Breaking Turtles All the Way Down An Exploit Chain to Break Out of - - PowerPoint PPT Presentation

▶
breaking turtles all the way down
SMART_READER_LITE
LIVE PREVIEW

Breaking Turtles All the Way Down An Exploit Chain to Break Out of - - PowerPoint PPT Presentation

Jun 11, 2023 321 likes •701 views

Breaking Turtles All the Way Down An Exploit Chain to Break Out of VMware ESXi Hanqing Zhao, Yanyu Zhang , Kun Yang, Taesoo Kim Chaitin Security Research Lab Georgia Institute of Technology Tsinghua University 1 What is ESXi? Bare-metal

slide-1
SLIDE 1

Breaking Turtles All the Way Down

An Exploit Chain to Break Out of VMware ESXi

Hanqing Zhao, Yanyu Zhang, Kun Yang, Taesoo Kim

Chaitin Security Research Lab Georgia Institute of Technology Tsinghua University

1

slide-2
SLIDE 2

What is ESXi?

2

  • Bare-metal hypervisor
  • Widely used in private cloud
slide-3
SLIDE 3

VMM

What is VM Escape?

3

Guest OS Guest OS 1 Guest OS N ... Host OS

exploitation

Excute arbitrary codes

  • n the host

network connection

...

slide-4
SLIDE 4

Attack I/O devices

4

(Pwn2Own 2019)

Graphic Ethernet USB SATA SCSI COM

(TianfuCup 2018) (Pwn2Own 2017)

Several Workstation escape have been demonstrated

slide-5
SLIDE 5

No ESXi Escape? What makes it so challenging?

5

(Pwn2Own 2019)

Graphic Ethernet USB SATA SCSI COM

(TianfuCup 2018) (Pwn2Own 2017)

There has been no escape of

ESXi !!!

slide-6
SLIDE 6

The customized architecture has not been studied

6

VMX guest OS VMM #VM-exit #VM launch #VM resume USER API virtual hardwares RPC handlers

RPC PIO/ MMIO VM-Exit handlers

  • VMKernel

○ VMM(hypervisor) ○ User world API ○ VMFS ○ Drivers

  • VMX Process

○ Virtual hardwares ○ RPC handlers

VMKernel

Physical Hardware Sandbox

slide-7
SLIDE 7

Limited attack surfaces

7

VMX guest OS VMM #VM-exit #VM launch #VM resume USER API host Ring3 host Ring0 virtual hardwares RPC handlers

RPC I/O VM-Exit handlers

  • VM-Exit handlers
  • Virtual Hardwares
  • RPC
  • compact VMX

process

Sandbox

slide-8
SLIDE 8

Challenging mitigations and protections

8

VMX guest OS VMM #VM-exit #VM launch #VM resume USER API host Ring3 host Ring0 virtual hardwares RPC handlers

RPC PIO/ MMIO VM-Exit handlers

  • ASLR
  • NX/DEP
  • sandboxing

Sandbox

slide-9
SLIDE 9

Overview: VulnerabilitIes and Exploitation

9

VMX Uninitialized Stack Usage (CVE-2018-6981) Uninitialized Stack Read (CVE-2018-6982) Sandbox

slide-10
SLIDE 10

Overview: VulnerabilitIes and Exploitation

10

VMX Uninitialized Stack Usage → Arbitrary Address Free Uninitialized Stack Read → Information Leakage Sandbox

slide-11
SLIDE 11

Overview: VulnerabilitIes and Exploitation

11

VMX Uninitialized Stack Usage → Arbitrary Address Free Uninitialized Stack Read → Information Leakage Arbitrary Shellcode Execution in VMX process Sandbox

slide-12
SLIDE 12

Overview: VulnerabilitIes and Exploitation

12

VMX Uninitialized Stack Usage → Arbitrary Address Free Uninitialized Stack Read → Information Leakage Arbitrary Shellcode Execution in VMX process Sandbox VMX

Sandbox Escape

slide-13
SLIDE 13

CVE-2018-6981: Uninitialized Stack Variable

void __usercall vmxnet3_reg_cmd() { ... case 4: // VMXNET3_CMD_UPDATE_MAC_FILTERS * dma_memory_create(..., &page); vmxnet3_cmd_update_mac_filters(v6, &page, a5); * destruct_page_struct(&page); } break; ... } char __fastcall dma_memory_create(unsigned addr, uint64 size, …, page_struct *page) { // check the addr * if ( addr > v5 || !size || size > v5 - addr + 1 ) * return 0; set_page_struct(addr, size, a3, a4, page); return 1; }

13

void destruct_page_struct(page_struct *a1) { if(page_count == 1) free(a1->addr) // free the pointer on stack else free(a1->page_array); }

translate_size page_offset page_count addr page_array ... 0x10 0x18 a struct on stack for address translation

page

slide-14
SLIDE 14

CVE-2018-6981: Uninitialized Stack Variable

void __usercall vmxnet3_reg_cmd() { ... case 4: // VMXNET3_CMD_UPDATE_MAC_FILTERS * dma_memory_create(..., &page); vmxnet3_cmd_update_mac_filters(v6, &page, a5); * destruct_page_struct(&page); } break; ... } char __fastcall dma_memory_create(unsigned addr, uint64 size, …, page_struct *page) { // check the addr * if ( addr > v5 || !size || size > v5 - addr + 1 ) * return 0; set_page_struct(addr, size, a3, a4, page); return 1; }

14

void destruct_page_struct(page_struct *a1) { if(page_count == 1) free(a1->addr) // free the pointer on stack else free(a1->page_array); }

translate_size page_offset page_count addr page_array ... 0x10 0x18 a struct on stack for address translation

page

try to initialize the “page” structure on stack

slide-15
SLIDE 15

CVE-2018-6981: Uninitialized Stack Variable

void __usercall vmxnet3_reg_cmd() { ... case 4: // VMXNET3_CMD_UPDATE_MAC_FILTERS * dma_memory_create(..., &page); vmxnet3_cmd_update_mac_filters(v6, &page, a5); * destruct_page_struct(&page); } break; ... } char __fastcall dma_memory_create(unsigned addr, uint64 size, …, page_struct *page) { // check the addr * if ( addr > v5 || !size || size > v5 - addr + 1 ) * return 0; set_page_struct(addr, size, a3, a4, page); return 1; }

15

void destruct_page_struct(page_struct *a1) { if(page_count == 1) free(a1->addr) // free the pointer on stack else free(a1->page_array); }

translate_size page_offset page_count addr page_array ... 0x10 0x18

page

a struct on stack for address translation

check the size and addr

slide-16
SLIDE 16

CVE-2018-6981: Uninitialized Stack Variable

void __usercall vmxnet3_reg_cmd() { ... case 4: // VMXNET3_CMD_UPDATE_MAC_FILTERS * dma_memory_create(..., &page); vmxnet3_cmd_update_mac_filters(v6, &page, a5); * destruct_page_struct(&page); } break; ... } char __fastcall dma_memory_create(unsigned addr, uint64 size, …, page_struct *page) { // check the addr * if ( addr > v5 || !size || size > v5 - addr + 1 ) * return 0; set_page_struct(addr, size, a3, a4, page); return 1; }

16

void destruct_page_struct(page_struct *a1) { if(page_count == 1) free(a1->addr) // free the pointer on stack else free(a1->page_array); }

translate_size page_offset page_count addr page_array ... 0x10 0x18

page

a struct on stack for address translation

illegal combination! skip initalization

initialization

slide-17
SLIDE 17

void __usercall vmxnet3_reg_cmd() { ... case 4: // VMXNET3_CMD_UPDATE_MAC_FILTERS * dma_memory_create(..., &page); vmxnet3_cmd_update_mac_filters(v6, &page, a5); * destruct_page_struct(&page); } break; ... } char __fastcall dma_memory_create(unsigned addr, uint64 size, …, page_struct *page) { // check the addr * if ( addr > v5 || !size || size > v5 - addr + 1 ) * return 0; set_page_struct(addr, size, a3, a4, page); return 1; }

CVE-2018-6981: Uninitialized Stack Variable

17

void destruct_page_struct(page_struct *a1) { if(page_count == 1) free(a1->addr) // free the pointer on stack else free(a1->page_array); }

translate_size page_offset page_count addr page_array ... 0x10 0x18

page

a struct on stack for address translation

return and enter into the “destruct” function

initialization

slide-18
SLIDE 18

void destruct_page_struct (page_struct *a1) { … // free the pointer on stack free(a1->page_array); }

void __usercall handle_port_io(__int64 a1, __int64 a2, __int64 a3) { ... v3 = *(a1 + 4); v4 = *(a1 + 13); read_or_write = *(a1 + 48); ... if ( *(a1 + 60) && (v10 = *(a1 + 52) << 12, v10 > 0x8000) ) v11 = malloc_heap_memory(v10); // copy the data into heap else v11 = &v35; if ( read_or_write & 1 ) { if ( *(v8 + 60) ) { ... v15 = v11; do { ... memcpy(v15, v18, v17); // copy the data into stack ...

Uninit Variable → Arbitrary Address Free

18

Abusing a function to spray stack!

18

translate_size page_offset page_count addr page_array ... 0x10 0x18

slide-19
SLIDE 19

bool __fastcall vmxnet3_cmd_get_coalesce(__int64 a1, char a2){ struct buffer { uint64_t member0; uint64_t member1; }; size_t length; ... get_length_from_guest(..., &length); if(length != 16) return; ... * buffer.member0 = 0xFA000000003LL; // first 8-byte of src is initialized, but 16-byte is read // (length == 16) * write_back_to_guest(v19, &buffer, length, ...); return 1; } ... }

CVE-2018-6982: Uninitialized Stack Variable

19

At first, all stack variables are uninitlized

slide-20
SLIDE 20

bool __fastcall vmxnet3_cmd_get_coalesce(__int64 a1, char a2){ struct buffer { uint64_t member0; uint64_t member1; }; size_t length; ... get_length_from_guest(..., &length); if(length != 16) return; ... * buffer.member0 = 0xFA000000003LL; // first 8-byte of src is initialized, but 16-byte is read // (length == 16) * write_back_to_guest(v19, &buffer, length, ...); return 1; } ... }

CVE-2018-6982: Uninitialized Stack Variable

20

set length must be 16

slide-21
SLIDE 21

bool __fastcall vmxnet3_cmd_get_coalesce(__int64 a1, char a2){ struct buffer { uint64_t member0; uint64_t member1; }; size_t length; ... get_length_from_guest(..., &length); if(length != 16) return; ... * buffer.member0 = 0xFA000000003LL; // first 8-byte of src is initialized, but 16-byte is read // (length == 16) * write_back_to_guest(v19, &buffer, length, ...); return 1; } ... }

CVE-2018-6982: Uninitialized Stack Variable

21

initialize the first 8-byte

slide-22
SLIDE 22

bool __fastcall vmxnet3_cmd_get_coalesce(__int64 a1, char a2){ struct buffer { uint64_t member0; uint64_t member1; }; size_t length; ... get_length_from_guest(..., &length); if(length != 16) return; ... * buffer.member0 = 0xFA000000003LL; // first 8-byte of src is initialized, but 16-byte is read // (length == 16) * write_back_to_guest(v19, &buffer, length, ...); return 1; } ... }

CVE-2018-6982: Uninitialized Stack Variable

22

member1(uninitilized) will be write back to the guest OS

slide-23
SLIDE 23

Abusing a special RPC named “backdoor”

23

  • A special hypercall
  • Guest

○ Send messages through special I/O ports

  • Host

○ Handle messages in VMX process

slide-24
SLIDE 24

Abusing RPCI to manipulate heap

24

  • Controllable size
  • Controllable buffer

Heap Buffer N size N Heap Buffer N+1 data ptr N size N size N+1 data ptr N+1 size N+1

slide-25
SLIDE 25

Abusing the feature of heap

  • Main idea

○ fake a fast chunk on metadata

  • Constraints

○ check current chunk’s size ○ check next chunk’s size

25

size N+1

slide-26
SLIDE 26

Abusing the feature of heap

  • Main idea

○ fake a fast chunk on metadata

  • Constraints

○ check current chunk’s size ○ check next chunk’s size

26

size N+1 Free the fake chunk

slide-27
SLIDE 27

Abusing the feature of heap

  • Main idea

○ fake a fast chunk on metadata

  • Constraints

○ check current chunk’s size ○ check next chunk’s size

27

Free the fake chunk size N size N+1

slide-28
SLIDE 28
  • Main idea

○ fake a fast chunk on metadata

  • Constraints

○ check current chunk’s size ○ check next chunk’s size

Abusing the feature of heap

28

Free the fake chunk size N size N+2 Channel N+2 size N+1

slide-29
SLIDE 29

fake chunk → fastbin linklist

29

  • ther real fast chunks

The fake chunk will be put into the heap fastbin

slide-30
SLIDE 30

Reallocate the fake chunk with another channel

30

another backdoor channel

slide-31
SLIDE 31

Overwrite the next channel’s pointer

31

another backdoor channel .got.plt foo’s .got.plt bar’s .got.plt

slide-32
SLIDE 32

Control Flow Hijacking through the next channel

32

another backdoor channel .got.plt ROP gadget bar’s .got.plt

slide-33
SLIDE 33

Bypass the sandbox

  • A loophole in the sandbox profile

○ The sandbox grants us to read and write the /var/run directory

  • We overwrite the inetd.conf file and bind a

specific port to /bin/bash

33

slide-34
SLIDE 34

# Internet server configuration database # Remote shell access ssh stream tcp nowait root /usr/lib/vmware/openssh/bin/sshd ... ssh stream tcp6 nowait root /usr/lib/vmware/openssh/bin/sshd ... authd stream tcp nowait root /bin/sh ... authd stream tcp6 nowait root /bin/sh ...

Bypass the sandbox

34

slide-35
SLIDE 35

Get Shell

  • Restart the inetd process

○ Reboot ○ Kill the process ■ The watchdog helps us to restart the process

35

VMFS reboot backup firmware copy from the firmware recover inetd.conf host OS

slide-36
SLIDE 36

Success Rate

  • ESXi 6.7:

○ MAX: 93.3% ○ AVG: 90.0%

  • Failing Reasons

○ stack pollution ○ heap stability

36

slide-37
SLIDE 37

Thanks!

37