SlideShare a Scribd company logo
Vulnerability design
PATTERNS
case: Kernel mode
PAST
Environment for exploitation
Simple
ioctl
W^X NX KASLR
Hardened
Pool
SMEP SMAP
Why kernel exploitation
Full control of
system
Simple
exploitation
Simple bugs
KERNEL ESCAPE
few lines of code, simple, effective – for that time
Modified sample from : https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sock_sendpage.rb
EVOLUTION
Exploitation hierarchy
User
Elevated user
(admin / root)
supervisor
Past exploitation shortcut
User
Elevated user
(admin / root)
supervisor
Present (+-) & Future : Step by step
User
Elevated user
(admin / root)
Supervisor
• DEP, ASLR, SEHOP, ProtectedFree, Isolated Heap, CFG,
Virtual Table Guards, EMET...
• sandbox, SELinux and alikes
• KASLR, SMEP, SMAP, ..
Why kernel escape
• Going to be more and more difficult, but ...
• still .. sometimes easier .. shortcut
• Natural bypass of SELinux
• Full control (cpl0 > cpl3)
• for now do not considering cpl-1, ...
exploitation ==> developing
• In past was very easy elevate privileges
• Now everything is fast moving
• You need to adapt to all changes & diversity
• Things are getting more complex
• Your exploitation code is expanding dramatically
• Every change can broke your black-box
• + Process of exploitation need more than ioctl
• Race conditions, complex mechanism break (ttf), sandbox
escapes ...
VULNERABILITY DESIGN PATTERNS
kernel case
selected vulnerability classes
• Out Of Boundary
• Basic types Over/Under flows
• Stack overflows
• Buffer overflows
• nullptr writes
• Race conditions –not generic, but ...
• may create other bug from above group
Out Of Boundary
Simple, mighty, generic
OOB
• Read
• Write
• SMAP – limitation, but not
eliminate oob
• GENERIC approach
Basic type Over/Under-flow
Generic, simple and useful when it comes to aligned rw
Stack Overflow
sometimes protected, sometimes not .. local vars ?
.. depends on compilation ..
Stack overview
• Local vars
• canaries
• Protect ret & args
• ... sometimes ... missing
• UNprotected inner calls ?
• Arg in main func preserved in register
• Inner call invoked, register may be putted onto stack
• Rewrite arg (or directly ret) on stack in inner call
• Return to main func with altered arg (in register)
• Can help more than it seems ;)
• Controlled copy, overwrite save your day
Buffer Overflow
Common case, can be also byproduct, heap hardening can be
problem
Buffer overview
• Windows kernel pool, SLUB
• not so predictable anymore
• but still far from not-predictable at some level
• kmalloc
• targeted kmalloc from user mode ?
• not so hard as can seems
• help with predictability
• Pool spray
• thread, process, pipe, socket ...
• caches (linux)
• can be problem for precise pool layout, but can be solved
nullptr pwn
spray, write, pwn .. 64b bit more effort ...
user part of cake
Pool
spray
kmalloc
Pipes
ThreadsLocks
ret2dir
Kernel IO
kernel pool
pipes, threads .. kmalloc .. spray
Kernel IO
If doable, then almighty ...
workers, locks, helpers
a lot of common issues per vuln task
CODING STYLE MATTERS
Elevation of Privilages
USER
• Find nt!_eprocess /
thread_info
• Patch credentials
• Bypass ACL policy
• Reverse engineer per policy
• Implement
• Keep up to date
• Good if not change
frequently .. Not that case 
KERNEL
• Elevate process
• Grant access important
operations (callbacks)
• File access
• Process access
• Registry access
• Network
• How effective without
framework ?
Kernel part of cake
• Boosting privs
• Why patching ?
• Recognize and grant access instead
• No LKM ? Are you sure ?
• Kernel exploitation may be equals to enable LKM
CC-shellcoding framework
• developing instead of shellcoding ?
• C++, boost, std ?
• Loading your own kernel modules ?
https://github.com/k33nteam/cc-shellcoding
more info : http://www.k33nteam.org/blog.htm -
CC-SHELLCODING
@KEENTEAM
2014 - $500,000
2015 - $??????? Pick a device, name your own challenge!
We are hiring!
 Kernel & app sec
 A LOT of research
 mobile, pc
 M$, android, OSX ..
Thank You! Q & A
@K33nTeam

More Related Content

PPTX
Guardians of your CODE
PPTX
Back to the CORE
PPTX
Racing with Droids
PPTX
Power of linked list
PPTX
Attack on the Core
PPTX
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
PDF
DeathNote of Microsoft Windows Kernel
PPTX
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Guardians of your CODE
Back to the CORE
Racing with Droids
Power of linked list
Attack on the Core
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
DeathNote of Microsoft Windows Kernel
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes

What's hot (20)

PDF
When is something overflowing
PPTX
Ice Age melting down: Intel features considered usefull!
PDF
Rainbow Over the Windows: More Colors Than You Could Expect
PPTX
Security research over Windows #defcon china
PPTX
How Safe is your Link ?
PPTX
Hacking - high school intro
PDF
How to Root 10 Million Phones with One Exploit
PPTX
Steelcon 2014 - Process Injection with Python
PPTX
Memory Corruption: from sandbox to SMM
PDF
PPTX
Practical Windows Kernel Exploitation
PDF
For the Greater Good: Leveraging VMware's RPC Interface for fun and profit by...
PDF
One Shellcode to Rule Them All: Cross-Platform Exploitation
PDF
Modern Evasion Techniques
PPTX
Software to the slaughter
PDF
Process injection - Malware style
PDF
Is That A Penguin In My Windows?
PDF
Defcon 22-colby-moore-patrick-wardle-synack-drop cam
PPTX
BSides Hannover 2015 - Shell on Wheels
PDF
NSC #2 - D3 02 - Peter Hlavaty - Attack on the Core
When is something overflowing
Ice Age melting down: Intel features considered usefull!
Rainbow Over the Windows: More Colors Than You Could Expect
Security research over Windows #defcon china
How Safe is your Link ?
Hacking - high school intro
How to Root 10 Million Phones with One Exploit
Steelcon 2014 - Process Injection with Python
Memory Corruption: from sandbox to SMM
Practical Windows Kernel Exploitation
For the Greater Good: Leveraging VMware's RPC Interface for fun and profit by...
One Shellcode to Rule Them All: Cross-Platform Exploitation
Modern Evasion Techniques
Software to the slaughter
Process injection - Malware style
Is That A Penguin In My Windows?
Defcon 22-colby-moore-patrick-wardle-synack-drop cam
BSides Hannover 2015 - Shell on Wheels
NSC #2 - D3 02 - Peter Hlavaty - Attack on the Core
Ad

Similar to Vulnerability desing patterns (20)

PDF
New hope is comming? Project Loom.pdf
PDF
Efficient Bytecode Analysis: Linespeed Shellcode Detection
PDF
JavaOne 2010: Top 10 Causes for Java Issues in Production and What to Do When...
PPTX
Using the big guns: Advanced OS performance tools for troubleshooting databas...
PDF
Ansible 101 - Presentation at Ansible STL Meetup
PDF
Ceph in the GRNET cloud stack
PDF
LXC Containers and AUFs
PPTX
Inferno Scalable Deep Learning on Spark
PDF
Scale11x lxc talk
PDF
Java Performance Analysis on Linux with Flame Graphs
PDF
Experiences with Debugging Data Races
PDF
You Call that Micro, Mr. Docker? How OSv and Unikernels Help Micro-services S...
PDF
Running Applications on the NetBSD Rump Kernel by Justin Cormack
KEY
Andy Parsons Pivotal June 2011
PPTX
Go Faster with Ansible (PHP meetup)
PDF
Lect06
PDF
What Linux can learn from Solaris performance and vice-versa
KEY
20100425 Configuration Management With Puppet Lfnw
PDF
Lions, Tigers and Deers: What building zoos can teach us about securing micro...
PPTX
Ceph Deployment at Target: Customer Spotlight
New hope is comming? Project Loom.pdf
Efficient Bytecode Analysis: Linespeed Shellcode Detection
JavaOne 2010: Top 10 Causes for Java Issues in Production and What to Do When...
Using the big guns: Advanced OS performance tools for troubleshooting databas...
Ansible 101 - Presentation at Ansible STL Meetup
Ceph in the GRNET cloud stack
LXC Containers and AUFs
Inferno Scalable Deep Learning on Spark
Scale11x lxc talk
Java Performance Analysis on Linux with Flame Graphs
Experiences with Debugging Data Races
You Call that Micro, Mr. Docker? How OSv and Unikernels Help Micro-services S...
Running Applications on the NetBSD Rump Kernel by Justin Cormack
Andy Parsons Pivotal June 2011
Go Faster with Ansible (PHP meetup)
Lect06
What Linux can learn from Solaris performance and vice-versa
20100425 Configuration Management With Puppet Lfnw
Lions, Tigers and Deers: What building zoos can teach us about securing micro...
Ceph Deployment at Target: Customer Spotlight
Ad

Recently uploaded (20)

PDF
2025 Textile ERP Trends: SAP, Odoo & Oracle
PDF
SAP S4 Hana Brochure 3 (PTS SYSTEMS AND SOLUTIONS)
PDF
Why TechBuilder is the Future of Pickup and Delivery App Development (1).pdf
PDF
Odoo Companies in India – Driving Business Transformation.pdf
PDF
Internet Downloader Manager (IDM) Crack 6.42 Build 42 Updates Latest 2025
PDF
Understanding Forklifts - TECH EHS Solution
PPTX
Transform Your Business with a Software ERP System
PDF
Softaken Excel to vCard Converter Software.pdf
PDF
Digital Strategies for Manufacturing Companies
PPTX
history of c programming in notes for students .pptx
PDF
Wondershare Filmora 15 Crack With Activation Key [2025
PPTX
ISO 45001 Occupational Health and Safety Management System
PPTX
L1 - Introduction to python Backend.pptx
PDF
top salesforce developer skills in 2025.pdf
PDF
How to Migrate SBCGlobal Email to Yahoo Easily
PPTX
VVF-Customer-Presentation2025-Ver1.9.pptx
PDF
Navsoft: AI-Powered Business Solutions & Custom Software Development
PDF
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
PPTX
Agentic AI Use Case- Contract Lifecycle Management (CLM).pptx
PPTX
Introduction to Artificial Intelligence
2025 Textile ERP Trends: SAP, Odoo & Oracle
SAP S4 Hana Brochure 3 (PTS SYSTEMS AND SOLUTIONS)
Why TechBuilder is the Future of Pickup and Delivery App Development (1).pdf
Odoo Companies in India – Driving Business Transformation.pdf
Internet Downloader Manager (IDM) Crack 6.42 Build 42 Updates Latest 2025
Understanding Forklifts - TECH EHS Solution
Transform Your Business with a Software ERP System
Softaken Excel to vCard Converter Software.pdf
Digital Strategies for Manufacturing Companies
history of c programming in notes for students .pptx
Wondershare Filmora 15 Crack With Activation Key [2025
ISO 45001 Occupational Health and Safety Management System
L1 - Introduction to python Backend.pptx
top salesforce developer skills in 2025.pdf
How to Migrate SBCGlobal Email to Yahoo Easily
VVF-Customer-Presentation2025-Ver1.9.pptx
Navsoft: AI-Powered Business Solutions & Custom Software Development
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Agentic AI Use Case- Contract Lifecycle Management (CLM).pptx
Introduction to Artificial Intelligence

Vulnerability desing patterns

  • 3. Environment for exploitation Simple ioctl W^X NX KASLR Hardened Pool SMEP SMAP
  • 4. Why kernel exploitation Full control of system Simple exploitation Simple bugs
  • 5. KERNEL ESCAPE few lines of code, simple, effective – for that time Modified sample from : https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sock_sendpage.rb
  • 8. Past exploitation shortcut User Elevated user (admin / root) supervisor
  • 9. Present (+-) & Future : Step by step User Elevated user (admin / root) Supervisor • DEP, ASLR, SEHOP, ProtectedFree, Isolated Heap, CFG, Virtual Table Guards, EMET... • sandbox, SELinux and alikes • KASLR, SMEP, SMAP, ..
  • 10. Why kernel escape • Going to be more and more difficult, but ... • still .. sometimes easier .. shortcut • Natural bypass of SELinux • Full control (cpl0 > cpl3) • for now do not considering cpl-1, ...
  • 11. exploitation ==> developing • In past was very easy elevate privileges • Now everything is fast moving • You need to adapt to all changes & diversity • Things are getting more complex • Your exploitation code is expanding dramatically • Every change can broke your black-box • + Process of exploitation need more than ioctl • Race conditions, complex mechanism break (ttf), sandbox escapes ...
  • 13. selected vulnerability classes • Out Of Boundary • Basic types Over/Under flows • Stack overflows • Buffer overflows • nullptr writes • Race conditions –not generic, but ... • may create other bug from above group
  • 14. Out Of Boundary Simple, mighty, generic
  • 15. OOB • Read • Write • SMAP – limitation, but not eliminate oob • GENERIC approach
  • 16. Basic type Over/Under-flow Generic, simple and useful when it comes to aligned rw
  • 17. Stack Overflow sometimes protected, sometimes not .. local vars ? .. depends on compilation ..
  • 18. Stack overview • Local vars • canaries • Protect ret & args • ... sometimes ... missing • UNprotected inner calls ? • Arg in main func preserved in register • Inner call invoked, register may be putted onto stack • Rewrite arg (or directly ret) on stack in inner call • Return to main func with altered arg (in register) • Can help more than it seems ;) • Controlled copy, overwrite save your day
  • 19. Buffer Overflow Common case, can be also byproduct, heap hardening can be problem
  • 20. Buffer overview • Windows kernel pool, SLUB • not so predictable anymore • but still far from not-predictable at some level • kmalloc • targeted kmalloc from user mode ? • not so hard as can seems • help with predictability • Pool spray • thread, process, pipe, socket ... • caches (linux) • can be problem for precise pool layout, but can be solved
  • 21. nullptr pwn spray, write, pwn .. 64b bit more effort ...
  • 22. user part of cake Pool spray kmalloc Pipes ThreadsLocks ret2dir Kernel IO
  • 23. kernel pool pipes, threads .. kmalloc .. spray
  • 24. Kernel IO If doable, then almighty ...
  • 25. workers, locks, helpers a lot of common issues per vuln task
  • 27. Elevation of Privilages USER • Find nt!_eprocess / thread_info • Patch credentials • Bypass ACL policy • Reverse engineer per policy • Implement • Keep up to date • Good if not change frequently .. Not that case  KERNEL • Elevate process • Grant access important operations (callbacks) • File access • Process access • Registry access • Network • How effective without framework ?
  • 28. Kernel part of cake • Boosting privs • Why patching ? • Recognize and grant access instead • No LKM ? Are you sure ? • Kernel exploitation may be equals to enable LKM
  • 29. CC-shellcoding framework • developing instead of shellcoding ? • C++, boost, std ? • Loading your own kernel modules ? https://github.com/k33nteam/cc-shellcoding more info : http://www.k33nteam.org/blog.htm - CC-SHELLCODING @KEENTEAM
  • 30. 2014 - $500,000 2015 - $??????? Pick a device, name your own challenge!
  • 31. We are hiring!  Kernel & app sec  A LOT of research  mobile, pc  M$, android, OSX .. Thank You! Q & A @K33nTeam