Attack on the Core

Attack on the
Core!
@zer0mem

#whoami - Peter Hlavaty (@zer0mem)
[ KEEN TEAM ]
 Background
 @K33nTeam
 Previously ~4 years in ESET
 Contact
 twitter : @zer0mem
 weibo : weibo.com/u/5238732594
 blog : http://zer0mem.sk
 src : https://github.com/zer0mem

outline
ATTACKER
▪ KernelIo tech
▪ Vulnerability cases
▪ Design features (flaws)
▪ State of targets / security
DEVELOPER
▪ Point of view
▪ Goal
▪ Environment
▪ C++! no more shellcoding!

Privileged cpl3 != cpl0
[NtQuerySystemInformation]
• NtQueryInformation from win8.1
requires elevated privileges
• Still callable from user mode
• Driver Signing Enforcement does
not like installing drivers even
from privileged ones …
• Privileged are enpowered with
good eye sight, kernel leakage

Read & Write boosting
[windows]
• write-where vuln
• what => should be above
read / write target
• Pool address can be
sufficient

[windows]

 KPP is not here to punish
attackers
 leak & write-where-
(semi)what
 patch & use & patch back
 turned into full KernelIo
 ReadFile alternative just
with
nt!MmUserProbeAddress
http://haxpo.nl/wp-content/uploads/2014/01/
D1T2-Bypassing-Endpoint-Security-for-Fun-and-Profit.pdf
[windows]
https://www.dropbox.com/sh/bkfajegn2mn35ng/AABm_RyD4x9VLzYjI9n9Dl2Wa?dl=0

[linux / droids]
• leak & write-where vuln
• what => should be above read / write target
• nullptr / pool address can be sufficient
http://vulnfactory.org/blog/2011/06/05/smep-what-is-it-and-how-to-beat-it-on-linux/

[linux / droids]
 PXN UDEREF handle it
 PXN not in default build
of linux
 On droids ? XD
 turned into full KernelIo
http://vulnfactory.org/research/stackjacking-infiltrate11.pdf

Why KernelIo ?
▪ abstraction behind
virtual address
▪ what is SMAP / SMEP
about ?

MMU straigforward idea
[PoC by MWR Labs]
1. choose address X with isolated page tables
1. To be sure write-where does not hit other used memory
2. mmap (X)
3. Patch S/U bits (write-where)
4. S/U bits need to patch per PXE !
1. self ref, can help 
5. cpl0 memcpy (X, shellcode)
6. Pwn (SMEP, SMAP out of the game)
https://labs.mwrinfosecurity.com/blog/2014/08/15/windows-8-kernel-memory-protections-bypass/
http://fluxius.handgrep.se/2011/10/20/the-art-of-elf-analysises-and-exploitations/

Symbolic cpl0 – cpl3 separators
“
The ProbeForRead routine checks
that a user-mode buffer actually
resides in the user portion of the
address space, and is correctly
aligned.
“
 Ok, what about
aliasing ?!
 and about ret2dir
approach ? 
https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/kemerlis

KERNEL- FAIL – SAFE – CHECKS
 copy_to/from_user
 ProbeForRead/Write
 Checking just
symbolic values
 not cover aliasing…

Out of Boundary
1. Trivial to exploit
2. Generic implementation
3. write/read – where
4. NO -SMAP
5. but sometimes PXN

Out of Boundary
 what if SMAP enabled ?
 Is over ?
 Read – no problem, just do
not try to read from
usermode 
 Write – you have to know
where to write – relative
positioned structs

kmalloc under/overflow
1. under/overflowed kmalloc
2. copy_to/from_user
3. search_exception_table
for frv, but idea same
4. force copy_to/from_user
fail
5. Copied just controlled
bytes even in
under/overflow situation!

KASLR
• From win8.1
NtQuerySystemInfo is just
for privileged user
• /proc/kallsyms same, just for
privileged ones
• Need to info-leak
• Read-where vuln
• Abusing weak or old
mechanism

KASLR
 PageTable concept is old
 That time no hardering needed
 Crucial for performance
 Timing attacks, PageFault
measuring, seems doable, see
recent research
 A lot of static PHYSICAL
addresses, KASLR weakened
 MMU mechanism attacks
target of recent research, and
it works …
http://felinemenace.org/~nemo/docs/TR-HGI-2013-001-real.pdf
http://labs.bromium.com/2014/10/27/tsx-improves-timing-attacks-against-kaslr/

Part 3 -> design features
(flaws)

Linked lists
• nt!_list_entry / list_head
• Lazy list entry assertions
• Proper design ?
• Manipulating next / prev
outside of API ?
• Hardening ?
• Common member
• Intrusive containers
• Redirect list
• pool leak && write-where
• Own content && abussing
algo ?
http://www.k33nteam.org/blog.htm (nt!list_entry)

Kernel hidden pointers
plenty of c++
alike vtables
callbacks
ops
context func
Interesting
design features
typecast instead
of inheritance
Plenty data
pointers
No integrity
checks
Plenty data
structs
Sensitive trusted
context
No
hardening
Plain pointers
http://www.nosuchcon.org/talks/2013/
D3_02_Nikita_Exploiting_Hardcore_Pool_Corruptions_in_Microsoft_Windows_Kernel.pdf

Kernel ops by design
• Callback mechanism
• open / write / read …
• If not implemented
NULLPTR
• If not implemented no call
performed
1. nullptr write vuln
2. null some operation
3. Abuse scoped resource
handling logic
4. pwn

Part 4 -> state of exploitation

before win8.1
POOL
HARDENING
SMEP
SMAP
PLAIN
PTRS
“KASLR”
NtQuerySysInfo even kids … … do pwn

Era of Windows 8.1, earlier and current linux
POOL
HARDENING
SMEP
SMAP
PLAIN
PTRS
KASLR
 Cool, seems more hardening
 More software security features
 Access control improved
 UEFI
 Finally! More hardware features
goes implemented SMEP/SMAP, …
 SMAP still waiting in some cases
….
 Exploiting coming finally
challenging! BUT still kernel not
hardened enough

Future of OS ?
POOL
HARDENING
SMEP
SMAP
HARDENED
PTRS
KASLR
Hardware features implemented
 Strong complex access control
policy
Well randomized kernel space
 Kicked off obsolete designs
Well designed core
No plain pointers
Data integrity checks

Rebirth to
K E R N E L
Developing begins

CHANGING DIRECTION
[everything is just point of view]
Until now you were
ATTACKER
• NO MATTER HOW, but get
EXEC!
• hooks, patching, non-safe
walkers, etc.
Now you are
DEVELOPER !
• Pretend to be one of them
• Now you deal with KPP and
others mitigations

Kernel windows DEVELOPER view
▪ In kernel, but some obstacles reminds :
▪ PsSet * Routine, ObRegisterCallbacks, etc.
– Callback integrity validation!
▪ IoAttachDeviceToDeviceStack, IoQueueWorkItem
– DEVICE_OBJECT* needed (own is preferable)

Kernel DEVELOPing begins
[DRIVER/DEVICE_object*]
▪ Kernel loader method, or :
▪ Create your own!
– IoCreateDevice
– _OBJECT_HEADER + DRIVER_OBJECT

Kernel monitoring
[device attaching]
▪ Attach to driver
▪ Filter :
– Network communication
– File system communication
– …

Kernel monitoring
[legacy]
▪ File System Filter Driver
▪ FAST_IO_DISPATCH
– Register dropped files
– Access to files
– …
▪ Also minifilters are option

Kernel monitoring
[IoCompletion]
▪ IoCompletion
– Monitor ALPC
– Used by resolving host, etc. etc.
– Remote process communication
– Per process

Linux, everything is a file
1. Kernel ops
2. Find in which one you
are interesting in
3. Register to chain
4. cdev_add
( register_chrdev )

SELinux, SEAndroid, ACL
 Kernel escape
 Natural bypass
 Feature :
1. Developing superuser
deamon
2. does not rely on special
syscalls
3. Normal application
development, api …
4. Separation of responsibilities
5. Kernel – bypass policy checks
6. Daemon – provide boosted
functionality to user

C++
come on … why shellcoding or pure c ?

Exploitation means developming!
▪ C++ is about compiler & you skills
▪ You think you can wrote better shellcode than
compiler ? 
▪ You can code really close to assembly level –
when you know your compiler
▪ c++ well maintainable, scalable, modulable
▪ Design patterns
▪ Complex frameworks
http://www.exploit-monday.com/2013/08/writing-optimized-windows-shellcode-in-c.html
https://github.com/mattifestation/PIC_Bindshell (Window Shellcode in C)

Exploiting is development!
▪ Before you can write PoC for exploits as easy as hello world
▪ Things getting complex
▪ Now with same style you can end up with unreadable master piece
▪ Next time you have good time to rewriting lot of the same logic
▪ And at the end you end up with black-boxes chained together with
black-magic, somehow working
▪ Something will change … start fixing black-box

Exploitation framework can be powerfull
▪ UserCode in kernel allowed!
– Kernel code hidden inside binary
– Fully c++ driver!
▪ Mixing User & Kernel code
– just avoid direct linking imported kernel functions!
– Also avoid to mixing um & km headers together in compile time ;)
– Compile standalone kernel code as .lib
– link kernel code .lib to exploit .exe

KERNEL as exploitation VECTOR
1.
Copy whole PE to RWE kernel page
 ExAllocatePool(NonPagedPoolExecute,SizeOfImage);
2.
3.
Fix Rellocations
4.
resolve kernel part of
Import table
Ready for exec with CPL0!
CPL Teleport

Raise of C++, no more shellcoding!
1. Mixing user & kernel code
2. no imports
3. c++
4. relocations
5. Dynamic loader

Raise of C++, no more shellcoding!
1. c++ kernel code
2. Compiled with user mode code
3. No Imports, but does not impact code

C++ ‘shellcoding’ framework
▪ no import table
▪ no need to handle imports by your own
▪ .py scripts set up all imports
▪ no need to code position independent code
▪ fixups resolved by loader
▪ C++ (partially also std & boost) supported
▪ no need to ship kernel code as resource, or shellcode
▪ no need to special coding style to kernel module, classical developing
▪ All features (c++, imports, fixups..) applies to kernel code as well
http://www.zer0mem.sk/?p=517
http://www.hollistech.com/Resources/Cpp/kernel_c_runtime_library.htm
http://www.codeproject.com/Articles/22801/Drivers-Exceptions-and-C

C++ ‘shellcoding’ framework
https://github.com/k33nteam/cc-shellcoding
releasing very soon @K33nTeam

materials
(not listed in slides before)
– http://www.codeproject.com/Articles/43586/File-System-Filter-Driver-Tutorial
– www.bitnuts.de/KernelBasedMonitoring.pdf
– https://projects.honeynet.org/svn/capture-hpc/capture-hpc/tags/2.5/capture-client/
KernelDrivers/CaptureKernelDrivers/FileMonitor/CaptureFileMonitor.c
– http://www.osronline.com/article.cfm?article=199

Acknowledge Thanks to :
jfang
liac
rafal wojtczuk
wushi nforest
NTarakanov
j00ru
aionescu
cesarcer
dan rosenberg
krzywix
maxim

We are hiring!
▪ #1 vulnerability research team in China
– http://www.k33nteam.org/cvelist.htm
– pwn2own
▪ Enjoying research ?
– Mobile (Android, iOS, WP)
– PC (Windows, OS X, Chrome OS, etc.)
▪ Willing to move to Shanghai ?
– Beijing ?
▪ Want to join our team ?
– Application security
– Kernel security hr (at) keencloudtech.com

2014 - $500,000
2015 - $???????? Pick a device, name your own challenge!

follow us
@K33nTeam
Thank You.
Q & A
peter (at) keencloudtech.com

Attack on the Core

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Attack on the Core (20)

Recently uploaded (20)

Attack on the Core