A look inside the Windows Kernel CVE-2011-1237 Evolution from XP - - PowerPoint PPT Presentation

▶
a look inside the windows kernel
SMART_READER_LITE
LIVE PREVIEW

A look inside the Windows Kernel CVE-2011-1237 Evolution from XP - - PowerPoint PPT Presentation

Dec 25, 2022 577 likes •1.55k views

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel A look inside the Windows Kernel CVE-2011-1237 Evolution from XP to 8 Bruno Pujos CVE-2013-3660 Conclusion LSE July 18, 2013 Plan A look inside the

slide-1
SLIDE 1

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

A look inside the Windows Kernel

Bruno Pujos

LSE

July 18, 2013

slide-2
SLIDE 2

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Plan

1

Introduction

slide-3
SLIDE 3

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Introduction

What this talk is about?

  • Security of the Windows Kernel
  • Presentation of some exploits
  • What changed in the security of the kernel, since

Windows NT 5.1 (Windows XP)

Motivation for attacking the kernel

  • Sandbox bypassing
  • Full access to everything
  • The fun
slide-4
SLIDE 4

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Plan

1

Introduction

2

Basics of Windows Kernel

3

CVE-2011-1237

4

Evolution from XP to 8

5

CVE-2013-3660

6

Conclusion

slide-5
SLIDE 5

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Plan

2

Basics of Windows Kernel

slide-6
SLIDE 6

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Basics of Windows Kernel

slide-7
SLIDE 7

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

HAL

  • HAL : The hardware abstraction layer (hal.dll)
  • ”a layer of software that deals directly with your

computer hardware.” (msdn)

  • Layer for suporting different hardware with the same

software

  • HalDispatchTable : holds the addresses of a few

HAL routines

slide-8
SLIDE 8

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Win32k.sys

  • Kernel mode driver
  • Introduce in NT 4.0 for performance reason
  • Two parts :
  • The Graphics Device Interface (GDI)
  • The Window Manager
slide-9
SLIDE 9

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

User objects

  • User entities (Windows, menu, keyboard layout. . . )
  • Managed by the Window Manager
  • Represented by a handle
  • Handle table keeps track of each user object
  • The address of the object
  • The type of the object
  • A flag
  • The owner and a wUniq value
slide-10
SLIDE 10

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

User objects

  • User entities (Windows, menu, keyboard layout. . . )
  • Managed by the Window Manager
  • Represented by a handle
  • Handle table keeps track of each user object
  • The address of the object
  • The type of the object
  • A flag
  • The owner and a wUniq value
slide-11
SLIDE 11

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

User objects

  • User entities (Windows, menu, keyboard layout. . . )
  • Managed by the Window Manager
  • Represented by a handle
  • Handle table keeps track of each user object
  • The address of the object
  • The type of the object
  • A flag
  • The owner and a wUniq value
slide-12
SLIDE 12

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

User-Mode Callback

  • A way to communicate between kernel and user:
  • access to some structures in user mode
  • used to support hooking
  • . . .
  • CBT-Hook: receive notifications from windows
  • WindowProc: callback function wich processes the

messages sent to a window

slide-13
SLIDE 13

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

User-Mode Callback

  • A way to communicate between kernel and user:
  • access to some structures in user mode
  • used to support hooking
  • . . .
  • CBT-Hook: receive notifications from windows
  • WindowProc: callback function wich processes the

messages sent to a window

slide-14
SLIDE 14

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Plan

3

CVE-2011-1237

slide-15
SLIDE 15

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tarjei Mandt

(@kernelpool), based on his paper Kernel Attacks through User-Mode Callbacks

  • Use After Free of a window object (User Object)
  • During the creation of a new window, you can give a

parent in a CBT-Hook

  • Using another hook during the creation, you can

destroy this window

  • We have a way to allocate a buffer with our content

and the size we want with SetWindowTextW. We will use it to put what we want at the position of the free window

  • The parent is used at the end of LinkWindow, and it

has been freed

  • We can map the Null page and put our shellcode in

it, in userland. Our goal is to call it

slide-16
SLIDE 16

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tarjei Mandt

(@kernelpool), based on his paper Kernel Attacks through User-Mode Callbacks

  • Use After Free of a window object (User Object)
  • During the creation of a new window, you can give a

parent in a CBT-Hook

  • Using another hook during the creation, you can

destroy this window

  • We have a way to allocate a buffer with our content

and the size we want with SetWindowTextW. We will use it to put what we want at the position of the free window

  • The parent is used at the end of LinkWindow, and it

has been freed

  • We can map the Null page and put our shellcode in

it, in userland. Our goal is to call it

slide-17
SLIDE 17

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tarjei Mandt

(@kernelpool), based on his paper Kernel Attacks through User-Mode Callbacks

  • Use After Free of a window object (User Object)
  • During the creation of a new window, you can give a

parent in a CBT-Hook

  • Using another hook during the creation, you can

destroy this window

  • We have a way to allocate a buffer with our content

and the size we want with SetWindowTextW. We will use it to put what we want at the position of the free window

  • The parent is used at the end of LinkWindow, and it

has been freed

  • We can map the Null page and put our shellcode in

it, in userland. Our goal is to call it

slide-18
SLIDE 18

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tarjei Mandt

(@kernelpool), based on his paper Kernel Attacks through User-Mode Callbacks

  • Use After Free of a window object (User Object)
  • During the creation of a new window, you can give a

parent in a CBT-Hook

  • Using another hook during the creation, you can

destroy this window

  • We have a way to allocate a buffer with our content

and the size we want with SetWindowTextW. We will use it to put what we want at the position of the free window

  • The parent is used at the end of LinkWindow, and it

has been freed

  • We can map the Null page and put our shellcode in

it, in userland. Our goal is to call it

slide-19
SLIDE 19

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tarjei Mandt

(@kernelpool), based on his paper Kernel Attacks through User-Mode Callbacks

  • Use After Free of a window object (User Object)
  • During the creation of a new window, you can give a

parent in a CBT-Hook

  • Using another hook during the creation, you can

destroy this window

  • We have a way to allocate a buffer with our content

and the size we want with SetWindowTextW. We will use it to put what we want at the position of the free window

  • The parent is used at the end of LinkWindow, and it

has been freed

  • We can map the Null page and put our shellcode in

it, in userland. Our goal is to call it

slide-20
SLIDE 20

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tarjei Mandt

(@kernelpool), based on his paper Kernel Attacks through User-Mode Callbacks

  • Use After Free of a window object (User Object)
  • During the creation of a new window, you can give a

parent in a CBT-Hook

  • Using another hook during the creation, you can

destroy this window

  • We have a way to allocate a buffer with our content

and the size we want with SetWindowTextW. We will use it to put what we want at the position of the free window

  • The parent is used at the end of LinkWindow, and it

has been freed

  • We can map the Null page and put our shellcode in

it, in userland. Our goal is to call it

slide-21
SLIDE 21

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tarjei Mandt

(@kernelpool), based on his paper Kernel Attacks through User-Mode Callbacks

  • Use After Free of a window object (User Object)
  • During the creation of a new window, you can give a

parent in a CBT-Hook

  • Using another hook during the creation, you can

destroy this window

  • We have a way to allocate a buffer with our content

and the size we want with SetWindowTextW. We will use it to put what we want at the position of the free window

  • The parent is used at the end of LinkWindow, and it

has been freed

  • We can map the Null page and put our shellcode in

it, in userland. Our goal is to call it

slide-22
SLIDE 22

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Link Window

  • Basically, it just adds an element in a double chained

list of windows

  • clockObj: part of each User Object, reference

counter

  • Since we control one of the objects we can

decrement an arbitrary a word by one

  • If the clockObj is null, it calls the function

HMDestroyUnlockedObject

slide-23
SLIDE 23

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Link Window

  • Basically, it just adds an element in a double chained

list of windows

  • clockObj: part of each User Object, reference

counter

  • Since we control one of the objects we can

decrement an arbitrary a word by one

  • If the clockObj is null, it calls the function

HMDestroyUnlockedObject

slide-24
SLIDE 24

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Link Window

  • Basically, it just adds an element in a double chained

list of windows

  • clockObj: part of each User Object, reference

counter

  • Since we control one of the objects we can

decrement an arbitrary a word by one

  • If the clockObj is null, it calls the function

HMDestroyUnlockedObject

slide-25
SLIDE 25

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Link Window

  • Basically, it just adds an element in a double chained

list of windows

  • clockObj: part of each User Object, reference

counter

  • Since we control one of the objects we can

decrement an arbitrary a word by one

  • If the clockObj is null, it calls the function

HMDestroyUnlockedObject

slide-26
SLIDE 26

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Link Window

slide-27
SLIDE 27

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Link Window

slide-28
SLIDE 28

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Link Window

slide-29
SLIDE 29

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Link Window

slide-30
SLIDE 30

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Decrement by one

  • Create two windows (A & B)
  • Activate the hook
  • Create a third window (E)
  • HCBT_CREATEWND: link with the window A
  • WM_NCCREATE: destroy A (DestroyWindow),

realloc with a fake object (SetWindowTextW on B)

  • LinkWindow: decrement by one where we want
slide-31
SLIDE 31

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Decrement by one

  • Create two windows (A & B)
  • Activate the hook
  • Create a third window (E)
  • HCBT_CREATEWND: link with the window A
  • WM_NCCREATE: destroy A (DestroyWindow),

realloc with a fake object (SetWindowTextW on B)

  • LinkWindow: decrement by one where we want
slide-32
SLIDE 32

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Decrement by one

  • Create two windows (A & B)
  • Activate the hook
  • Create a third window (E)
  • HCBT_CREATEWND: link with the window A
  • WM_NCCREATE: destroy A (DestroyWindow),

realloc with a fake object (SetWindowTextW on B)

  • LinkWindow: decrement by one where we want
slide-33
SLIDE 33

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Decrement by one

  • Create two windows (A & B)
  • Activate the hook
  • Create a third window (E)
  • HCBT_CREATEWND: link with the window A
  • WM_NCCREATE: destroy A (DestroyWindow),

realloc with a fake object (SetWindowTextW on B)

  • LinkWindow: decrement by one where we want
slide-34
SLIDE 34

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Decrement by one

  • Create two windows (A & B)
  • Activate the hook
  • Create a third window (E)
  • HCBT_CREATEWND: link with the window A
  • WM_NCCREATE: destroy A (DestroyWindow),

realloc with a fake object (SetWindowTextW on B)

  • LinkWindow: decrement by one where we want
slide-35
SLIDE 35

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Decrement by one

  • Create two windows (A & B)
  • Activate the hook
  • Create a third window (E)
  • HCBT_CREATEWND: link with the window A
  • WM_NCCREATE: destroy A (DestroyWindow),

realloc with a fake object (SetWindowTextW on B)

  • LinkWindow: decrement by one where we want
slide-36
SLIDE 36

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

HMDestroyUnlockedObject

HMDestroyUnlockedObject

  • HMDestroyUnlockedObject: takes the handle from

the user object given as argument

  • check this condition: (flag & 1) && !(flag & 2)
  • if it is true, calls the destroying function for the object

depending on his type

  • If the type is 0 (already free): calls the null page

Standard

  • the type for a window is 1
  • in a standard moment the flag is 00
slide-37
SLIDE 37

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

HMDestroyUnlockedObject

HMDestroyUnlockedObject

  • HMDestroyUnlockedObject: takes the handle from

the user object given as argument

  • check this condition: (flag & 1) && !(flag & 2)
  • if it is true, calls the destroying function for the object

depending on his type

  • If the type is 0 (already free): calls the null page

Standard

  • the type for a window is 1
  • in a standard moment the flag is 00
slide-38
SLIDE 38

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

HMDestroyUnlockedObject

HMDestroyUnlockedObject

  • HMDestroyUnlockedObject: takes the handle from

the user object given as argument

  • check this condition: (flag & 1) && !(flag & 2)
  • if it is true, calls the destroying function for the object

depending on his type

  • If the type is 0 (already free): calls the null page

Standard

  • the type for a window is 1
  • in a standard moment the flag is 00
slide-39
SLIDE 39

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

HMDestroyUnlockedObject

HMDestroyUnlockedObject

  • HMDestroyUnlockedObject: takes the handle from

the user object given as argument

  • check this condition: (flag & 1) && !(flag & 2)
  • if it is true, calls the destroying function for the object

depending on his type

  • If the type is 0 (already free): calls the null page

Standard

  • the type for a window is 1
  • in a standard moment the flag is 00
slide-40
SLIDE 40

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

HMDestroyUnlockedObject

HMDestroyUnlockedObject

  • HMDestroyUnlockedObject: takes the handle from

the user object given as argument

  • check this condition: (flag & 1) && !(flag & 2)
  • if it is true, calls the destroying function for the object

depending on his type

  • If the type is 0 (already free): calls the null page

Standard

  • the type for a window is 1
  • in a standard moment the flag is 00
slide-41
SLIDE 41

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

HMDestroyUnlockedObject

HMDestroyUnlockedObject

  • HMDestroyUnlockedObject: takes the handle from

the user object given as argument

  • check this condition: (flag & 1) && !(flag & 2)
  • if it is true, calls the destroying function for the object

depending on his type

  • If the type is 0 (already free): calls the null page

Standard

  • the type for a window is 1
  • in a standard moment the flag is 00
slide-42
SLIDE 42

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Calling the null page

  • We create a first window (U)
  • We decremant the flag of the handle of U by 3 using

the use-after-free (0xFD)

  • We decrement the type of the handle of U by 1 (0)
  • We trigger once again the use-after-free
  • In LinkWindow we put a clockObj to 1, and the

handler of the window U

  • when clockObj is decremented, call to

HMDestroyUnlockedObject is done, that passes the test and calls the null page

slide-43
SLIDE 43

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Calling the null page

  • We create a first window (U)
  • We decremant the flag of the handle of U by 3 using

the use-after-free (0xFD)

  • We decrement the type of the handle of U by 1 (0)
  • We trigger once again the use-after-free
  • In LinkWindow we put a clockObj to 1, and the

handler of the window U

  • when clockObj is decremented, call to

HMDestroyUnlockedObject is done, that passes the test and calls the null page

slide-44
SLIDE 44

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Calling the null page

  • We create a first window (U)
  • We decremant the flag of the handle of U by 3 using

the use-after-free (0xFD)

  • We decrement the type of the handle of U by 1 (0)
  • We trigger once again the use-after-free
  • In LinkWindow we put a clockObj to 1, and the

handler of the window U

  • when clockObj is decremented, call to

HMDestroyUnlockedObject is done, that passes the test and calls the null page

slide-45
SLIDE 45

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Calling the null page

  • We create a first window (U)
  • We decremant the flag of the handle of U by 3 using

the use-after-free (0xFD)

  • We decrement the type of the handle of U by 1 (0)
  • We trigger once again the use-after-free
  • In LinkWindow we put a clockObj to 1, and the

handler of the window U

  • when clockObj is decremented, call to

HMDestroyUnlockedObject is done, that passes the test and calls the null page

slide-46
SLIDE 46

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Calling the null page

  • We create a first window (U)
  • We decremant the flag of the handle of U by 3 using

the use-after-free (0xFD)

  • We decrement the type of the handle of U by 1 (0)
  • We trigger once again the use-after-free
  • In LinkWindow we put a clockObj to 1, and the

handler of the window U

  • when clockObj is decremented, call to

HMDestroyUnlockedObject is done, that passes the test and calls the null page

slide-47
SLIDE 47

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Exploitation - Calling the null page

  • We create a first window (U)
  • We decremant the flag of the handle of U by 3 using

the use-after-free (0xFD)

  • We decrement the type of the handle of U by 1 (0)
  • We trigger once again the use-after-free
  • In LinkWindow we put a clockObj to 1, and the

handler of the window U

  • when clockObj is decremented, call to

HMDestroyUnlockedObject is done, that passes the test and calls the null page

slide-48
SLIDE 48

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Plan

4

Evolution from XP to 8

slide-49
SLIDE 49

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

From XP to 8

  • Kernel ASLR
  • Kernel Address = User Address - Local module base

+ Kernel module base

  • Enhanced /GS
  • Guard pages
  • DEP improvements
  • NULL dereference protection
  • Kernel pool integrity checks
  • SMEP/PXN
slide-50
SLIDE 50

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

From XP to 8

  • Kernel ASLR
  • Kernel Address = User Address - Local module base

+ Kernel module base

  • Enhanced /GS
  • Guard pages
  • DEP improvements
  • NULL dereference protection
  • Kernel pool integrity checks
  • SMEP/PXN
slide-51
SLIDE 51

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

From XP to 8

  • Kernel ASLR
  • Kernel Address = User Address - Local module base

+ Kernel module base

  • Enhanced /GS
  • Guard pages
  • DEP improvements
  • NULL dereference protection
  • Kernel pool integrity checks
  • SMEP/PXN
slide-52
SLIDE 52

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

From XP to 8

  • Kernel ASLR
  • Kernel Address = User Address - Local module base

+ Kernel module base

  • Enhanced /GS
  • Guard pages
  • DEP improvements
  • NULL dereference protection
  • Kernel pool integrity checks
  • SMEP/PXN
slide-53
SLIDE 53

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

From XP to 8

  • Kernel ASLR
  • Kernel Address = User Address - Local module base

+ Kernel module base

  • Enhanced /GS
  • Guard pages
  • DEP improvements
  • NULL dereference protection
  • Kernel pool integrity checks
  • SMEP/PXN
slide-54
SLIDE 54

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

From XP to 8

  • Kernel ASLR
  • Kernel Address = User Address - Local module base

+ Kernel module base

  • Enhanced /GS
  • Guard pages
  • DEP improvements
  • NULL dereference protection
  • Kernel pool integrity checks
  • SMEP/PXN
slide-55
SLIDE 55

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

From XP to 8

  • Kernel ASLR
  • Kernel Address = User Address - Local module base

+ Kernel module base

  • Enhanced /GS
  • Guard pages
  • DEP improvements
  • NULL dereference protection
  • Kernel pool integrity checks
  • SMEP/PXN
slide-56
SLIDE 56

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

SMEP/PXN

  • Supervisor Mode Execution Protection / Privileged

Execute Never

  • Depends on the processor
  • Prevents a kernel thread to execute code in userland
  • SMEP is enabled or disabled via CR4 control register
  • Possible to bypass
  • ROP
  • Store the shellcode into kernel space
slide-57
SLIDE 57

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

SMEP/PXN

  • Supervisor Mode Execution Protection / Privileged

Execute Never

  • Depends on the processor
  • Prevents a kernel thread to execute code in userland
  • SMEP is enabled or disabled via CR4 control register
  • Possible to bypass
  • ROP
  • Store the shellcode into kernel space
slide-58
SLIDE 58

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

SMEP/PXN

  • Supervisor Mode Execution Protection / Privileged

Execute Never

  • Depends on the processor
  • Prevents a kernel thread to execute code in userland
  • SMEP is enabled or disabled via CR4 control register
  • Possible to bypass
  • ROP
  • Store the shellcode into kernel space
slide-59
SLIDE 59

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

SMEP/PXN

  • Supervisor Mode Execution Protection / Privileged

Execute Never

  • Depends on the processor
  • Prevents a kernel thread to execute code in userland
  • SMEP is enabled or disabled via CR4 control register
  • Possible to bypass
  • ROP
  • Store the shellcode into kernel space
slide-60
SLIDE 60

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

SMEP/PXN

  • Supervisor Mode Execution Protection / Privileged

Execute Never

  • Depends on the processor
  • Prevents a kernel thread to execute code in userland
  • SMEP is enabled or disabled via CR4 control register
  • Possible to bypass
  • ROP
  • Store the shellcode into kernel space
slide-61
SLIDE 61

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Plan

5

CVE-2013-3660

slide-62
SLIDE 62

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tavis Ormandy (@taviso)
  • Exploit by Tavis Ormandy and progmboy
  • In win32k!EPATHOBJ::pprFlattenRec
  • Uninitialized pointer for the next in a double linked list

(part of a Path object in the GDI in win32k)

  • To-userspace dereferences vulnerability
  • We want to trigger a write-what-where vulnerability
slide-63
SLIDE 63

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tavis Ormandy (@taviso)
  • Exploit by Tavis Ormandy and progmboy
  • In win32k!EPATHOBJ::pprFlattenRec
  • Uninitialized pointer for the next in a double linked list

(part of a Path object in the GDI in win32k)

  • To-userspace dereferences vulnerability
  • We want to trigger a write-what-where vulnerability
slide-64
SLIDE 64

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tavis Ormandy (@taviso)
  • Exploit by Tavis Ormandy and progmboy
  • In win32k!EPATHOBJ::pprFlattenRec
  • Uninitialized pointer for the next in a double linked list

(part of a Path object in the GDI in win32k)

  • To-userspace dereferences vulnerability
  • We want to trigger a write-what-where vulnerability
slide-65
SLIDE 65

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tavis Ormandy (@taviso)
  • Exploit by Tavis Ormandy and progmboy
  • In win32k!EPATHOBJ::pprFlattenRec
  • Uninitialized pointer for the next in a double linked list

(part of a Path object in the GDI in win32k)

  • To-userspace dereferences vulnerability
  • We want to trigger a write-what-where vulnerability
slide-66
SLIDE 66

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Vulnerability

  • Vulnerability discovered by Tavis Ormandy (@taviso)
  • Exploit by Tavis Ormandy and progmboy
  • In win32k!EPATHOBJ::pprFlattenRec
  • Uninitialized pointer for the next in a double linked list

(part of a Path object in the GDI in win32k)

  • To-userspace dereferences vulnerability
  • We want to trigger a write-what-where vulnerability
slide-67
SLIDE 67

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Pathrec struct

struct _PATHRECORD { struct _PATHRECORD ∗ next ; struct _PATHRECORD ∗ prev ; ULONG flags ; ULONG count ; POINTFIX points [ x ] ; }

slide-68
SLIDE 68

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Go to userspace

  • We need to make a specific AllocObject fail to trigger

the exploitable condition: we need memory pressure.

  • Allocation of the struct of a PATHREC is done of two

possible ways

  • The PATHALLOC system use HeavyAllocPool for

allocating object but have is own implementation of the free list

  • After allocating from HeavyAllocPool, it memsets to 0
  • But in the case of taking an element of the freelist it’s

not set to 0

  • If we can spam the freelist with what we want we

have big chances to have the next pointer where we want (in userspace)

  • We can do that easily by flattening path with a lot of

points we control

  • We put a structure we created in userspace and we

force the kernel to consider that is the next of his list

slide-69
SLIDE 69

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Go to userspace

  • We need to make a specific AllocObject fail to trigger

the exploitable condition: we need memory pressure.

  • Allocation of the struct of a PATHREC is done of two

possible ways

  • The PATHALLOC system use HeavyAllocPool for

allocating object but have is own implementation of the free list

  • After allocating from HeavyAllocPool, it memsets to 0
  • But in the case of taking an element of the freelist it’s

not set to 0

  • If we can spam the freelist with what we want we

have big chances to have the next pointer where we want (in userspace)

  • We can do that easily by flattening path with a lot of

points we control

  • We put a structure we created in userspace and we

force the kernel to consider that is the next of his list

slide-70
SLIDE 70

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Go to userspace

  • We need to make a specific AllocObject fail to trigger

the exploitable condition: we need memory pressure.

  • Allocation of the struct of a PATHREC is done of two

possible ways

  • The PATHALLOC system use HeavyAllocPool for

allocating object but have is own implementation of the free list

  • After allocating from HeavyAllocPool, it memsets to 0
  • But in the case of taking an element of the freelist it’s

not set to 0

  • If we can spam the freelist with what we want we

have big chances to have the next pointer where we want (in userspace)

  • We can do that easily by flattening path with a lot of

points we control

  • We put a structure we created in userspace and we

force the kernel to consider that is the next of his list

slide-71
SLIDE 71

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Go to userspace

  • We need to make a specific AllocObject fail to trigger

the exploitable condition: we need memory pressure.

  • Allocation of the struct of a PATHREC is done of two

possible ways

  • The PATHALLOC system use HeavyAllocPool for

allocating object but have is own implementation of the free list

  • After allocating from HeavyAllocPool, it memsets to 0
  • But in the case of taking an element of the freelist it’s

not set to 0

  • If we can spam the freelist with what we want we

have big chances to have the next pointer where we want (in userspace)

  • We can do that easily by flattening path with a lot of

points we control

  • We put a structure we created in userspace and we

force the kernel to consider that is the next of his list

slide-72
SLIDE 72

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Go to userspace

  • We need to make a specific AllocObject fail to trigger

the exploitable condition: we need memory pressure.

  • Allocation of the struct of a PATHREC is done of two

possible ways

  • The PATHALLOC system use HeavyAllocPool for

allocating object but have is own implementation of the free list

  • After allocating from HeavyAllocPool, it memsets to 0
  • But in the case of taking an element of the freelist it’s

not set to 0

  • If we can spam the freelist with what we want we

have big chances to have the next pointer where we want (in userspace)

  • We can do that easily by flattening path with a lot of

points we control

  • We put a structure we created in userspace and we

force the kernel to consider that is the next of his list

slide-73
SLIDE 73

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Go to userspace

  • We need to make a specific AllocObject fail to trigger

the exploitable condition: we need memory pressure.

  • Allocation of the struct of a PATHREC is done of two

possible ways

  • The PATHALLOC system use HeavyAllocPool for

allocating object but have is own implementation of the free list

  • After allocating from HeavyAllocPool, it memsets to 0
  • But in the case of taking an element of the freelist it’s

not set to 0

  • If we can spam the freelist with what we want we

have big chances to have the next pointer where we want (in userspace)

  • We can do that easily by flattening path with a lot of

points we control

  • We put a structure we created in userspace and we

force the kernel to consider that is the next of his list

slide-74
SLIDE 74

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Go to userspace

  • We need to make a specific AllocObject fail to trigger

the exploitable condition: we need memory pressure.

  • Allocation of the struct of a PATHREC is done of two

possible ways

  • The PATHALLOC system use HeavyAllocPool for

allocating object but have is own implementation of the free list

  • After allocating from HeavyAllocPool, it memsets to 0
  • But in the case of taking an element of the freelist it’s

not set to 0

  • If we can spam the freelist with what we want we

have big chances to have the next pointer where we want (in userspace)

  • We can do that easily by flattening path with a lot of

points we control

  • We put a structure we created in userspace and we

force the kernel to consider that is the next of his list

slide-75
SLIDE 75

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Go to userspace

  • We need to make a specific AllocObject fail to trigger

the exploitable condition: we need memory pressure.

  • Allocation of the struct of a PATHREC is done of two

possible ways

  • The PATHALLOC system use HeavyAllocPool for

allocating object but have is own implementation of the free list

  • After allocating from HeavyAllocPool, it memsets to 0
  • But in the case of taking an element of the freelist it’s

not set to 0

  • If we can spam the freelist with what we want we

have big chances to have the next pointer where we want (in userspace)

  • We can do that easily by flattening path with a lot of

points we control

  • We put a structure we created in userspace and we

force the kernel to consider that is the next of his list

slide-76
SLIDE 76

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

bFlatten and pprFlatten

  • EPATHOBJ::bFlatten just goes through a list and

calls pprFlattenRec if a flag is set on the element

  • EPATHOBJ::pprFlattenRec
  • allocates a new pathrec
  • initialises the new (but not the next at this point)
  • sets the next of previous of the new to himself

new−>previous −>next = new ;

  • ...
  • if we control the struct we can write the position of

the new struct created by pprFlattenRec

slide-77
SLIDE 77

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

bFlatten and pprFlatten

  • EPATHOBJ::bFlatten just goes through a list and

calls pprFlattenRec if a flag is set on the element

  • EPATHOBJ::pprFlattenRec
  • allocates a new pathrec
  • initialises the new (but not the next at this point)
  • sets the next of previous of the new to himself

new−>previous −>next = new ;

  • ...
  • if we control the struct we can write the position of

the new struct created by pprFlattenRec

slide-78
SLIDE 78

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

bFlatten and pprFlatten

  • EPATHOBJ::bFlatten just goes through a list and

calls pprFlattenRec if a flag is set on the element

  • EPATHOBJ::pprFlattenRec
  • allocates a new pathrec
  • initialises the new (but not the next at this point)
  • sets the next of previous of the new to himself

new−>previous −>next = new ;

  • ...
  • if we control the struct we can write the position of

the new struct created by pprFlattenRec

slide-79
SLIDE 79

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

bFlatten and pprFlatten

  • EPATHOBJ::bFlatten just goes through a list and

calls pprFlattenRec if a flag is set on the element

  • EPATHOBJ::pprFlattenRec
  • allocates a new pathrec
  • initialises the new (but not the next at this point)
  • sets the next of previous of the new to himself

new−>previous −>next = new ;

  • ...
  • if we control the struct we can write the position of

the new struct created by pprFlattenRec

slide-80
SLIDE 80

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

bFlatten and pprFlatten

  • EPATHOBJ::bFlatten just goes through a list and

calls pprFlattenRec if a flag is set on the element

  • EPATHOBJ::pprFlattenRec
  • allocates a new pathrec
  • initialises the new (but not the next at this point)
  • sets the next of previous of the new to himself

new−>previous −>next = new ;

  • ...
  • if we control the struct we can write the position of

the new struct created by pprFlattenRec

slide-81
SLIDE 81

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Getting execution

  • We can write the address of something we don’t

control but we control the contents of the first pointer in it: it’s the address of our next element in the list

  • We can write in the HalDispatchTable our pointer on

the next will be considered as code when calling the function.

  • So we need an address which is a valid pointer for

the bFlatten loop and a valid code for execution like inc eax ; 0x40 jmp dword ptr [ ebp+0x40 ] ; 0xff6540

  • We will rewrite the HALDispatchTable[1], called by

NtQueryIntervalProfile and not used for a lot of other things

  • The ebp+0x40 corresponds to the second argument
  • f the NtQueryIntervalProfile where we put the

address of our shellcode

slide-82
SLIDE 82

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Getting execution

  • We can write the address of something we don’t

control but we control the contents of the first pointer in it: it’s the address of our next element in the list

  • We can write in the HalDispatchTable our pointer on

the next will be considered as code when calling the function.

  • So we need an address which is a valid pointer for

the bFlatten loop and a valid code for execution like inc eax ; 0x40 jmp dword ptr [ ebp+0x40 ] ; 0xff6540

  • We will rewrite the HALDispatchTable[1], called by

NtQueryIntervalProfile and not used for a lot of other things

  • The ebp+0x40 corresponds to the second argument
  • f the NtQueryIntervalProfile where we put the

address of our shellcode

slide-83
SLIDE 83

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Getting execution

  • We can write the address of something we don’t

control but we control the contents of the first pointer in it: it’s the address of our next element in the list

  • We can write in the HalDispatchTable our pointer on

the next will be considered as code when calling the function.

  • So we need an address which is a valid pointer for

the bFlatten loop and a valid code for execution like inc eax ; 0x40 jmp dword ptr [ ebp+0x40 ] ; 0xff6540

  • We will rewrite the HALDispatchTable[1], called by

NtQueryIntervalProfile and not used for a lot of other things

  • The ebp+0x40 corresponds to the second argument
  • f the NtQueryIntervalProfile where we put the

address of our shellcode

slide-84
SLIDE 84

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Getting execution

  • We can write the address of something we don’t

control but we control the contents of the first pointer in it: it’s the address of our next element in the list

  • We can write in the HalDispatchTable our pointer on

the next will be considered as code when calling the function.

  • So we need an address which is a valid pointer for

the bFlatten loop and a valid code for execution like inc eax ; 0x40 jmp dword ptr [ ebp+0x40 ] ; 0xff6540

  • We will rewrite the HALDispatchTable[1], called by

NtQueryIntervalProfile and not used for a lot of other things

  • The ebp+0x40 corresponds to the second argument
  • f the NtQueryIntervalProfile where we put the

address of our shellcode

slide-85
SLIDE 85

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Getting execution

  • We can write the address of something we don’t

control but we control the contents of the first pointer in it: it’s the address of our next element in the list

  • We can write in the HalDispatchTable our pointer on

the next will be considered as code when calling the function.

  • So we need an address which is a valid pointer for

the bFlatten loop and a valid code for execution like inc eax ; 0x40 jmp dword ptr [ ebp+0x40 ] ; 0xff6540

  • We will rewrite the HALDispatchTable[1], called by

NtQueryIntervalProfile and not used for a lot of other things

  • The ebp+0x40 corresponds to the second argument
  • f the NtQueryIntervalProfile where we put the

address of our shellcode

slide-86
SLIDE 86

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Getting execution

slide-87
SLIDE 87

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Chronology

  • Get the addresses in the kernel we need for the

exploit (HALDispatchTable, . . . )

  • Allocate three structs PATHRECORD that we need,

in particular the one at a precise address (0x4065ff40)

  • Put memory pressure
  • Put the address of our first PATHRECORD that we

want into the freelist

  • Flatten the path => write in the HALDispatchTable
  • Call NtQueryIntervalProfile => get shellcode

executed

slide-88
SLIDE 88

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Chronology

  • Get the addresses in the kernel we need for the

exploit (HALDispatchTable, . . . )

  • Allocate three structs PATHRECORD that we need,

in particular the one at a precise address (0x4065ff40)

  • Put memory pressure
  • Put the address of our first PATHRECORD that we

want into the freelist

  • Flatten the path => write in the HALDispatchTable
  • Call NtQueryIntervalProfile => get shellcode

executed

slide-89
SLIDE 89

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Chronology

  • Get the addresses in the kernel we need for the

exploit (HALDispatchTable, . . . )

  • Allocate three structs PATHRECORD that we need,

in particular the one at a precise address (0x4065ff40)

  • Put memory pressure
  • Put the address of our first PATHRECORD that we

want into the freelist

  • Flatten the path => write in the HALDispatchTable
  • Call NtQueryIntervalProfile => get shellcode

executed

slide-90
SLIDE 90

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Chronology

  • Get the addresses in the kernel we need for the

exploit (HALDispatchTable, . . . )

  • Allocate three structs PATHRECORD that we need,

in particular the one at a precise address (0x4065ff40)

  • Put memory pressure
  • Put the address of our first PATHRECORD that we

want into the freelist

  • Flatten the path => write in the HALDispatchTable
  • Call NtQueryIntervalProfile => get shellcode

executed

slide-91
SLIDE 91

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Chronology

  • Get the addresses in the kernel we need for the

exploit (HALDispatchTable, . . . )

  • Allocate three structs PATHRECORD that we need,

in particular the one at a precise address (0x4065ff40)

  • Put memory pressure
  • Put the address of our first PATHRECORD that we

want into the freelist

  • Flatten the path => write in the HALDispatchTable
  • Call NtQueryIntervalProfile => get shellcode

executed

slide-92
SLIDE 92

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Chronology

  • Get the addresses in the kernel we need for the

exploit (HALDispatchTable, . . . )

  • Allocate three structs PATHRECORD that we need,

in particular the one at a precise address (0x4065ff40)

  • Put memory pressure
  • Put the address of our first PATHRECORD that we

want into the freelist

  • Flatten the path => write in the HALDispatchTable
  • Call NtQueryIntervalProfile => get shellcode

executed

slide-93
SLIDE 93

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Plan

6

Conclusion

slide-94
SLIDE 94

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Conclusion

  • A lot of improvements between XP and Windows 8
  • Lot of checks so exploits are really harder
  • Still doable
slide-95
SLIDE 95

A look inside the Windows Kernel Bruno Pujos Introduction Basics of Windows Kernel CVE-2011-1237 Evolution from XP to 8 CVE-2013-3660 Conclusion

Questions ? Questions ?

  • Tarjei Mandt (@kernelpool)
  • Tavis Ormandy (@taviso)
  • Mateusz Jurvczyk (@j00ru)
  • Alex Ionescu (@aionescu)
  • Ivanlefou (@Ivanlef0u)