BREEDING SANDWORMS: HOW TO FUZZ YOUR WAY OUT OF ADOBE READER X'S - - PowerPoint PPT Presentation

▶
breeding sandworms
SMART_READER_LITE
LIVE PREVIEW

BREEDING SANDWORMS: HOW TO FUZZ YOUR WAY OUT OF ADOBE READER X'S - - PowerPoint PPT Presentation

May 15, 2023 110 likes •652 views

BREEDING SANDWORMS: HOW TO FUZZ YOUR WAY OUT OF ADOBE READER X'S SANDBOX Who we are Research and Analysis: Zhenhua(Eric) Liu Vulnerability Researcher zhliu@fortinet.com Contributor and Editor: Guillaume Lovet Sr Manager of Fortinet's

slide-1
SLIDE 1

BREEDING SANDWORMS:

HOW TO FUZZ YOUR WAY OUT OF ADOBE READER X'S SANDBOX

slide-2
SLIDE 2
  • Research and Analysis: Zhenhua(Eric) Liu

Vulnerability Researcher zhliu@fortinet.com

  • Contributor and Editor: Guillaume Lovet

Sr Manager of Fortinet's EMEA Threat Research and Response Center glovet@fortinet.com

Who we are

slide-3
SLIDE 3

Huge number of vulnerabilities been found

Adobe vulnerabilities history in CVE. http://www.cvedetails.com/vendor/53/Adobe.html

slide-4
SLIDE 4

Huge number of vulnerabilities been found

Big Fan of you,

  • Mr. Ormandy
slide-5
SLIDE 5

How many of them can compromise Adobe Reader X?

Since its launch in November 2010, we have not seen a single successful exploit in the wild against Adobe Reader X.

slide-6
SLIDE 6

All because of Protected Mode (SandBox)

Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.

slide-7
SLIDE 7

How Hard Actually?

http://blogs.adobe.com/asset/files/2010/11/Win7- Sandbox-Exploit-Steps.png

slide-8
SLIDE 8
  • Introduce to the Adobe Reader X Protected

Mode

  • The SandBox implementation
  • Fuzz Broker APIs
  • Bypass the Challenge
  • Demo
  • Conclusions and Future Work

Agenda

slide-9
SLIDE 9
  • The most complete and authoritative

documentation one can find about Adobe Reader Protect Mode is the series of blogs written by Kyle Randolph from ASSET.

Documentation

slide-10
SLIDE 10

Sandbox INTERNALS from ASSET’s blog

http://blogs.adobe.com/asset/files/2010/10/Sandbox- Diagrams3.png

slide-11
SLIDE 11

Blood and Sand: At the heart of Adobe Reader's sandbox

http://blogs.adobe.com/asset/files/2010/11/Sandbox- and-Broker-Process-IPC.png

slide-12
SLIDE 12
  • Attacks From Kernel Land
  • Attacks From User Land
  • - Broker API Attack Surface
  • - Policy Engine
  • - IPC Frame Work
  • - Named Object Squatting Attacks
  • - Plug-in that not been sandboxed.
  • - And more… which will be discovered by you.

Possible Avenues to Achieve Attack

slide-13
SLIDE 13

Attacks From Kernel Land

Can we subvert the token pointer？

slide-14
SLIDE 14

“An example is the dialog that confirms if the user really wants to disable Protected Mode”

Motivations and Questions

Hello from our old friend. We start from `hello` for respective.

slide-15
SLIDE 15
  • 1: Are there logic flaws, or weaknesses, that

could be leveraged to circumvent restrictions?

  • 2: Are there memory corruption

vulnerabilities?

Audit Target

slide-16
SLIDE 16
  • Find “thread_provider_->RegisterWait”
  • Find function “ThreadPingEventReady” and

the important parameter “service_context”.

  • Find IPC message dispatch mechanism

through ThreadPingEventReady, and then find the entire IPC handler functions.

The strategy for reversing 1

slide-17
SLIDE 17

RegisterWaitForSingleObject(&pool_object, waitable_object, callback, context, INFINITE, WT_EXECUTEDEFAULT )

Important data structures

slide-18
SLIDE 18

service_context：

  • +0h Ping handle
  • +4h pong handle
  • +8h channel_size
  • +Ch channel_buffer
  • +10h shared_base
  • +14h channel
  • +18h dispatcher
  • +1Ch target_info

Important data structures

slide-19
SLIDE 19

The result

slide-20
SLIDE 20
  • find out the “HOOK” function first, then

enumerate entire broker IPC by “xrefs” function of IDApro. (for Client API)

  • Characteristic string like

“AcroWinMainSandbox”. (for Client API)

  • Serach pattern strings in .data section of file

“AcroRd32.exe”. (for handler API)

The strategy for reversing 2

slide-21
SLIDE 21

You are so beautiful

Following `AcroWinMainSandbox`, we find Adobe Service APIs list. (Client side)

slide-22
SLIDE 22

Broker API tag 0x3E is to disable Protected Mode.

if ( MessageBoxW(hWnd, "..", "..", 0x34) == 6 ) { hKey = 0; ret = RegCreateKeyW ( HKEY_CURRENT_USER, L"Software\\Adobe\\Acrobat Reader\\ 10.0\\Privileged", &hKey); ...

slide-23
SLIDE 23

Practice for fun

Tag field 0x3E means to “disable Protected Mode”

slide-24
SLIDE 24

Practice for fun

With a pop confirmation dialogs out

slide-25
SLIDE 25

Another Practice For Fun

Tag field 0x43 means to open http link using default explorer under High Integrity. http://10.10.1.127/1.exe

slide-26
SLIDE 26

Another Practice For Fun

1.exe is a POC file which doing operation in file system

slide-27
SLIDE 27

Another Practice For Fun

And another confirmation dialog pop out

slide-28
SLIDE 28
  • The needs
  • The existing idea that meets needs

Fuzz Broker APIs

slide-29
SLIDE 29
  • In particular, the “in memory fuzz” concept

introduced by Michael Sutton in a famous book“Fuzzing: Brute Force Vulnerability Discovery”fits our requirements.

The exits idea that meets needs

slide-30
SLIDE 30

Why we focused Broker Service APIs

  • We guess APIs inherited from Google’s

Chrome have been researched a lot by many researchers.

  • Continuously increased Broker Service APIs by

Adobe.

slide-31
SLIDE 31

Why we focused Broker Service APIs

63 Broker Service Dispatchers were found in AcroRd32.exe 10.0.1.434 72 Broker Service Dispatchers were found in AcroRd32.exe 10.1.1.33

slide-32
SLIDE 32

In Memory Fuzzer POC: How it works

第 32 页

Step 1 Step 2 Step 3 Step 4 Step 5 Take snapshot for sandboxed process before sending the IPC message Stuff fuzzing data into the IPC Message Send the IPC Message Wait for the broker process to handle the IPC message Restore snapshot of sandboxed process

slide-33
SLIDE 33

In Memory Fuzzer POC: How it works

Step 1 Step 2 Step 3 Step 4 Step 5 Take snapshot for sandboxed process before sending the IPC message Stuff fuzzing data into the IPC Message Send the IPC Message Wait for the broker process to handle the IPC message Restore snapshot of sandboxed process Repeat step 2 - 5 until fuzz data exhausted

slide-34
SLIDE 34

Prepare the “Smarter ” Fuzz Data

Example: strings in policy rules.

slide-35
SLIDE 35

Pop Pop and Pop XD

Which means the relative Broker API have been achieved.

slide-36
SLIDE 36
  • It was patched by Adobe in September 2011

as a result of our responsible disclosure action

  • World is small

Mark Yason and Paul Sabanal of IBM X-Force have also found this vulnerability.

The Vulnerability CVE-2011-1353

slide-37
SLIDE 37
  • AddRule( SUBSYS_REGISTRY,

REG_DENY, "HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Privileged" );

  • AddRule( SUBSYS_REGISTRY,

REG_ALLOW_ANY, "HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0" );

See the Problem?

slide-38
SLIDE 38
  • AddRule( SUBSYS_REGISTRY,

REG_DENY, "HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Privileged" );

  • AddRule( SUBSYS_REGISTRY,

REG_ALLOW_ANY, "HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0" );

See the Problem?

slide-39
SLIDE 39
  • HKEY_CURRENT_USER\Software\Adobe\Acro

bat Reader\10.0\\Privileged\bProtectedMode

Magic String

slide-40
SLIDE 40

CVE-2011-1353

Sandbox Process Broker Process

Policy Engine

CreateRegKey Request

OS

slide-41
SLIDE 41

CVE-2011-1353

Sandbox Process Broker Process

Policy Engine

OS

Good Boy?

slide-42
SLIDE 42

CVE-2011-1353

Sandbox Process Broker Process

Policy Engine False Positive

OS

Good Boy

slide-43
SLIDE 43

CVE-2011-1353

Sandbox Process Broker Process

Policy Engine

OS

What Can I Do for you?

slide-44
SLIDE 44

CVE-2011-1353

Sandbox Process Broker Process

Policy Engine

OS

Return Duplicated Handle

slide-45
SLIDE 45

The patch and little bit more

New function “CanonPathName” added to Strip off the extra backslash. while ( *Cp != '\' ); do { Cp++; }

slide-46
SLIDE 46

Demo

slide-47
SLIDE 47

Conclusions and Future Work

slide-48
SLIDE 48

The Road To The Horizon

slide-49
SLIDE 49

The Road To The Horizon

APSAs Like CVE-2011-3232 in the Demo.

slide-50
SLIDE 50

The Road To The Horizon

Heap Spray, ROP, Heap FengShui, JIT, Haifei Li’s Flash ActionScript Exploit…

slide-51
SLIDE 51

The Road To The Horizon

CVE-2011-1353

slide-52
SLIDE 52

Free!