Exploit generation automation with WinDBG (Hacktivity 2017)
- 1. Exploit generation automation with WinDBG Csaba Fitzl
- 2. whoami blue teamer security researcher, blogger husband, father hiker
- 3. Exploit writing challenges Time consuming Heavily manual intensive process Discovering memory layout Finding bad characters While (exploit doesn’t work == True): Start process, attach debugger, crash, Modify exploit
- 4. Exploit writing methodology - BoF Find EIP overwrite location Examine memory layout, registries Somehow jump to shellcode Generate shellcode Put all together
- 5. The task A tool which can automate the entire exploit writing process From crash PoC to working Exploit If possible n0 manual interaction
- 6. The tool Written in Python Uses the “pykd” library to interact with WinDBG
- 7. What can it do? Currently works for classic BoFs Can bypass ASLR Works for network and file based exploits Will create a successful exploit from a simple crash Automates the entire process (even finding bad characters!) No need to manually start the process / WinDBG
- 8. The logic Find EIP overwrite location / offset Find registers pointing to the buffers Find bad characters Find a way to jump to the shellcode (JMP, CALL, etc…) Generate shellcode Put it all together
- 9. demo time
- 10. How to use it? Some pre-work needs to be done Exploit is a Class Has to be populated with initial info (crash)
- 11. What has to be changed? def exploit(self): """ This function runs the actual exploit """ sleep(1) sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect(('127.0.0.1',80)) message = "GET " + ''.join(self.buffer) + " HTTP/ 1.1rnrn" sock.send(message) sock.close()