Win32k Dark Composition Attacking the Shadow Part of Graphic - - PowerPoint PPT Presentation

Win32k Dark Composition

Attacking the Shadow Part of Graphic Subsystem

@360Vulcan Team Peng Qiu (@pgboy) SheFang Zhong (@zhong_sf)

About US

Member of 360 vulcan team. Windows kernel security researcher Pwn2Own winners 2016

.pwned Chrome pwn2own 2016 .pwned Flash pwn2own 2016

Pwnfest winners 2016

.pwned Edge PwnFest 2016 .pwned Flash PwnFest 2016

Pwn2Own winners 2015

.pwned IE pwn2own 2015

Agdenda

Direct Composition Overview 0day & Exploitation Fuzzing Mitigation & Bypass

• High-performance bitmap composition with transforms,

effects and animations graphic engine

• Introduced from windows 8.
• Working based on dwm(desktop

windows manager).

Direct Composition Overview

Direction Composition Architecture

dwmcore dcomp

. . .

userland kernel

DirectComposiAon CApplicaAonChannel visual

CExpressionMarshaler CFilterEffectMarshaler CScaleTransformMarshaler . . .

submit DWM (desktop windows manager) DXGK (directX graphic kernel) call

Significant Change since win10 RS1

• kernel implement changed
• Interface changed

Remove lots of interface. 10+? Lots of funcAon has been rewrite, not fix vuln Add some interface. eg:

Before win10 RS1

Exist independently and some in the win32k filter table

Since win10 RS1

all included in

This func1on is out of Win32k filter list

Why attack DirectComposition

• Reachable in AppContainer and out of win32k filter
• This part implement with c++ in kernel
• Introduced from windows 8, ever been focus by

another researchers, !!!as far as we know!!!

Important functions

Channel Object

• know as Device Object in user interface
• owner of resource, use to create resource
• pArgSec(onBaseMapInProcess return a batch buffer we

need later

Resource Object

• know as visual in user interface
• similar to win32k surface
• It has a lots of types.

CScaleTransformMarshaler CTranslateTransformMarshaler CRectangleClipMarshaler CBaseClipMarshaler CSharedSecAonMarshaler CMatrixTransformMarshaler CMatrixTransform3DMarshaler CShadowEffectMarshaler

. . .

Batch Buffer

• Associate with a channel
• Returned from NtDComposiAonCreateChannel
• NtDComposiAonProcessChannelBatchBuffer parse it
• This funcAon support a lot of commands

How to fuzz

By default is 1, we increase those funcAon’s probability to 100.

• They need a channel we give them one.
• They need a resource we give them one.
• If we do not known what they want, give them a random
• ne.

• 0day & Exploition

Resource Double free (CVE-2017-XXXX)

Root Cause

Free the resource(visual)'s property buffer forget to clear resource->Databuffer. result in free again when resource is free

First time free

Second time free

Exploition

Res1

First time free

ResY Free this one Res2 Res3 Res4 … Res1 palette Occupy with palette Res2 Res3 Res4 … Res1 palette Free palette Res2 Res3 Res4 …

Second time free

Res1 ResX Occupy with ResX Res2 Res3 Res4 …

Modify the palette->pEntries to what you want when

• ccupy palette with a ResourceBuffer

palette

pEntries

ResX- >DataBuf

xxxxx

• ccupy second time

Content Replace

palette

pEntries

bitma p

pScan0

Usually, cover palette1->pEntries to a bitmap address

Read & Write primity Replace process token, exploited

Fix BSOD

• We finished privilege escalation, but BSOD

when process exit

• There still has double either Palette or ResX's

DataBuffer, because they share the same kernel buffer

• Double free happened in clear process

handle table when process exit

• Close palette handle first, Resource handle next
• So? must clear ResX->DataBuffer or remove ResX

handle from handle table before process exit

Clear ResX->DataBuffer

• It's a binary tree struct, search the binary tree to

find the channel that Resource belongs to.

• Channel handle table locate in:

_EPROCESS->Win32Process->GenericTable

GenericTable channel1 channel2 channel3 channel4 channel5

• 1. Locate ResX address
• 2. Locate channel address

Resource address store in channel's resource table

Resource table in channel implement as a array

void* ptrNull=0; AddressWrite(&ResX->DataBuffer, sizeof(void*), &ptrNull);

Clear

BagMarshaler Integer overflow (CVE-2016-XXXX)

Root cause

Integer overflow while dataOffset < DataSize-0xc if DataSize < 0xc

If (dwOffet < (DWORD)(0x1-0xc)) { if (DataBuffer[dwOffset]==0x66) { DataBuffer[dwOffset+0xc]=xxxx; } }

• By default,this->Databuffer==NULL

&& this->DataSize==0

• Write anywhere in x86 system.
• Not so easy in x64 system.

1.this->Databuffer must not NULL 2.this->DataSize < 0xC && this->DataSize!=0 3.*(this->Databuffer + inbuf->offset)==(0x45 or 0x66)

Exploitation:

1.this->Databuffer must not NULL

we could call CPropertyBagMarshaler::SetBufferProperty(...) with property==2 to alloc a buffer, then store in this->DataBuffer

*(this->DataBuffer+inbuf->offset)==(0x45 or 0x66)

Spray lots of bufferX to enable that bufferX behind this->DataBuffer

DataBuffer

bufferX ...

Calc inbuf->offset value, it must be saAsfy:

bufferX

• (Databuffer+offset) locate in bufferX, ( bufferX->Filed1 )
• bufferX->Flied1 must be modifyable from usermod, set it to (0x45 or 0x66)
• (Databuffer+offset+0xc) locate in bufferX, and it must be exploitable.

DataBuffer bufferX

...

Offset

0xc Flied1 Flied2

Fortunately, we found bitmap saAsfy this case perfectly

DataBuffer

bitmap

...

Offset 0xc Height pScan0

Now, bitmap->pScan0 has benn changed to the value we set. so we got Read/Write primary

• 1. GetBitmapbits (....)
• 2. SetBitmapbits (....)

Replace ps token, exploited !

Complier Warning?

WARNING!!

• Mitigation & bypass

Read/Write ability object

• 1. tagWND abuse

Write what? tagWND.strName ? (UNICODE_STRING)

GetWindowText ？ NtUserDefSetText ?

Unfortunately, the destination address has been modify when write to,

just desktop heap range is legal.

Maybe

2014

Pwn2Own:KeenTeam used once. HackingTeam leaked 0day. Someone write it to a public paper

2015.3

Pwn2Own: We used Twice. Pwn2Own: KeenTeam used Once.

2016.3 2016.8

2.BITMAP ABUSED

2016.10

We use Acclerator Object To Guess Bitmap Object Address. Then We used Twice again in PwnFast. Coresecurity guys release a paper to talk about is.

14393 VS 15xxx:

A New way

But Only The Object which Allocate at desktop heap:

• 1. Window
• 2. Menu
• 3. InputContext
• 4. CallProc

limitation

But It is enough, I believe you guys could find something useful!!

We are just on the way. Thank you.