GDI Font Fuzzing in Windows Kernel for Fun Kernel for Fun Lee Ling - - PowerPoint PPT Presentation

▶
gdi font fuzzing in windows kernel for fun kernel for fun
SMART_READER_LITE
LIVE PREVIEW

GDI Font Fuzzing in Windows Kernel for Fun Kernel for Fun Lee Ling - - PowerPoint PPT Presentation

Feb 16, 2023 123 likes •788 views

GDI Font Fuzzing in Windows Kernel for Fun Kernel for Fun Lee Ling Chuan & Chan Lee Yee Ministry of Science, Technology and Innovation Agenda Agenda Introduction TrueType Font (.TTF) TTF Fuzzer Exploit Demonstration MS11

slide-1
SLIDE 1

GDI Font Fuzzing in Windows Kernel for Fun Kernel for Fun

Lee Ling Chuan & Chan Lee Yee

Ministry of Science, Technology and Innovation

slide-2
SLIDE 2

Agenda Agenda

  • Introduction
  • TrueType Font (.TTF)
  • TTF Fuzzer
  • Exploit Demonstration – MS11‐087
  • Microsoft Windows Bitmapped font ( fon)

Microsoft Windows Bitmapped font (.fon)

  • FON Fuzzer (by Byoungyoung Lee) with some

modification modification

  • Exploit Demonstration – MS11‐077

3/16/2012 2

slide-3
SLIDE 3

Introduction Introduction

  • Two groups of categories are exist:
  • g oups o catego es a e e st:
  • a. GDI Fonts
  • b. Device Fonts
  • b. Device Fonts
  • GDI fonts which are based in Windows consists of

three types: yp

  • a. raster
  • b. Vector
  • c. TrueType & OpenType

Reference: http://msdn microsoft com/en us/library/dd162893(v=vs 85) aspx Reference: http://msdn.microsoft.com/en‐us/library/dd162893(v=vs.85).aspx

3/16/2012 3

slide-4
SLIDE 4

Introduction… Introduction…

  • Raster fonts: a glyph is a bitmap that uses to

Raster fonts: a glyph is a bitmap that uses to draw a single character in the font

  • Vector fonts: a glyph is a collection of line
  • Vector fonts: a glyph is a collection of line

endpoints that define the line segments and uses to draw a character in the font uses to draw a character in the font

  • TrueType & OpenType fonts: a glyph is a

ll i f li d d ll collection of line and curve commands as well as a collection of hints

3/16/2012 4

slide-5
SLIDE 5

TrueType Fonts (.TTF) TrueType Fonts (.TTF)

  • TrueType font file contains data, in table

TrueType font file contains data, in table format, that compromises an outline font

  • The outlines of glyphs in TrueType fonts are

The outlines of glyphs in TrueType fonts are made of straight line segments and quadratic Bézier curves

  • The Windows scale these fonts to any size

using the hints inside the TTF file.

  • Hints included in TTF files and are used to

correct oversights

3/16/2012 5

slide-6
SLIDE 6

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • TTF table is designed to keep the entire glyph

TTF table is designed to keep the entire glyph data in various table: a EBDT: Embedded Bitmap Data Table

  • a. EBDT: Embedded Bitmap Data Table
  • b. EBLC: Embedded Bitmap Location Table

EBSC E b dd d Bit S li T bl

  • c. EBSC: Embedded Bitmap Scaling Table
  • The rasterizer uses combination of data from

diff t t d th l h d t i th f t differents to render the glyph data in the font

R f T T 1 0 F Fil T h i l S ifi i R i i 1 66 A 1995 Mi f Reference: TrueType 1.0 Font File, Technical Specification Revision 1.66 August 1995 Microsoft

3/16/2012 6

slide-7
SLIDE 7

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • TrueType embedded bitmaps are also called

TrueType embedded bitmaps are also called ‘scaler bitmaps’ or ‘sbits’

  • A set of bitmaps for a face at a given size is
  • A set of bitmaps for a face at a given size is

called a strike

3/16/2012 7

slide-8
SLIDE 8

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

TTF Font Structure

3/16/2012 8

.TTF Font Structure

slide-9
SLIDE 9

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • EBDT – Embedded Bitmap Data Table:

EBDT Embedded Bitmap Data Table:

  • a. EBDT table stores the glyph bitmap data.

b h ‘ ’ bl b i i h h d

  • b. The ‘EBDT’ table begins with a header

containing simply the table version number

  • c. The rest of the ‘EBDT’ table is a collection of

bitmap data bitmap data

3/16/2012 9

slide-10
SLIDE 10

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

EBDT Table Structure

3/16/2012 10

EBDT Table Structure

slide-11
SLIDE 11

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • EBLC – Embedded Bitmap Location Table:
  • a. The ‘EBLC’ table identifies the sizes and glyph

range of the sbits, and keeps offsets to glyph bit d t i i d S bT bl bitmap data in indexSubTables

  • b. The ‘EBLC’ table begins with a header

(eblcHeader) containing the table version and (eblcHeader) containing the table version and number of strikes.

  • c. The eblcHeader is followed by the

bitmapSizeTable array(s)

  • d. Each strike is defined by one bitmapSizeTable

3/16/2012 11

slide-12
SLIDE 12

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

3/16/2012 12

EBLC Table Structure

slide-13
SLIDE 13

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • EBSC – Embedded Bitmap Scaling Table:

p g

  • a. The ‘EBSC’ table allows a font to define a

bitmap strike as a scaled version of another strike

  • b. The table begins with a header (ebscHeader)

containing the table version and number of strikes

  • c. The ebscHeader is followed immediately by the

bitmapScaleTable array. The numSizes in the b H d i di t th b f ebscHeader indicates the number of bitmapScaleTables in the array d Each strike is defined by one bitmapScaleTable

  • d. Each strike is defined by one bitmapScaleTable

3/16/2012 13

slide-14
SLIDE 14

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

3/16/2012 14

EBSC Table Structure

slide-15
SLIDE 15

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • Glyph Data (glyf)

a This table contains information that

  • a. This table contains information that

describes the glyphs in the font

  • b. Table provides instructions for each of the following

tasks: ‐ Pushing data onto the interpreter stack managing the Storage Area ‐ managing the Storage Area ‐ managing the Control Value Table ‐ modifying Graphics State settings y g p g ‐ Managing outlines ‐ General purpose instructions

3/16/2012 15

slide-16
SLIDE 16

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • TrueType instructions are uniquely specified by

th i d their opcodes. GLYFDirectoryEntry ‐> DataGLYFData[x+1]‐> SimpleGLYFData[x]‐> instructions

  • Examples: Pushing data onto the interpreter stack

– function[0xB0]: itrp_PUSHB1 p_ – function[0xB8]: itrp_PUSHW1

3/16/2012 16

slide-17
SLIDE 17

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • Examples: Managing the flow of control

f ti [0 1C] it JMPR ‐ function[0x1C]: itrp_JMPR ‐ function[0x1F]: itrp_LSW ‐ function[0x78]: itrp JROT function[0x78]: itrp_JROT

  • Examples: Managing the stack

‐ function[0x20]: itrp_DUP ‐ function[0x23]: itrp_SWAP

  • Examples: Managing the Storage Area

function[0x43]: itrp RS ‐ function[0x43]: itrp_RS ‐ function[0x42]: itrp_WS

3/16/2012 17

slide-18
SLIDE 18

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • Examples: Managing the Control Value Table

‐ function[0x44]: itrp_WCVT ‐ function[0x45]: itrp_RCVT

  • Examples: Managing the Graphics State
  • Examples: Managing the Graphics State

‐ function[0x4D]: itrp_FLIPON ‐ function[0x4E]: itrp_FLIPOFF

  • Examples: Arithmetic Functions

‐ function[0x60]: itrp_ADD ‐ function[0x61]: itrp SUB function[0x61]: itrp_SUB

Reference: Chapter Appendix B, TrueType 1.0 Font File, Technical Specification Revision 1.66 August 1995 Microsoft

3/16/2012 18

slide-19
SLIDE 19

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • Important info (1) in exploitation:

Important info (1) in exploitation:

structure fnt_GlobalGraphicStateType{ stackBase; /*the stack area stackBase; / the stack area store; /*the storage area controlValueTable; /*the control value table …… int8 non90DegreeTransformation /*bit0: 1 if non‐90 degree /*bit 1:1 if x scale not equal y scale …… unit16 cvtCount; } fnt_GlobalGraphicStateType;

3/16/2012 19

slide-20
SLIDE 20

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

  • Important info (2) in exploitation:

p ( ) p ‐ function ‘itrp_InnerExecute’ as the disassembler engine to process Glyph Data and map to correct TrueType instructions TrueType instructions

  • fnt_GlobalGraphicStateType:

+0 : stackBase +0 : stackBase +4: store +8: controlValueTable +8: controlValueTable +90h: non90DegreeTransformation +134h: cvtCount

3/16/2012 20

slide-21
SLIDE 21

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

3/16/2012 21

The TrueType Instruction Set

slide-22
SLIDE 22

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

itrp_InnerExecute

3/16/2012 22

Glyph data in hexadicimal format

slide-23
SLIDE 23

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

itrp_InnerExecute

3/16/2012 23

Glyph data in hexadicimal format

slide-24
SLIDE 24

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

itrp_InnerExecute

;Function[0xB0]: itrp_PUSHB1 ;’00’ is parameter of the instruction

3/16/2012 24

Glyph data in hexadicimal format

slide-25
SLIDE 25

TrueType Fonts (.TTF)… TrueType Fonts (.TTF)…

itrp_PUSHB1

;ecx: parameter ‘00’ ;esi: pointer structure fnt_GlobalGraphicStateType+0

3/16/2012 25

Glyph data in hexadicimal format

slide-26
SLIDE 26

TTF Fuzzer TTF Fuzzer

  • TTF font fuzzer is created to fuzz the TTF font into

different sizes

  • In GDI, we can create a font by:
  • a. filling in a LOGFONT structure
  • b. calling ‘CreateFontIndirect’ which returns a

font handle (HFONT) W k ith f t t l l l th h f t

  • c. Work with fonts at a lower level through font

APIs: GetFontData, GetGlyphIndices, ExtTextOut with ETO_GLYPH_INDEX flag _ _ g

Reference: http://blogs.msdn.com/b/text/archive/2009/04/15/introducing‐the‐ directwrite‐font‐system.aspx

3/16/2012 26

slide-27
SLIDE 27

TTF Fuzzer TTF Fuzzer

  • The overall process of the fuzzer:

a automating the installation of the crafted

  • a. automating the installation of the crafted

font in ‘C:\WINDOWS\Fonts’ folder

h dll d dd (f l ) htr=windll.gdi32.AddFontResourceExA(fileFont, FR_PRIVATE, None)

  • b. Register a window class and creating a new

window to automate the display of the font window to automate the display of the font text in a range of font size c Remove the fonts in ‘C:\WINDOWS\Fonts’

  • c. Remove the fonts in C:\WINDOWS\Fonts

folder

windll.gdi32.RemoveFontResourceExW(fileFont, FR PRIVATE, None) windll.gdi32.RemoveFontResourceExW(fileFont, FR_PRIVATE, None)

3/16/2012 27

slide-28
SLIDE 28

TTF Fuzzer TTF Fuzzer

  • A range of font size

lf=win32gui.LOGFONT() for fontsize in range (0, 100, 1): lf.lfHeight=fontsize lf.lfFaceName="Dexter" lf lf d h lf.lfWidth=0 lf.lfEscapement=0 lf.lfOrientation=0 lf lfWeight=FW NORMAL lf.lfWeight=FW_NORMAL lf.lfItalic=False lf.lfUnderline=False lf lfStrikeOut=False lf.lfStrikeOut False lf.lfCharSet=DEFAULT_CHARSET lf.lfOutPrecision=OUT_DEFAULT_PRECIS lf.lfClipPrecision=CLIP_DEFAULT_PRECIS f f p _ _ lf.lfPitchAndFamily=DEFAULT_PITCH|FF_DONTCARE

3/16/2012 28

slide-29
SLIDE 29

TTF Fuzzer TTF Fuzzer

  • Calling physical font APIs and display the

font text font text

windll.gdi32.ExtTextOutW( windll.gdi32.ExtTextOutW( hdc, 5, 5, ETO_GLYPH_INDEX, None, var1 var1, len(var1), None)

3/16/2012 29

slide-30
SLIDE 30

TTF Fuzzer TTF Fuzzer

3/16/2012 30

slide-31
SLIDE 31

Exploit MS11‐087 Exploit MS11 087

3/16/2012 31

slide-32
SLIDE 32

Exploit MS11‐087 Exploit MS11 087

Name Value Description EBSC.bitmapScaleTable[0].ppemX 0x004 Target horizontal pixels per Em EBSC.bitmapScaleTable[0].ppemY 0x004 Target vertical pixels per Em EBLC.bitmapSizeTable[5].ppemX 0x001 Horizontal pixels per Em EBLC bit Si T bl [5] Y 0 001 V ti l i l E EBLC.bitmapSizeTable[5].ppemY 0x001 Vertical pixels per Em EBDT.bitmapData.EbdtFormat8[11]. smallMetrics.height 0x001 Number of rows of data EBDT.bitmapData.EbdtFormat8[11]. smallMetrics.width 0x0ff Number of columns of data EBDT.bitmapData.EbdtFormat8[11]. 0x040 Position of component left ebdtComponent[0].xOffset EBDT.bitmapData.EbdtFormat8[11]. ebdtComponent[0].yOffset 0x052 Position of component top

Important info in exploitation

3/16/2012 32

slide-33
SLIDE 33

Exploit MS11‐087 Exploit MS11 087

  • usScaleWidth

=(EBLC.ppemX+((EBSC.ppemX*2)* EBDT.width))/(2*EBLC.ppemX) EBDT.width))/(2 EBLC.ppemX) =(0x001+((0x004*2)*0x0ff))/(2*0x001) (0 001 0 7F8)/(0 002) = (0x001+0x7F8)/(0x002) = 0x03FC

3/16/2012 33

slide-34
SLIDE 34

Exploit MS11‐087 Exploit MS11 087

  • usScaleHeight =

usScaleHeight = (EBLC.ppemY+((EBSC.ppemY*2)*EBDT.height)) /(2*EBLC ppemY) /(2 EBLC.ppemY) =(0x001+0x008)/(0x002) 0 0004 = 0x0004

3/16/2012 34

slide-35
SLIDE 35

Exploit MS11‐087 Exploit MS11 087

  • usScaleRowBytes

usScaleRowBytes =((usScaledWidth+0x1F)>>3)&(0xFFFC) ((0 03 C 0 ) 3)& (0 C) = ((0x03FC+0x1F)>>3)& (0xFFFC) = (0x85)&(0xFFFC) = 0x80

3/16/2012 35

slide-36
SLIDE 36

Exploit MS11‐087 Exploit MS11 087

  • usOriginalRowBytes

usOriginalRowBytes = ((EBDT.width+0x1F)>>3)&(0xFFFC) ((0 0 ) 3)&(0 C) = ((0x0FF+0x1F)>>3)&(0xFFFC) = 0x20

3/16/2012 36

slide-37
SLIDE 37

Exploit MS11‐087 Exploit MS11 087

  • Byte of scaling bitmap data

Byte of scaling bitmap data =usScaleHeight*usScaleRowBytes = 0x004*0x080 = 0x004 0x080 = 0x200 R i d b t f li bit d t ff t

  • Required byte of scaling bitmap data offset

= (EBDT.yOffset)*(usOriginalRowBytes) = 0x52*0x20 = 0x0A40

3/16/2012 37

slide-38
SLIDE 38

Exploit MS11‐087 Exploit MS11 087

structure fnt_GlobalGraphicStateType{ stackBase; /*the stack area store; /*the storage area store; / the storage area controlValueTable; /*the control value table …… int8 non90DegreeTransformation …… unit16 cvtCount; } fnt_GlobalGraphicStateType;

BEFORE AFTER

3/16/2012 38

slide-39
SLIDE 39

Exploit MS11‐087 Exploit MS11 087

structure fnt_GlobalGraphicStateType{ stackBase; /*the stack area store; /*the storage area store; / the storage area controlValueTable; /*the control value table …… int8 non90DegreeTransformation …… unit16 cvtCount; } fnt_GlobalGraphicStateType;

BEFORE AFTER

3/16/2012 39

slide-40
SLIDE 40

Exploit MS11‐087 Exploit MS11 087

fnt_GlobalGraphicStateType+134h (cvtCount) BEFORE AFTER

3/16/2012 40

slide-41
SLIDE 41

Exploit MS11‐087 Exploit MS11 087

3/16/2012 41

slide-42
SLIDE 42

Exploit MS11‐087 Exploit MS11 087

3/16/2012 42

slide-43
SLIDE 43

Exploit MS11‐087 Exploit MS11 087

ecx: value ‘stackBase+0’ edx: value Control Value Table

3/16/2012 43

slide-44
SLIDE 44

Exploit MS11‐087 Exploit MS11 087

3/16/2012 44

slide-45
SLIDE 45

Exploit MS11‐087 Exploit MS11 087

3/16/2012 45

slide-46
SLIDE 46

Exploit MS11‐087 Exploit MS11 087

Perfectly jump into Perfectly jump into the shellcode

3/16/2012 46

slide-47
SLIDE 47

Demonstration

3/16/2012 47

slide-48
SLIDE 48

Microsoft Windows Bitmapped Font ( f ) (.fon)

  • Microsoft Windows Bitmapped Fonts (.fon)

Microsoft Windows Bitmapped Fonts (.fon) come in two different types:

  • a. New Executable NE (old format used by
  • a. New Executable NE (old format used by

Windows 3)NE

  • b. Portable Executable PE (new 32bit
  • b. Portable Executable PE (new 32bit

executable format used in Windows 95 and above)

Note: Can’t find any complete documentation of Microsoft Windows Bitmapped Font. If you have any, share with me ☺!!

3/16/2012 48

slide-49
SLIDE 49

FON FUZZER FON FUZZER

  • .FON fuzzer consits of 2 files:

k f

  • a. mkwinfont.py

‐ written and/or maintained by Simon Tatham ‐ python script generates NE fon files only python script generates NE .fon files only

  • b. fuzzer.py

i b ‐ written by Byoungyoung Lee ‐ fuzz the .fon in different width, height

3/16/2012 49

slide-50
SLIDE 50

FON FUZZER FON FUZZER

  • Some modification:

k i f

  • a. mkwinfont.py

value = string.atol(w, 16) ;support hexadecimal

  • b. fuzzer.py

if width != 0: if width ! 0: for j in range(height): fdStr += "A"*width + "\n“ fd "\ " fdStr += "\n"

3/16/2012 50

slide-51
SLIDE 51

FON FUZZER FON FUZZER

3/16/2012 51

slide-52
SLIDE 52

Exploit MS11‐077 Exploit MS11 077

  • Discovered by Byoungyoung Lee

Discovered by Byoungyoung Lee

  • BSOD: BAD_POOL_HEADER(19)

i b b b d h l i Interesting bug but based on the analysis, there is very difficult to bypass the ‘safe li ki ’ i i d k l l unlinking’ in windows kernel pool

  • BSOD: DRIVER_OVERRAN_STACK_BUFFER(f7)

Possible to bypass the Stack‐Canary in Kernel Land Land

3/16/2012 52

slide-53
SLIDE 53

Exploit MS11‐077 Exploit MS11 077

win32k!BmfdOpenFontContext

;.Fon width=498 (0x1F2)

3/16/2012 53

; eax=(0x1F2)*5=0x9ba

slide-54
SLIDE 54

Exploit MS11‐077 Exploit MS11 077

win32k!BmfdOpenFontContext ;the ‘EngAllocMem’ function allocates a block of memory (0x160) and inserts

3/16/2012 54

;a ‘Bmfd’ pool tag before the allocation

slide-55
SLIDE 55

Exploit MS11‐077 Exploit MS11 077

3/16/2012 55

slide-56
SLIDE 56

Exploit MS11‐077 Exploit MS11 077

;Font data ‘aa’ will process and the result as index to read from the following array:

  • a. awStretch5W1
  • a. _awStretch5W1
  • b. _BFA10171
  • c. _awStretch5W2
  • d. _BFA10191

jS h5B1

  • e. _ajStretch5B1

3/16/2012 56

slide-57
SLIDE 57

Exploit MS11‐077 Exploit MS11 077

3/16/2012 57

slide-58
SLIDE 58

Exploit MS11‐077 Exploit MS11 077

Overwrite 3 bytes in l h d next pool header

3/16/2012 58

slide-59
SLIDE 59

Limitation of Exploit MS11‐077 Limitation of Exploit MS11 077

win32k!vStretchGlyphBitmap

3/16/2012 59

win32k!vStretchGlyphBitmap

slide-60
SLIDE 60

Limitation of Exploit MS11‐077 Limitation of Exploit MS11 077

win32k!vStretchGlyphBitmap

3/16/2012 60

win32k!vStretchGlyphBitmap

slide-61
SLIDE 61

Exploit MS11‐077 Exploit MS11 077

3/16/2012 61

slide-62
SLIDE 62

Exploit MS11‐077 (another try) Exploit MS11 077 (another try)

3/16/2012 62

slide-63
SLIDE 63

Exploit MS11‐077 Exploit MS11 077

Possible to bypass Kernel Canary in Kernel Land??

3/16/2012 63

Possible to bypass Kernel Canary in Kernel Land?? gave up without detail testing

slide-64
SLIDE 64

Demonstration

3/16/2012 64

slide-65
SLIDE 65

Thank You

Credit to: jvjvlglg, Byoungyoung Lee & Tarjei Mandt

3/16/2012 65