre_bitmap • Simple & *reliable* pool layout • Direct syscalls for content manipulation • Pivot -> worker technique
w32k out of scope of interest ? • somehow : • going to be locked down & filtered out • not so cool anymore, many research done, many bugs out, ... • so complex so it even gets boring after time of researching there • if you trying to find something -> you will : if no, then try harder... • however in nowadays still applies (and some time will) • weakest points of windows kernel • accessible from most sandboxes • best attack vector nowadays • attackers are lazy, why do something hard if no need ? *PERFECT GROUND FOR YOUR FUZZER*
ntos : lets move from win32k mutex memory thread (a)lpc section pipe ...
ntos - attack surface • difference : • seemingly no data parsing +- • state only • from untrusted level / app container not much to touch • small number of state changing syscalls • state changes are minimalistic in most cases*
ntos under the microscope - extensions • Nt*Transaction* • Nt*Enlistment* • Nt*Manager*
tm.sys • ntos extension • Kernel Transaction Manager • however not much attack surface as well • simple states & minimum syscalls • however interconnections • Qilin vs tm, round1 : • 1 nullptr • 1 exploitable double ObDeref -> type confusion -> uaf
explore unknown : indirections++ • tm.sys simple purpose driver • but interesting module involved at backend • CLFS.sys
CLFS.sys : unseen hand behind the scenes • Common Log File System • not everything need to be direct • easy to get interest if you look at simplistic tm.sys • clfs used at many different places in ntos itself as well • clfs on other hand more complex • c++ code base • complex state • involve data parsing • Qilin vs clfs : 3~5 state bugs, 6~8 data parsing • Advanced *data* fuzzer : covers all first hand bugs, and extend 4+ • by @long123king
bug hunting research, fuzzing, feedback, analysis, loop back
kick off • select target • collect related syscalls ( apis ) • research attack surface • go trough related msdn part (if any) • understand abstracted functionality • what it is purpose • what is usual way of working with it • double check interesting points with kernel implementation
fuzzer • make some code to automate working with target • optionally use existing framework, just add functionality per target • make it work • most basic syscalls working (open, close, get) • make use of previous reseach • implement basic schema from previous step • ensure that your fuzzer can sucessfully work on target based on documentation of target • introduce randomnes with preserving certain sucess ratio • introduce connections (syscall & handle dependencies)
feedback • how good is your fuzzing ? • sucess ratio % ? • code coverage ?
meassure your fuzzing
research • fuzzing is one part • you want more bugz ? you need know your target well • not only target, but your fuzzer as well • analyze less covered parts • think of possible buggy scenarios • implement back to fuzzer • loop back (from documentation, trough fuzzing up to understanding) fuzzing analyze update
additional thoughts • fuzzing is not enough • you need to understand what you are fuzzing • better understanding helps to build more tricky logic • hower once you concrete too much, then you puting yourself into corner • better to be backuped with code coverage corpus • corpus is essential to keep & update, but not recycle (scatter&replace) often • fuzzer is not all you need • runtime tools [ adress sanitizers, race tools, debugger plugins, .. ] • static tools [ helping your fuzzer, helping your analysis ]
lets move to exploitation techniques!
options • w32k easy to go, however not so easy from locked down / filtered state anymore • can go trough chaining, but we can do better • ntos, harder to go • not much available syscalls - harder to setup & control technique properly • not much used before - why to go harder way if no need ? • less objects, with less nasty states
nt!KeWaitForSingleObject • small object • relativelly simple • interesting logic behind usage • lock / unlock • wait • kernel pointers • ethreads • offers various primitives : • arbitrary decrease • arbitrary write where - kernel pointer* • ...
SafeLink write where primitive • Introduced to deal meta data link corruptions • previously lead to : write where - what • now it leads to int 0x29 ... not necessary, or ? A B C
Arbitrary write – kernel pointer • target needs to point to semaphore / event • Problem ? .. Well not much : • You can predict kernel mode memory members • You can misalign Flink –> Blink == Blink -> Blink http://www.slideshare.net/PeterHlavaty/how-safe
ALPC • not everything touchable in ntos is really minimalistic • more complex mechanism • more complex state • good interconnections • .. however well written code .. • lot of safe checks • safe user mode memory handling (via 'getters') • seems well designed http://alex-ionescu.com/Publications/SyScan/syscan2014.pdf
ALPC #spray kd> dt nt!_kalpc_message … +0x010 PortQueue +0x018 OwnerPort … +0x068 MessageAttributes +0x0b0 DataUserVa : Ptr64 Void … +0x0d8 ExtensionBuffer : Ptr64 Void +0x0e0 ExtensionBufferSize : Uint8B +0x0e8 PortMessage : _PORT_MESSAGE kd> dt nt!_kalpc_message PortMessage->u1->* +0x0e8 PortMessage : +0x000 u1 : +0x000 s1 : <unnamed-tag> +0x000 Length : Uint4B +0x004 u2
ALPC #detect kd> dt nt!_kalpc_message … +0x010 PortQueue +0x018 OwnerPort … +0x068 MessageAttributes +0x0b0 DataUserVa : Ptr64 Void … +0x0d8 ExtensionBuffer : Ptr64 Void +0x0e0 ExtensionBufferSize : Uint8B +0x0e8 PortMessage : _PORT_MESSAGE kd> dt nt!_kalpc_message PortMessage->u1->* +0x0e8 PortMessage : +0x000 u1 : +0x000 s1 : <unnamed-tag> +0x000 Length : Uint4B +0x004 u2
ALPC #overflow kd> dt nt!_kalpc_message … +0x010 PortQueue +0x018 OwnerPort … +0x068 MessageAttributes +0x0b0 DataUserVa : Ptr64 Void … +0x0d8 ExtensionBuffer : Ptr64 Void +0x0e0 ExtensionBufferSize : Uint8B +0x0e8 PortMessage : _PORT_MESSAGE kd> dt nt!_kalpc_message PortMessage->u1->* +0x0e8 PortMessage : +0x000 u1 : +0x000 s1 : <unnamed-tag> +0x000 Length : Uint4B +0x004 u2
ALPC #io • #4 threads ( gdi tech, only #1 thread ) • io • pivot • worker • server • Performing additional write per io ! • synchronization • Undocumented ALPC • Setup server – client • Keeping messages alive • pool feng shui is problematic
Hardenings !? SMEP, KASLR, Nx, CFG, RFG, ACL, SafeLink ...
from user to kernel, from kernel to jail : w32k • Filtering • ? win32k – win32kfull – win32kbase ? • win32k -> wrapper to add stub* with access checks • restrict access only to necessary parts • maybe not 'clean' solution, but security++ (relatively) • app can have different sandboxed entities, and per entity different attack surfaces • find way from one to another, and you can find way out of filter • in optimal scenario limit potential bug landscape • first part of good effect • in optimal scenario limit exploitation techniques • this is the second good effect • lockdown • wow, this sure solve something in crazy *absolute* way O_o
w32k is here for you if you need it! • One can have arbitrary decrease ? [ see previous semaphore slides ] • Or any suitable primitive, just necessary be creative • Would he choose alpc technique ? • If he is lazy (smart) enough, then no … • Re-enable w32k instead! • even allow more proc in your job in case of need • do one-bit kernel pwn via win32k!_gre_bitmap and enjoy life!
kernel code exec vs mittigations • KASLR, code signing, Nx, CFG, SMEP • set some good security boundaries • however getting code exec no problem after all • kaslr - good bug or additional info leak • code signing : we will ship our code to kernel via kernel io, and exec it • Nx + SMEP : find rwe page, or create it • CFG : find good trampoline or target stack
easy to be said, harder to be done ? • not actually • kernel-io techniques already described • still headache with kernel Nx / SMEP ? • NtUserMessageCall [ following slide ] • CFG • prevents only from ROP to be kicked of • i dont like ROP neither, target stack [ + functions ] • CFG alone is not enough (in terms of code exec) !
NtUserMessageCall • Function of many faces • 7 parameters • Full control over them • Indirect call invoked • 7+ member of vtable <- dummy! • vcall return is passed to user! • Enough primitives for kernel code exec, with valid function (no ROP) !
Get kernel code exec • Misuse existing functions • NtUserMessageCall • Allocate RWE memory • memcpy you kernel driver • Stack hook • Game over
SMAP - tale of lacking feature • prevents kernel unwanted access to user mode memory • sets bare metal borders between data in user mode and kernel • should serve as fine security feature … does it ?
SMAP - tale of lacking feature
SMAP - tale of lacking feature ... however ... • without proper security schema in underlying OS, it is just shinny ... • nullptr deref protection - anything bellow 0x10000 • poisons should be *not-mappable* by user by default! • you need controlled data at exploitation ? why you need them in user mode ? • easy to put in kernel (pipes, direct mem mapping, physmap, kernel stack, ...) • in occasional cases one more bug to leak address layout • in most cases you can get them out from mem corruption bug (unprotected raw pointers, ...) • security features is good to have, but better to use to max potential • which OS nowadays is using SMAP in way that it is really obstacle for attackers ?
Control Flow – hardware! • CET-IBT • Indirect jumps / calls + endbrXX • Similar idea with CFG indeed • Your jumps can not go wild, like ROP do! • CET-Shadow Stack • nicely done! • You can not subvert control flow via stack hooking anymore! • so seriously, what now ? • … wait for some time to adapt to mainstream O_o https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf
Return Flow Guard • Rumors about RFG • Return Flow Guard • Preliminary documentation (nice!) : http://xlab.tencent.com/en/2016/11/02/return-flow-guard/ • Simple & fast & effective • Effective ? • Shadow Stack alike, therefore yes! • .. and we are back with FS on x64! fs:[rsp] • arbitrary read / write will not touch it! • in combination with CFG ? – hell, a lot! • Two simple & effective mitigations together are pretty solid! • Can be implemented with todays hardware! https://people.eecs.berkeley.edu/~dawnsong/papers/osdi14-paper-kuznetsov.pdf
{C/R}FG vs CET vs CFI • CET-IBT • some criticize that it lacks type integrity hash checks • It sets bare metal rules – how calls / ret must behave • CET is *not* about control flow *integrity* in particular • Implies : ROP is over but you can jump to *any* function instead! • CFG + RFG • very close to CET • Added some integrity checks on top of it • black-list (not include into bitmap) “dangerous” functions • Implies : ROP is over but you can jump to large *subset* of functions instead! • depends on corner cases however • As you can see CFG improvements over time, cat – mouse game ?
ROP – wild technique
Function oriented - restricted technique http://dl.acm.org/citation.cfm?id=2848479
CET-{IBT+ShadowStack} / {C/R}FG • Gadgets == functions (Loop dispatcher / KernelIo) • Proper CFI needed (clang / pax) • Kernel Code Exec, doable ? • Well, if you want install old school rootkit, doable • RWE on kernel component in your reach • Patch legitimate kernel • Jump • Patch back • Obviously bad code! • any reasonable benefits from kernel code exec ? • Kernel Code Exec, needed ? • do you even need your own _eproc ? • why don’t just use kernel io (legit non-harm) syscalls • force(trick) other _ethreads to do job for you • Patching their stacks (params / rets) should do the job http://www.slideshare.net/PeterHlavaty/back-to-the-core ( VadRoot technique ) http://www.pcc.me.uk/~peter/acad/usenix14.pdf https://pax.grsecurity.net/docs/PaXTeam-H2HC15-RAP-RIP-ROP.pdf
Data attacks! - TODO What is your goal ?
DOP – Turing Complete https://www.comp.nus.edu.sg/~shweta24/publications/dop_oakland16.pdf f
Kernel Io • In the end data are all what matters! • Code is just group of instructions working over those data • Your ultimate goal is to access data • No need to be SYSTEM • No need to do Kernel Exec • Kernel io can ‘emulate’ apis • You can do math operations • ...
Data attack prevention • Same piece of code should work on same memory type • w32k gdi function will not touch _eprocess • possible to simple set ranges (hardware) ? • Pool isolation • Isolated heap (object caches) ? • local vars (thread) by default allowed • Existing solutions ? • Intel mpx – seems not going to succeed ? • PAC – looks like game changer (CPI approach) ? • Isolation ?  https://software.intel.com/en-us/blogs/2013/07/22/intel- memory-protection-extensions-intel-mpx-support-in-the-gnu- toolchain https://community.arm.com/groups/processors /blog/2016/10/27/armv8-a-architecture-2016- additions https://taesoo.gtisc.gatech.edu/pubs/2016/song:kenali.pdf
Kernel Io vs cross heap checks
Kernel Io vs cross heap checks
Application Guard! • well, this can change things lot! • still kernel-Io is here real power ? • … well … • doomed within domain • One does not simple do exec when ring -1 is watching! • no real RWE page [ ept ] • code signing [ rw -> e ]
Containers • But, as always .. it is just another layer, another ring ... • bugs • logical issues • with small big difference • less code • code quality ++ http://www.alex-ionescu.com/syscan2015.pdf
conclusions • KASLR, nullptr-deref, Nx, SMEP • very well adapted! • ACL for kernel object access • good security model! • w32k re-designing { filtering & lockdown } • tackling biggest security problem in windows kernel! • {C/R}FG • nice anti-exploitation approaches! { - step by step to adapt to kernel } • CET - IBT & Shadow Stack • nice co-operation towards to new security model! • HyperV based App Containers • moving operating system to another league in terms of security
conclusions - todo#memory-corruptions • Control flow integrity – to improve • fine grained CFG – fast, smart, compat! but can it be fine enough ? • adapt { forwarded-edge ( clang ) / type-hash ( pax ) } – existing, fast, does the job! • Make code reuse attacks to disappear ? • Data attacks break down – to tackle • Memory access boundary checks • pointer load / function to heap memory access • Make kernel io disappear ? • Will it move memory corruptions from attack vector to state of art ? • memory corruption == ddos only ? • Not yet, long way to go, but now we can see that possibility • However maybe that can even happen in foreseeable future ?
Thank you! Q & A
You didnt see it’s coming? "Dawn of hardened Windows Kernel"

Empfohlen

DeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows KernelDeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows KernelPeter Hlavaty
 
Modern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesModern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesMichael Scovetta
 
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesWindows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesPeter Hlavaty
 
[CB16] DeathNote of Microsoft Windows Kernel by Peter Hlavaty & Jin Long
[CB16] DeathNote of Microsoft Windows Kernel by Peter Hlavaty & Jin Long[CB16] DeathNote of Microsoft Windows Kernel by Peter Hlavaty & Jin Long
[CB16] DeathNote of Microsoft Windows Kernel by Peter Hlavaty & Jin LongCODE BLUE
 
CSW2017 Peng qiu+shefang-zhong win32k -dark_composition_finnal_finnal_rm_mark
CSW2017 Peng qiu+shefang-zhong win32k -dark_composition_finnal_finnal_rm_markCSW2017 Peng qiu+shefang-zhong win32k -dark_composition_finnal_finnal_rm_mark
CSW2017 Peng qiu+shefang-zhong win32k -dark_composition_finnal_finnal_rm_markCanSecWest
 
Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Angel Boy
 
Pwning in c++ (basic)
Pwning in c++ (basic)Pwning in c++ (basic)
Pwning in c++ (basic)Angel Boy
 
Advanced heap exploitaion
Advanced heap exploitaionAdvanced heap exploitaion
Advanced heap exploitaionAngel Boy
 

Empfohlen

DeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows KernelDeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows KernelPeter Hlavaty
 
Modern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesModern Kernel Pool Exploitation: Attacks and Techniques
Modern Kernel Pool Exploitation: Attacks and TechniquesMichael Scovetta
 
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesWindows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesPeter Hlavaty
 
[CB16] DeathNote of Microsoft Windows Kernel by Peter Hlavaty & Jin Long
[CB16] DeathNote of Microsoft Windows Kernel by Peter Hlavaty & Jin Long[CB16] DeathNote of Microsoft Windows Kernel by Peter Hlavaty & Jin Long
[CB16] DeathNote of Microsoft Windows Kernel by Peter Hlavaty & Jin LongCODE BLUE
 
CSW2017 Peng qiu+shefang-zhong win32k -dark_composition_finnal_finnal_rm_mark
CSW2017 Peng qiu+shefang-zhong win32k -dark_composition_finnal_finnal_rm_markCSW2017 Peng qiu+shefang-zhong win32k -dark_composition_finnal_finnal_rm_mark
CSW2017 Peng qiu+shefang-zhong win32k -dark_composition_finnal_finnal_rm_markCanSecWest
 
Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Angel Boy
 
Pwning in c++ (basic)
Pwning in c++ (basic)Pwning in c++ (basic)
Pwning in c++ (basic)Angel Boy
 
Advanced heap exploitaion
Advanced heap exploitaionAdvanced heap exploitaion
Advanced heap exploitaionAngel Boy
 
Sigreturn Oriented Programming
Sigreturn Oriented ProgrammingSigreturn Oriented Programming
Sigreturn Oriented ProgrammingAngel Boy
 
Linux BPF Superpowers
Linux BPF SuperpowersLinux BPF Superpowers
Linux BPF SuperpowersBrendan Gregg
 
USENIX ATC 2017: Visualizing Performance with Flame Graphs
USENIX ATC 2017: Visualizing Performance with Flame GraphsUSENIX ATC 2017: Visualizing Performance with Flame Graphs
USENIX ATC 2017: Visualizing Performance with Flame GraphsBrendan Gregg
 
Execution
ExecutionExecution
ExecutionAngel Boy
 
Make static instrumentation great again, High performance fuzzing for Windows...
Make static instrumentation great again, High performance fuzzing for Windows...Make static instrumentation great again, High performance fuzzing for Windows...
Make static instrumentation great again, High performance fuzzing for Windows...Lucas Leong
 
TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程Weber Tsai
 
Linux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowLinux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowAngel Boy
 
Binary exploitation - AIS3
Binary exploitation - AIS3Binary exploitation - AIS3
Binary exploitation - AIS3Angel Boy
 
Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Angel Boy
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniquePlay with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniqueAngel Boy
 
Reliable Windows Heap Exploits
Reliable Windows Heap ExploitsReliable Windows Heap Exploits
Reliable Windows Heap Exploitsamiable_indian
 
WSL Reloaded
WSL ReloadedWSL Reloaded
WSL ReloadedAnthony LAOU-HINE TSUEI
 
twlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsotwlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsoViller Hsiao
 
Heap exploitation
Heap exploitationHeap exploitation
Heap exploitationAngel Boy
 
Linux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingLinux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingAngel Boy
 
Linux Profiling at Netflix
Linux Profiling at NetflixLinux Profiling at Netflix
Linux Profiling at NetflixBrendan Gregg
 
BPF - in-kernel virtual machine
BPF - in-kernel virtual machineBPF - in-kernel virtual machine
BPF - in-kernel virtual machineAlexei Starovoitov
 
Linux Performance Analysis: New Tools and Old Secrets
Linux Performance Analysis: New Tools and Old SecretsLinux Performance Analysis: New Tools and Old Secrets
Linux Performance Analysis: New Tools and Old SecretsBrendan Gregg
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27Sheng-Hao Ma
 
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...Maksim Shudrak
 
When is something overflowing
When is something overflowingWhen is something overflowing
When is something overflowingPeter Hlavaty
 
Rainbow Over the Windows: More Colors Than You Could Expect
Rainbow Over the Windows: More Colors Than You Could ExpectRainbow Over the Windows: More Colors Than You Could Expect
Rainbow Over the Windows: More Colors Than You Could ExpectPeter Hlavaty
 

Weitere ähnliche Inhalte

Was ist angesagt?

Sigreturn Oriented Programming
Sigreturn Oriented ProgrammingSigreturn Oriented Programming
Sigreturn Oriented ProgrammingAngel Boy
 
Linux BPF Superpowers
Linux BPF SuperpowersLinux BPF Superpowers
Linux BPF SuperpowersBrendan Gregg
 
USENIX ATC 2017: Visualizing Performance with Flame Graphs
USENIX ATC 2017: Visualizing Performance with Flame GraphsUSENIX ATC 2017: Visualizing Performance with Flame Graphs
USENIX ATC 2017: Visualizing Performance with Flame GraphsBrendan Gregg
 
Make static instrumentation great again, High performance fuzzing for Windows...
Make static instrumentation great again, High performance fuzzing for Windows...Make static instrumentation great again, High performance fuzzing for Windows...
Make static instrumentation great again, High performance fuzzing for Windows...Lucas Leong
 
TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程Weber Tsai
 
Linux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowLinux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowAngel Boy
 
Binary exploitation - AIS3
Binary exploitation - AIS3Binary exploitation - AIS3
Binary exploitation - AIS3Angel Boy
 
Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Angel Boy
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniquePlay with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniqueAngel Boy
 
Reliable Windows Heap Exploits
Reliable Windows Heap ExploitsReliable Windows Heap Exploits
Reliable Windows Heap Exploitsamiable_indian
 
twlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsotwlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsoViller Hsiao
 
Heap exploitation
Heap exploitationHeap exploitation
Heap exploitationAngel Boy
 
Linux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingLinux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingAngel Boy
 
Linux Profiling at Netflix
Linux Profiling at NetflixLinux Profiling at Netflix
Linux Profiling at NetflixBrendan Gregg
 
BPF - in-kernel virtual machine
BPF - in-kernel virtual machineBPF - in-kernel virtual machine
BPF - in-kernel virtual machineAlexei Starovoitov
 
Linux Performance Analysis: New Tools and Old Secrets
Linux Performance Analysis: New Tools and Old SecretsLinux Performance Analysis: New Tools and Old Secrets
Linux Performance Analysis: New Tools and Old SecretsBrendan Gregg
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27Sheng-Hao Ma
 
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...Maksim Shudrak
 

Was ist angesagt? (20)

Sigreturn Oriented Programming
Sigreturn Oriented ProgrammingSigreturn Oriented Programming
Sigreturn Oriented Programming
 
Linux BPF Superpowers
Linux BPF SuperpowersLinux BPF Superpowers
Linux BPF Superpowers
 
USENIX ATC 2017: Visualizing Performance with Flame Graphs
USENIX ATC 2017: Visualizing Performance with Flame GraphsUSENIX ATC 2017: Visualizing Performance with Flame Graphs
USENIX ATC 2017: Visualizing Performance with Flame Graphs
 
Execution
ExecutionExecution
Execution
 
Make static instrumentation great again, High performance fuzzing for Windows...
Make static instrumentation great again, High performance fuzzing for Windows...Make static instrumentation great again, High performance fuzzing for Windows...
Make static instrumentation great again, High performance fuzzing for Windows...
 
TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程
 
Linux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowLinux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflow
 
Binary exploitation - AIS3
Binary exploitation - AIS3Binary exploitation - AIS3
Binary exploitation - AIS3
 
Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniquePlay with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit Technique
 
Reliable Windows Heap Exploits
Reliable Windows Heap ExploitsReliable Windows Heap Exploits
Reliable Windows Heap Exploits
 
WSL Reloaded
WSL ReloadedWSL Reloaded
WSL Reloaded
 
twlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdsotwlkh-linux-vsyscall-and-vdso
twlkh-linux-vsyscall-and-vdso
 
Heap exploitation
Heap exploitationHeap exploitation
Heap exploitation
 
Linux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend ProgramingLinux Binary Exploitation - Return-oritend Programing
Linux Binary Exploitation - Return-oritend Programing
 
Linux Profiling at Netflix
Linux Profiling at NetflixLinux Profiling at Netflix
Linux Profiling at Netflix
 
BPF - in-kernel virtual machine
BPF - in-kernel virtual machineBPF - in-kernel virtual machine
BPF - in-kernel virtual machine
 
Linux Performance Analysis: New Tools and Old Secrets
Linux Performance Analysis: New Tools and Old SecretsLinux Performance Analysis: New Tools and Old Secrets
Linux Performance Analysis: New Tools and Old Secrets
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27
 
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
 

Andere mochten auch

When is something overflowing
When is something overflowingWhen is something overflowing
When is something overflowingPeter Hlavaty
 
Rainbow Over the Windows: More Colors Than You Could Expect
Rainbow Over the Windows: More Colors Than You Could ExpectRainbow Over the Windows: More Colors Than You Could Expect
Rainbow Over the Windows: More Colors Than You Could ExpectPeter Hlavaty
 
Ice Age melting down: Intel features considered usefull!
Ice Age melting down: Intel features considered usefull!Ice Age melting down: Intel features considered usefull!
Ice Age melting down: Intel features considered usefull!Peter Hlavaty
 
Moony li pacsec-1.8
Moony li pacsec-1.8Moony li pacsec-1.8
Moony li pacsec-1.8PacSecJP
 
Memory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMMMemory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMMPositive Hack Days
 
Hacking - high school intro
Hacking - high school introHacking - high school intro
Hacking - high school introPeter Hlavaty
 
DbiFuzz framework #ZeroNights E.0x03 slides
DbiFuzz framework #ZeroNights E.0x03 slidesDbiFuzz framework #ZeroNights E.0x03 slides
DbiFuzz framework #ZeroNights E.0x03 slidesPeter Hlavaty
 
Power of linked list
Power of linked listPower of linked list
Power of linked listPeter Hlavaty
 
D1T3-Anto-Joseph-Droid-FF
D1T3-Anto-Joseph-Droid-FFD1T3-Anto-Joseph-Droid-FF
D1T3-Anto-Joseph-Droid-FFAnthony Jose
 
The Python bites your apple
The Python bites your appleThe Python bites your apple
The Python bites your appleQidan He
 
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...Alexandre Moneger
 
Find your own iOS kernel bug
Find your own iOS kernel bugFind your own iOS kernel bug
Find your own iOS kernel bugGustavo Martinez
 
Attacking the Webkit heap [Or how to write Safari exploits]
Attacking the Webkit heap [Or how to write Safari exploits]Attacking the Webkit heap [Or how to write Safari exploits]
Attacking the Webkit heap [Or how to write Safari exploits]Seguridad Apple
 
.Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 .Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 Amanda Rousseau
 
Henrique Dantas - API fuzzing using Swagger
Henrique Dantas - API fuzzing using SwaggerHenrique Dantas - API fuzzing using Swagger
Henrique Dantas - API fuzzing using SwaggerDevSecCon
 
[CB16] About the cyber grand challenge: the world’s first all-machine hacking...
[CB16] About the cyber grand challenge: the world’s first all-machine hacking...[CB16] About the cyber grand challenge: the world’s first all-machine hacking...
[CB16] About the cyber grand challenge: the world’s first all-machine hacking...CODE BLUE
 
50 Shades of Fuzzing by Peter Hlavaty & Marco Grassi
50 Shades of Fuzzing by Peter Hlavaty & Marco Grassi50 Shades of Fuzzing by Peter Hlavaty & Marco Grassi
50 Shades of Fuzzing by Peter Hlavaty & Marco GrassiShakacon
 

Andere mochten auch (20)

When is something overflowing
When is something overflowingWhen is something overflowing
When is something overflowing
 
Rainbow Over the Windows: More Colors Than You Could Expect
Rainbow Over the Windows: More Colors Than You Could ExpectRainbow Over the Windows: More Colors Than You Could Expect
Rainbow Over the Windows: More Colors Than You Could Expect
 
Ice Age melting down: Intel features considered usefull!
Ice Age melting down: Intel features considered usefull!Ice Age melting down: Intel features considered usefull!
Ice Age melting down: Intel features considered usefull!
 
Moony li pacsec-1.8
Moony li pacsec-1.8Moony li pacsec-1.8
Moony li pacsec-1.8
 
Memory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMMMemory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMM
 
Hacking - high school intro
Hacking - high school introHacking - high school intro
Hacking - high school intro
 
DbiFuzz framework #ZeroNights E.0x03 slides
DbiFuzz framework #ZeroNights E.0x03 slidesDbiFuzz framework #ZeroNights E.0x03 slides
DbiFuzz framework #ZeroNights E.0x03 slides
 
Racing with Droids
Racing with DroidsRacing with Droids
Racing with Droids
 
Power of linked list
Power of linked listPower of linked list
Power of linked list
 
How2heap
How2heap How2heap
How2heap
 
D1T3-Anto-Joseph-Droid-FF
D1T3-Anto-Joseph-Droid-FFD1T3-Anto-Joseph-Droid-FF
D1T3-Anto-Joseph-Droid-FF
 
The Python bites your apple
The Python bites your appleThe Python bites your apple
The Python bites your apple
 
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
 
Find your own iOS kernel bug
Find your own iOS kernel bugFind your own iOS kernel bug
Find your own iOS kernel bug
 
Attacking the Webkit heap [Or how to write Safari exploits]
Attacking the Webkit heap [Or how to write Safari exploits]Attacking the Webkit heap [Or how to write Safari exploits]
Attacking the Webkit heap [Or how to write Safari exploits]
 
.Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 .Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017
 
What the fuzz
What the fuzzWhat the fuzz
What the fuzz
 
Henrique Dantas - API fuzzing using Swagger
Henrique Dantas - API fuzzing using SwaggerHenrique Dantas - API fuzzing using Swagger
Henrique Dantas - API fuzzing using Swagger
 
[CB16] About the cyber grand challenge: the world’s first all-machine hacking...
[CB16] About the cyber grand challenge: the world’s first all-machine hacking...[CB16] About the cyber grand challenge: the world’s first all-machine hacking...
[CB16] About the cyber grand challenge: the world’s first all-machine hacking...
 
50 Shades of Fuzzing by Peter Hlavaty & Marco Grassi
50 Shades of Fuzzing by Peter Hlavaty & Marco Grassi50 Shades of Fuzzing by Peter Hlavaty & Marco Grassi
50 Shades of Fuzzing by Peter Hlavaty & Marco Grassi
 

Ähnlich wie You didnt see it’s coming? "Dawn of hardened Windows Kernel"

Security research over Windows #defcon china
Security research over Windows #defcon chinaSecurity research over Windows #defcon china
Security research over Windows #defcon chinaPeter Hlavaty
 
Practical Windows Kernel Exploitation
Practical Windows Kernel ExploitationPractical Windows Kernel Exploitation
Practical Windows Kernel ExploitationzeroSteiner
 
Multithreading and Parallelism on iOS [MobOS 2013]
Multithreading and Parallelism on iOS [MobOS 2013] Multithreading and Parallelism on iOS [MobOS 2013]
Multithreading and Parallelism on iOS [MobOS 2013]Kuba Břečka
 
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class Chris Gates
 
Metasploit & Windows Kernel Exploitation
Metasploit & Windows Kernel ExploitationMetasploit & Windows Kernel Exploitation
Metasploit & Windows Kernel ExploitationzeroSteiner
 
SMP implementation for OpenBSD/sgi
SMP implementation for OpenBSD/sgiSMP implementation for OpenBSD/sgi
SMP implementation for OpenBSD/sgiTakuya ASADA
 
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013midnite_runr
 
Vulnerability, exploit to metasploit
Vulnerability, exploit to metasploitVulnerability, exploit to metasploit
Vulnerability, exploit to metasploitTiago Henriques
 
BSides_Charm2015_Info sec hunters_gathers
BSides_Charm2015_Info sec hunters_gathersBSides_Charm2015_Info sec hunters_gathers
BSides_Charm2015_Info sec hunters_gathersAndrew McNicol
 
Reverse Engineering the TomTom Runner pt. 1
Reverse Engineering the TomTom Runner pt. 1 Reverse Engineering the TomTom Runner pt. 1
Reverse Engineering the TomTom Runner pt. 1 Luis Grangeia
 
Advanced SOHO Router Exploitation XCON
Advanced SOHO Router Exploitation XCONAdvanced SOHO Router Exploitation XCON
Advanced SOHO Router Exploitation XCONLyon Yang
 
Network Penetration Testing Toolkit - Nmap, Netcat, and Metasploit Basics
Network Penetration Testing Toolkit - Nmap, Netcat, and Metasploit BasicsNetwork Penetration Testing Toolkit - Nmap, Netcat, and Metasploit Basics
Network Penetration Testing Toolkit - Nmap, Netcat, and Metasploit BasicsBishop Fox
 
NBTC#2 - Why instrumentation is cooler then ice
NBTC#2 - Why instrumentation is cooler then iceNBTC#2 - Why instrumentation is cooler then ice
NBTC#2 - Why instrumentation is cooler then iceAlexandre Moneger
 
The basics of hacking and penetration testing 이제 시작이야 해킹과 침투 테스트 kenneth.s.kwon
The basics of hacking and penetration testing 이제 시작이야 해킹과 침투 테스트 kenneth.s.kwonThe basics of hacking and penetration testing 이제 시작이야 해킹과 침투 테스트 kenneth.s.kwon
The basics of hacking and penetration testing 이제 시작이야 해킹과 침투 테스트 kenneth.s.kwonKenneth Kwon
 
Игорь Фесенко "Direction of C# as a High-Performance Language"
Игорь Фесенко "Direction of C# as a High-Performance Language"Игорь Фесенко "Direction of C# as a High-Performance Language"
Игорь Фесенко "Direction of C# as a High-Performance Language"Fwdays
 
Steelcon 2014 - Process Injection with Python
Steelcon 2014 - Process Injection with PythonSteelcon 2014 - Process Injection with Python
Steelcon 2014 - Process Injection with Pythoninfodox
 

Ähnlich wie You didnt see it’s coming? "Dawn of hardened Windows Kernel" (20)

Security research over Windows #defcon china
Security research over Windows #defcon chinaSecurity research over Windows #defcon china
Security research over Windows #defcon china
 
Practical Windows Kernel Exploitation
Practical Windows Kernel ExploitationPractical Windows Kernel Exploitation
Practical Windows Kernel Exploitation
 
Multithreading and Parallelism on iOS [MobOS 2013]
Multithreading and Parallelism on iOS [MobOS 2013] Multithreading and Parallelism on iOS [MobOS 2013]
Multithreading and Parallelism on iOS [MobOS 2013]
 
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
 
Metasploit & Windows Kernel Exploitation
Metasploit & Windows Kernel ExploitationMetasploit & Windows Kernel Exploitation
Metasploit & Windows Kernel Exploitation
 
SMP implementation for OpenBSD/sgi
SMP implementation for OpenBSD/sgiSMP implementation for OpenBSD/sgi
SMP implementation for OpenBSD/sgi
 
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
 
Deep hooks
Deep hooksDeep hooks
Deep hooks
 
Vulnerability, exploit to metasploit
Vulnerability, exploit to metasploitVulnerability, exploit to metasploit
Vulnerability, exploit to metasploit
 
BSides_Charm2015_Info sec hunters_gathers
BSides_Charm2015_Info sec hunters_gathersBSides_Charm2015_Info sec hunters_gathers
BSides_Charm2015_Info sec hunters_gathers
 
Reverse Engineering the TomTom Runner pt. 1
Reverse Engineering the TomTom Runner pt. 1 Reverse Engineering the TomTom Runner pt. 1
Reverse Engineering the TomTom Runner pt. 1
 
Advanced SOHO Router Exploitation XCON
Advanced SOHO Router Exploitation XCONAdvanced SOHO Router Exploitation XCON
Advanced SOHO Router Exploitation XCON
 
Network Penetration Testing Toolkit - Nmap, Netcat, and Metasploit Basics
Network Penetration Testing Toolkit - Nmap, Netcat, and Metasploit BasicsNetwork Penetration Testing Toolkit - Nmap, Netcat, and Metasploit Basics
Network Penetration Testing Toolkit - Nmap, Netcat, and Metasploit Basics
 
Surge2012
Surge2012Surge2012
Surge2012
 
NBTC#2 - Why instrumentation is cooler then ice
NBTC#2 - Why instrumentation is cooler then iceNBTC#2 - Why instrumentation is cooler then ice
NBTC#2 - Why instrumentation is cooler then ice
 
The basics of hacking and penetration testing 이제 시작이야 해킹과 침투 테스트 kenneth.s.kwon
The basics of hacking and penetration testing 이제 시작이야 해킹과 침투 테스트 kenneth.s.kwonThe basics of hacking and penetration testing 이제 시작이야 해킹과 침투 테스트 kenneth.s.kwon
The basics of hacking and penetration testing 이제 시작이야 해킹과 침투 테스트 kenneth.s.kwon
 
Игорь Фесенко "Direction of C# as a High-Performance Language"
Игорь Фесенко "Direction of C# as a High-Performance Language"Игорь Фесенко "Direction of C# as a High-Performance Language"
Игорь Фесенко "Direction of C# as a High-Performance Language"
 
Steelcon 2014 - Process Injection with Python
Steelcon 2014 - Process Injection with PythonSteelcon 2014 - Process Injection with Python
Steelcon 2014 - Process Injection with Python
 
Security Onion
Security OnionSecurity Onion
Security Onion
 
Jvm memory model
Jvm memory modelJvm memory model
Jvm memory model
 

Mehr von Peter Hlavaty

Software Security : From school to reality and back!
Software Security : From school to reality and back!Software Security : From school to reality and back!
Software Security : From school to reality and back!Peter Hlavaty
 
Guardians of your CODE
Guardians of your CODEGuardians of your CODE
Guardians of your CODEPeter Hlavaty
 
Vulnerability desing patterns
Vulnerability desing patternsVulnerability desing patterns
Vulnerability desing patternsPeter Hlavaty
 
How Safe is your Link ?
How Safe is your Link ?How Safe is your Link ?
How Safe is your Link ?Peter Hlavaty
 

Mehr von Peter Hlavaty (6)

Software Security : From school to reality and back!
Software Security : From school to reality and back!Software Security : From school to reality and back!
Software Security : From school to reality and back!
 
Guardians of your CODE
Guardians of your CODEGuardians of your CODE
Guardians of your CODE
 
Back to the CORE
Back to the COREBack to the CORE
Back to the CORE
 
Vulnerability desing patterns
Vulnerability desing patternsVulnerability desing patterns
Vulnerability desing patterns
 
Attack on the Core
Attack on the CoreAttack on the Core
Attack on the Core
 
How Safe is your Link ?
How Safe is your Link ?How Safe is your Link ?
How Safe is your Link ?
 

Kürzlich hochgeladen

Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slidespraypatel2
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Alan Dix
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfEnterprise Knowledge
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhisoniya singh
 
A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024Results
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Allon Mureinik
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure servicePooja Nehwal
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersThousandEyes
 
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...HostedbyConfluent
 

Kürzlich hochgeladen (20)

Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slides
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
 
A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
 
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
 

You didnt see it’s coming? "Dawn of hardened Windows Kernel"

  • 1. You didnt see it’s coming? “Dawn of hardened Windows Kernel”
  • 2. $whoami Peter • @zer0mem • Windows kernel research at KeenLab, Tencent • pwn2own winner (2015 / 2016), pwnie nominee (2015) • fuzzing focus : state • wushu player
  • 5. path of less resistance - w32k* • resides in ring 0 • natural := ( level < medium ) -> SYSTEM (/kernel code exec) escape • huge attack surface • huge in comparsion to ntoskrnl counterpart or in-ring3-sandbox interface • state logic, window callbacks, hidden syscalls, directx, format parsing, ... • accessible from sandbox-es • nowdays more or less => big success! • easy develepoing of exploitation techniques
  • 7. what is going on ? • huge numbers of syscalls • lot of objects • lot of hardcore graphics stuffs • lot of things i dunno
  • 8. w32k vs Qilin • Qilin - internal multi-platform fuzzing framework • Target – gdi - part of w32k • Technique : • knowledge based • random driven • interconnection aware • Results in graph • technique ++ code coverage • feedback + knowledge based (ongoing) Collisions 23% ReadVa, nullptr 24% reported 35% queue 18% bugz so far #13~16 Collisions ReadVa, nullptr reported queue http://www.slideshare.net/PeterHlavaty/rainbow-over-the-windows-more-colors-than-you-could-expect
  • 9. from bug to take over SYSTEM • except huge code base with lot of space for bugs • huge code base with lof of space for missusing existing mechanisms • valuable arsenal • virtual tables and alikes • unprotected lengths • plain state members • buffer pointers • prequisites : • call syscalls
  • 10. W32k kernel io : _gre_bitmap • Simple & *reliable* pool layout • Direct syscalls for content manipulation • Pivot -> worker technique
  • 11. w32k out of scope of interest ? • somehow : • going to be locked down & filtered out • not so cool anymore, many research done, many bugs out, ... • so complex so it even gets boring after time of researching there • if you trying to find something -> you will : if no, then try harder... • however in nowadays still applies (and some time will) • weakest points of windows kernel • accessible from most sandboxes • best attack vector nowadays • attackers are lazy, why do something hard if no need ? *PERFECT GROUND FOR YOUR FUZZER*
  • 12. ntos : lets move from win32k mutex memory thread (a)lpc section pipe ...
  • 13. ntos - attack surface • difference : • seemingly no data parsing +- • state only • from untrusted level / app container not much to touch • small number of state changing syscalls • state changes are minimalistic in most cases*
  • 14. ntos under the microscope - extensions • Nt*Transaction* • Nt*Enlistment* • Nt*Manager*
  • 15. tm.sys • ntos extension • Kernel Transaction Manager • however not much attack surface as well • simple states & minimum syscalls • however interconnections • Qilin vs tm, round1 : • 1 nullptr • 1 exploitable double ObDeref -> type confusion -> uaf
  • 16. explore unknown : indirections++ • tm.sys simple purpose driver • but interesting module involved at backend • CLFS.sys
  • 17. CLFS.sys : unseen hand behind the scenes • Common Log File System • not everything need to be direct • easy to get interest if you look at simplistic tm.sys • clfs used at many different places in ntos itself as well • clfs on other hand more complex • c++ code base • complex state • involve data parsing • Qilin vs clfs : 3~5 state bugs, 6~8 data parsing • Advanced *data* fuzzer : covers all first hand bugs, and extend 4+ • by @long123king
  • 18. bug hunting research, fuzzing, feedback, analysis, loop back
  • 19. kick off • select target • collect related syscalls ( apis ) • research attack surface • go trough related msdn part (if any) • understand abstracted functionality • what it is purpose • what is usual way of working with it • double check interesting points with kernel implementation
  • 20. fuzzer • make some code to automate working with target • optionally use existing framework, just add functionality per target • make it work • most basic syscalls working (open, close, get) • make use of previous reseach • implement basic schema from previous step • ensure that your fuzzer can sucessfully work on target based on documentation of target • introduce randomnes with preserving certain sucess ratio • introduce connections (syscall & handle dependencies)
  • 21. feedback • how good is your fuzzing ? • sucess ratio % ? • code coverage ?
  • 23. research • fuzzing is one part • you want more bugz ? you need know your target well • not only target, but your fuzzer as well • analyze less covered parts • think of possible buggy scenarios • implement back to fuzzer • loop back (from documentation, trough fuzzing up to understanding) fuzzing analyze update
  • 24. additional thoughts • fuzzing is not enough • you need to understand what you are fuzzing • better understanding helps to build more tricky logic • hower once you concrete too much, then you puting yourself into corner • better to be backuped with code coverage corpus • corpus is essential to keep & update, but not recycle (scatter&replace) often • fuzzer is not all you need • runtime tools [ adress sanitizers, race tools, debugger plugins, .. ] • static tools [ helping your fuzzer, helping your analysis ]
  • 25. lets move to exploitation techniques!
  • 26. options • w32k easy to go, however not so easy from locked down / filtered state anymore • can go trough chaining, but we can do better • ntos, harder to go • not much available syscalls - harder to setup & control technique properly • not much used before - why to go harder way if no need ? • less objects, with less nasty states
  • 27. nt!KeWaitForSingleObject • small object • relativelly simple • interesting logic behind usage • lock / unlock • wait • kernel pointers • ethreads • offers various primitives : • arbitrary decrease • arbitrary write where - kernel pointer* • ...
  • 28. SafeLink write where primitive • Introduced to deal meta data link corruptions • previously lead to : write where - what • now it leads to int 0x29 ... not necessary, or ? A B C
  • 29. Arbitrary write – kernel pointer • target needs to point to semaphore / event • Problem ? .. Well not much : • You can predict kernel mode memory members • You can misalign Flink –> Blink == Blink -> Blink http://www.slideshare.net/PeterHlavaty/how-safe
  • 30. ALPC • not everything touchable in ntos is really minimalistic • more complex mechanism • more complex state • good interconnections • .. however well written code .. • lot of safe checks • safe user mode memory handling (via 'getters') • seems well designed http://alex-ionescu.com/Publications/SyScan/syscan2014.pdf
  • 31. ALPC #spray kd> dt nt!_kalpc_message … +0x010 PortQueue +0x018 OwnerPort … +0x068 MessageAttributes +0x0b0 DataUserVa : Ptr64 Void … +0x0d8 ExtensionBuffer : Ptr64 Void +0x0e0 ExtensionBufferSize : Uint8B +0x0e8 PortMessage : _PORT_MESSAGE kd> dt nt!_kalpc_message PortMessage->u1->* +0x0e8 PortMessage : +0x000 u1 : +0x000 s1 : <unnamed-tag> +0x000 Length : Uint4B +0x004 u2
  • 32. ALPC #detect kd> dt nt!_kalpc_message … +0x010 PortQueue +0x018 OwnerPort … +0x068 MessageAttributes +0x0b0 DataUserVa : Ptr64 Void … +0x0d8 ExtensionBuffer : Ptr64 Void +0x0e0 ExtensionBufferSize : Uint8B +0x0e8 PortMessage : _PORT_MESSAGE kd> dt nt!_kalpc_message PortMessage->u1->* +0x0e8 PortMessage : +0x000 u1 : +0x000 s1 : <unnamed-tag> +0x000 Length : Uint4B +0x004 u2
  • 33. ALPC #overflow kd> dt nt!_kalpc_message … +0x010 PortQueue +0x018 OwnerPort … +0x068 MessageAttributes +0x0b0 DataUserVa : Ptr64 Void … +0x0d8 ExtensionBuffer : Ptr64 Void +0x0e0 ExtensionBufferSize : Uint8B +0x0e8 PortMessage : _PORT_MESSAGE kd> dt nt!_kalpc_message PortMessage->u1->* +0x0e8 PortMessage : +0x000 u1 : +0x000 s1 : <unnamed-tag> +0x000 Length : Uint4B +0x004 u2
  • 34. ALPC #io • #4 threads ( gdi tech, only #1 thread ) • io • pivot • worker • server • Performing additional write per io ! • synchronization • Undocumented ALPC • Setup server – client • Keeping messages alive • pool feng shui is problematic
  • 35. Hardenings !? SMEP, KASLR, Nx, CFG, RFG, ACL, SafeLink ...
  • 36. from user to kernel, from kernel to jail : w32k • Filtering • ? win32k – win32kfull – win32kbase ? • win32k -> wrapper to add stub* with access checks • restrict access only to necessary parts • maybe not 'clean' solution, but security++ (relatively) • app can have different sandboxed entities, and per entity different attack surfaces • find way from one to another, and you can find way out of filter • in optimal scenario limit potential bug landscape • first part of good effect • in optimal scenario limit exploitation techniques • this is the second good effect • lockdown • wow, this sure solve something in crazy *absolute* way O_o
  • 37. w32k is here for you if you need it! • One can have arbitrary decrease ? [ see previous semaphore slides ] • Or any suitable primitive, just necessary be creative • Would he choose alpc technique ? • If he is lazy (smart) enough, then no … • Re-enable w32k instead! • even allow more proc in your job in case of need • do one-bit kernel pwn via win32k!_gre_bitmap and enjoy life!
  • 38. kernel code exec vs mittigations • KASLR, code signing, Nx, CFG, SMEP • set some good security boundaries • however getting code exec no problem after all • kaslr - good bug or additional info leak • code signing : we will ship our code to kernel via kernel io, and exec it • Nx + SMEP : find rwe page, or create it • CFG : find good trampoline or target stack
  • 39. easy to be said, harder to be done ? • not actually • kernel-io techniques already described • still headache with kernel Nx / SMEP ? • NtUserMessageCall [ following slide ] • CFG • prevents only from ROP to be kicked of • i dont like ROP neither, target stack [ + functions ] • CFG alone is not enough (in terms of code exec) !
  • 40. NtUserMessageCall • Function of many faces • 7 parameters • Full control over them • Indirect call invoked • 7+ member of vtable <- dummy! • vcall return is passed to user! • Enough primitives for kernel code exec, with valid function (no ROP) !
  • 41. Get kernel code exec • Misuse existing functions • NtUserMessageCall • Allocate RWE memory • memcpy you kernel driver • Stack hook • Game over
  • 42. SMAP - tale of lacking feature • prevents kernel unwanted access to user mode memory • sets bare metal borders between data in user mode and kernel • should serve as fine security feature … does it ?
  • 43. SMAP - tale of lacking feature
  • 44. SMAP - tale of lacking feature ... however ... • without proper security schema in underlying OS, it is just shinny ... • nullptr deref protection - anything bellow 0x10000 • poisons should be *not-mappable* by user by default! • you need controlled data at exploitation ? why you need them in user mode ? • easy to put in kernel (pipes, direct mem mapping, physmap, kernel stack, ...) • in occasional cases one more bug to leak address layout • in most cases you can get them out from mem corruption bug (unprotected raw pointers, ...) • security features is good to have, but better to use to max potential • which OS nowadays is using SMAP in way that it is really obstacle for attackers ?
  • 45. Control Flow – hardware! • CET-IBT • Indirect jumps / calls + endbrXX • Similar idea with CFG indeed • Your jumps can not go wild, like ROP do! • CET-Shadow Stack • nicely done! • You can not subvert control flow via stack hooking anymore! • so seriously, what now ? • … wait for some time to adapt to mainstream O_o https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf
  • 46. Return Flow Guard • Rumors about RFG • Return Flow Guard • Preliminary documentation (nice!) : http://xlab.tencent.com/en/2016/11/02/return-flow-guard/ • Simple & fast & effective • Effective ? • Shadow Stack alike, therefore yes! • .. and we are back with FS on x64! fs:[rsp] • arbitrary read / write will not touch it! • in combination with CFG ? – hell, a lot! • Two simple & effective mitigations together are pretty solid! • Can be implemented with todays hardware! https://people.eecs.berkeley.edu/~dawnsong/papers/osdi14-paper-kuznetsov.pdf
  • 47. {C/R}FG vs CET vs CFI • CET-IBT • some criticize that it lacks type integrity hash checks • It sets bare metal rules – how calls / ret must behave • CET is *not* about control flow *integrity* in particular • Implies : ROP is over but you can jump to *any* function instead! • CFG + RFG • very close to CET • Added some integrity checks on top of it • black-list (not include into bitmap) “dangerous” functions • Implies : ROP is over but you can jump to large *subset* of functions instead! • depends on corner cases however • As you can see CFG improvements over time, cat – mouse game ?
  • 48. ROP – wild technique
  • 49. Function oriented - restricted technique http://dl.acm.org/citation.cfm?id=2848479
  • 50. CET-{IBT+ShadowStack} / {C/R}FG • Gadgets == functions (Loop dispatcher / KernelIo) • Proper CFI needed (clang / pax) • Kernel Code Exec, doable ? • Well, if you want install old school rootkit, doable • RWE on kernel component in your reach • Patch legitimate kernel • Jump • Patch back • Obviously bad code! • any reasonable benefits from kernel code exec ? • Kernel Code Exec, needed ? • do you even need your own _eproc ? • why don’t just use kernel io (legit non-harm) syscalls • force(trick) other _ethreads to do job for you • Patching their stacks (params / rets) should do the job http://www.slideshare.net/PeterHlavaty/back-to-the-core ( VadRoot technique ) http://www.pcc.me.uk/~peter/acad/usenix14.pdf https://pax.grsecurity.net/docs/PaXTeam-H2HC15-RAP-RIP-ROP.pdf
  • 51. Data attacks! - TODO What is your goal ?
  • 52. DOP – Turing Complete https://www.comp.nus.edu.sg/~shweta24/publications/dop_oakland16.pdf f
  • 53. Kernel Io • In the end data are all what matters! • Code is just group of instructions working over those data • Your ultimate goal is to access data • No need to be SYSTEM • No need to do Kernel Exec • Kernel io can ‘emulate’ apis • You can do math operations • ...
  • 54. Data attack prevention • Same piece of code should work on same memory type • w32k gdi function will not touch _eprocess • possible to simple set ranges (hardware) ? • Pool isolation • Isolated heap (object caches) ? • local vars (thread) by default allowed • Existing solutions ? • Intel mpx – seems not going to succeed ? • PAC – looks like game changer (CPI approach) ? • Isolation ?  https://software.intel.com/en-us/blogs/2013/07/22/intel- memory-protection-extensions-intel-mpx-support-in-the-gnu- toolchain https://community.arm.com/groups/processors /blog/2016/10/27/armv8-a-architecture-2016- additions https://taesoo.gtisc.gatech.edu/pubs/2016/song:kenali.pdf
  • 57. Application Guard! • well, this can change things lot! • still kernel-Io is here real power ? • … well … • doomed within domain • One does not simple do exec when ring -1 is watching! • no real RWE page [ ept ] • code signing [ rw -> e ]
  • 58. Containers • But, as always .. it is just another layer, another ring ... • bugs • logical issues • with small big difference • less code • code quality ++ http://www.alex-ionescu.com/syscan2015.pdf
  • 59. conclusions • KASLR, nullptr-deref, Nx, SMEP • very well adapted! • ACL for kernel object access • good security model! • w32k re-designing { filtering & lockdown } • tackling biggest security problem in windows kernel! • {C/R}FG • nice anti-exploitation approaches! { - step by step to adapt to kernel } • CET - IBT & Shadow Stack • nice co-operation towards to new security model! • HyperV based App Containers • moving operating system to another league in terms of security
  • 60. conclusions - todo#memory-corruptions • Control flow integrity – to improve • fine grained CFG – fast, smart, compat! but can it be fine enough ? • adapt { forwarded-edge ( clang ) / type-hash ( pax ) } – existing, fast, does the job! • Make code reuse attacks to disappear ? • Data attacks break down – to tackle • Memory access boundary checks • pointer load / function to heap memory access • Make kernel io disappear ? • Will it move memory corruptions from attack vector to state of art ? • memory corruption == ddos only ? • Not yet, long way to go, but now we can see that possibility • However maybe that can even happen in foreseeable future ?