Upload File

windows kernel shellcode exploit - hitcon pacific...

  • Home
  • Documents
  • Windows Kernel Shellcode Exploit - HITCON Pacific …hitcon.org/.../2005/Windows_Kernel_Shellcode_Exploit.pdfWindows Kernel shellcode Exploit • Ring3->Ring0 • Exploit Apc inject
27
Windows_Kernel_Shellcode _Exploit chrO.ot Nanika

Upload: vodan

Post on 16-Apr-2018

299 views

Category:

Documents


8 download

Report

TRANSCRIPT

  • Windows_Kernel_Shellcode

    _Exploit

    chrO.otNanika

  • Summary

    What is Exploit Windows_Shellcode Windows_Kernel_shellcode CreateRemoteThread backdoor byshell Exploit Demo 0day_exploit

  • What is Exploit Buffer overflow Heap overflow Format string CGI or SQL inject

  • Buffer overflow

    STACK ----------------Local Variables ESPBuffer ----------------EBP-> Old Value of EBP----------------Return Address ----------------

    void func(void)

    {

    char buffer[256]; // * for(i=0;i

  • Heap overflow

    mov [ecx], eax mov [eax+4], ecx

    buf1 = HeapAlloc(hHeap, 0, 32);

    strcpy(buf1,mybuf);

    buf2 = HeapAlloc(hHeap, 0, 32);

    HeapFree(hHeap, 0, buf1);HeapFree(hHeap, 0, buf2);

  • Format string

    int main(int argc, char *argv[]){char buffer[512]="";strncpy(buffer,argv[1],500);

    printf(buffer);return 0;

    }

    printf%.123456x%.123456x%n

  • CGI or SQL inject ../../../../../../ !@#$%^&*() http://127.0.0.1/a.asp?s=xxxxx

  • Windows_Shellcode bind shellcode connect back shellcode

  • bind shellcode Kernel APIaddress Create Shell WinSocket TCP6,1,2 Bind;Port Listen; Accept; Send; Recv;

  • connect back shellcode db "WSAStartup",0;edi-14h db "socket",0;edi-10h db "connect",0;edi-ch db "send",0;edi-8 db "recv",0;edi-4

  • Windows_Kernel_shellcode

    patch EPROCESS Token APC inject

  • Kernel Memery Kernel struct IRQL Patch EPROCESS Token APC_Inject

  • Kernel Memery

  • Kernel struct

    EPROCESS KPROCESS ETHREAD KTHREAD HANDLE TABLE

    dt nt!_EPROCESS

    dt nt!_KPROCESS

    dt nt!_ETHREAD

    dt nt!_KTHREAD

    dt nt!_HANDLE_TABLE

  • IRQL

    HighPower Fail

    Inter-processor InterruptClock

    Dispatch/DPC

    Device n

    Device 1

    APCPassive

    ...

    31302928

    012

    Hardware Interrupts

    Software Interrupts

    Normal Thread Execution

    IRQL = Interrupt Request Level (0 to 31)IRQL = Interrupt Request Level (0 to 31)

  • Patch EPROCESS Token

    +0x000 Pcb : _KPROCESS+0x084 UniqueProcessId : Ptr32 Void+0x088 ActiveProcessLinks : _LIST_ENTRY+0x0c4 ObjectTable : Ptr32 _HANDLE_TABLE+0x0c8 Token : _EX_FAST_REF+0x190 ThreadListHead : _LIST_ENTRY

  • APC_Inject Kernel ffdf0000 = user 7ffe0000 lkd> dt nt!_KTHREAD +0x02d State : UChar

    lkd> dt nt!_KAPC_STATE +0x000 ApcListHead : [2] _LIST_ENTRY +0x010 Process : Ptr32 _KPROCESS +0x014 KernelApcInProgress : UChar +0x015 KernelApcPending : UChar +0x016 UserApcPending : UChar

    void KeInitializeApc(struct _KAPC *Apc, PKTHREAD thread, unsigned char state_index, PKKERNEL_ROUTINE ker_routine, PKRUNDOWN_ROUTINE rd_routine, PKNORMAL_ROUTINE nor_routine, unsigned char mode, void *context);

    void KeInsertQueueApc(struct _KAPC *APC, void *SysArg1, void *SysArg2, unsigned char arg4);

  • CreateRemoteThread backdoor

    backdoor byshell monitor thread&process

  • backdoor byshell HANDLE OpenProcess( DWORD dwDesiredAccess,

    BOOL bInheritHandle, DWORD dwProcessId ); LPVOID VirtualAllocEx( HANDLE hProcess, LPVOID

    lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect );

    BOOL WriteProcessMemory( HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_TnSize, SIZE_T* lpNumberOfBytesWritten );

    HANDLE CreateRemoteThread( HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_TdwStackSize, LPTHREAD_START_ROUTINElpStartAddress, LPVOID lpParameter, DWORDdwCreationFlags, LPDWORD lpThreadId );

  • monitor thread&process

    PsSetCreateProcessNotifyRoutine(ProcessCreateMon, FALSE) PsLookupProcessByProcessId((ULONG)PId, &EProcess); PsSetCreateThreadNotifyRoutine(ThreadCreateMon); PsLookupThreadByThreadId((PVOID)4, &Thread);

  • Windows Kernel shellcodeExploit Ring3->Ring0 Exploit Apc inject

  • Ring3->Ring0 OpenPhysicalMemory() MapPhysicalMemory( )

  • Exploit Apc inject Demo

  • Exploit Demo Microsoft Jet Database Engine DB

    File Buffer Overflow Exploit Microsoft Exchange Server Remote

    Code Execution Exploit (MS05-021) Microsoft Internet Explorer

    "javaprxy.dll" Command Execution Exploit

  • Q&A

  • Reference

    Remote Windows Kernel Exploitation - Step Into the Ring 0 (pdf)http://www.eeye.com/~data/publish/whitepapers/research/OT20050205.FILE.pdf

    ring3->ring0 code by http://zzzevazzz.blogchina.com/427939.html monitor thread&process

    http://www.xfocus.net/articles/200503/788.html Inside Microsoft Windows 2000 Byshell backdoor

    http://www.xfocus.net/tools/200412/943.html

    MSDN


Shellix: An Efficient Approach for Shellcode Detection€¦ · Keywords: Shellcode Detection, Payload Execution, Hardware-based, OS Kernel 1. Introduction Code injection attacks are

Anatomy of a Remote Kernel Exploit - Dartmouth … of failed remote kernel exploit: Kernel panic, game over Copyright © 2011 Virtual Security Research, LLC. All Rights Reserved. 9

The Path to Ring-0 (Windows Edition) - insomniasec Path...Anatomy of a Kernel Exploit (Write-What-Where) 9/04/2018 The Path To Ring-0 –Windows Edition (Confidential) Shellcode Copy

Shellcode · 2019. 4. 4. · Shellcode Shellcode Properties Should be small Because we maybe have small buffers in the vulnerable program Position Independent Don’t know where it

k-Depth Mimicry Attack to Secretly Embed Shellcode into ... · In a shellcode injection method, an exploit is crafted to fool the targeted application (e.g., Microsoft O ce and Adobe

Anatomy of a Remote Kernel Exploit - Lagout.org · Exploit development methodology ... Trapping to kernel mode is relatively expensive Check CPL, switch stack, store trap frame, reload

Exploitation techniques for NT kernel...code located in kernel space (harder but SMEP bypass) Figure 1:Shellcode type overview Adrien ‘Adr1’ Garin (EPITA) Exploitation techniques

CNIT 127: Exploit Development Ch 3: Shellcode · • ld GNU Linker • objdump to see contents of object files • strace System Call Tracer ... instruction can make the program crash

Kernel&Exploit&SampleHunting&andMining&a!surprise!if!we!donot!see!Windows!kernel!exploit!involvedinsuchtargetedattacks.!! ItisalsoworthnotingthatbesideAPTattackers,thebotnetoperatorsalsoseizetheopportunityto!

ASLR Win7 Shellcode Exploit Pekeinfo

Anatomy of a Remote Kernel Exploit - Security …vulnfactory.org/research/h2hc-remote.pdfConsequence of failed remote kernel exploit: Kernel panic, game over Copyright © 2011 Virtual

CNIT 127: Exploit Development Ch 3: Shellcode · 9/4/2019  · • ld GNU Linker • objdump to see contents of object files • strace System Call Tracer ... • Any illegal instruction

Introduction to Shellcode Development

Shellcode Penetrate Firewall

Shellcode Detection in IPv6 Networks with HoneydV6 · 2017. 11. 29. · Shellcode detection and analysis Shellcode detection mechanisms libemu C library developed in 2007 used by

Lec02: x86_64 / Shellcode

KOOBE: Towards Facilitating Exploit Generation of Kernel ... · 1216 Linux kernel bugs discovered and fixed during a single year (from Aug 2017 to Sep 2018). •One promising direction

Windows Kernel Shellcode Exploit - HITCON

WLSI Windows Local Shellcode Injection - Black Hat€¦ · –Copy shellcode to shared section mapped at client process, this shellcode will be instantly mapped on target process

A Method for Shellcode Extractionfrom Malicious Document Files … · 2015. 11. 17. · shellcode is filled by (hexadecimal) 00, whereas the shellcode area has a random distribution

Shellcode 작성

Shellcode · 2018. 3. 1. · Shellcode Shellcode Properties Should be small Because we maybe have small buffers in the vulnerable program Position Independent Don’t know where it

FUZE: Towards Facilitating Exploit Generation for Kernel Use-After … · FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities Wei Wu⋆1,2,3, Yueqi

Shellcode injection

Linux Shellcode disassembling

CNIT 127: Exploit Development Ch 3: Shellcode. Topics Protection rings Syscalls Shellcode nasm Assembler ld GNU Linker objdump to see contents of object

Understanding Windows Shellcode - HiCK.ORG!

KERNEL WARS: KERNEL-EXPLOITATION DEMYSTIFIED · Introduction to kernel-mode vulnerabilities and exploitation • Why exploit kernel level vulnerabilities? – Attacks at the lowest

Enhancing the Open Source Storage System (and the Kernel) · • Soy Christian Kendi • I do … – IT-Security Consultant – (Kernel)-Developer – Penetration tester – Exploit

Kernel&Exploit&SampleHunting&andMining& - HITBexploit,!we!realized!thatitwasthefirstmalwareexploitingvulnerabilityspecifiedinCVE B2015B0057.!

FUZE: Towards Facilitating Exploit Generation for Kernel Use-After … · 2019-12-18 · FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities 1

Shellcode Detection in IPv6 Networks with HoneydV6 · Shellcode Detection in IPv6 Networks with HoneydV6 ... Shellcode detection and analysis Outline 1 Introduction ... Online malware

Writing kernel exploits - GitHub Pageskmcallister.github.io/talks/security/2012-kernel-exploits/talk.pdf · Exploit overview Assume we can run code as an unprivileged user. Trick

WiShMaster - WIndows SHellcode MASTERy · Such manipulations are considerably simplified if the program is a shellcode. There are a few solutions to obtain a shellcode: one is to

Kernel Pool Exploitation on Windows 7 - anti-reversing.com · •How To Exploit Windows Kernel Memory Pool •Presented by SoBeIt at XCON 2005 •Proposed two write-4 exploit methods