![[???????] Docker? ??? Gitlab CI/CD ?? ???](https://cdn.slidesharecdn.com/ss_thumbnails/dockergitlabci-cd-180103202327-thumbnail.jpg?width=560&fit=bounds)
More Related Content
What's hot (20)
Similar to Windows kernel basic exploit (20)
![[NDC17] Kubernetes? ???? ??? ????](https://cdn.slidesharecdn.com/ss_thumbnails/ndc-170529041601-thumbnail.jpg?width=560&fit=bounds)
![[???????]?????? ??? ???? ??](https://cdn.slidesharecdn.com/ss_thumbnails/opensourceconsutingkubernetesv0-191010000815-thumbnail.jpg?width=560&fit=bounds)
![[????????] ??? ???? ??? init script ??? ??(??? ???? ??? ????)](https://cdn.slidesharecdn.com/ss_thumbnails/webinarinitscript-190920075213-thumbnail.jpg?width=560&fit=bounds)
![[??????????] Contribution, ??? ?? : Apache OpenWhisk ?? ?? - ???](https://cdn.slidesharecdn.com/ss_thumbnails/apacheopenwhiskpublicfont-180905052401-thumbnail.jpg?width=560&fit=bounds)
![[225]yarn ??????? deep learning application cluster ????? ????????](https://cdn.slidesharecdn.com/ss_thumbnails/225yarndeeplearningapplicationcluster-161025031031-thumbnail.jpg?width=560&fit=bounds)
![[OpenTRS-001] Hotel California](https://cdn.slidesharecdn.com/ss_thumbnails/hotel-california-190621092500-thumbnail.jpg?width=560&fit=bounds)
Windows kernel basic exploit
- 2. Who Am I ? ????? 15?? ??? ? BoB 6? ??? ?? ? ?? ??? ???? ??? ? ?? ????
- 3. ?? 1? C Internal 1. Kernel Internal 2. Kernel Hooking 2? C Exploit Skills 1. Hacksys Driver 2. Stack Overflow 3. Stack Overflow GS 4. Arbitrary Write 5. Null Pointer Dereference 6. Recent Windows Mitigation
- 6. Kernel Internal ? Kernel Syscall ?? ?? ? int 0x2e ? xp ??? ??? syscall ? ????? ?? interrupt ???? ??? ?? ? SYSENTER ? xp ???? ??? syscall ? int 0x2e?? ?? syscall? ????
- 7. Kernel Internal Ntdll.dllKernel32.dll USER level KERNEL level nt!KiFastCallEntry SYSEXIT Native API nt!KiSystemCallExi t SYSENTER (MSR 0x176) ntdll!KiFastSystemCallRet SSDT nt!... nt!... nt!...
- 8. MSR register? ? ??? ??? ??? ? ?? ??? control Register ? SYSENTER ???? ???? ?? ??? ????. Code Segment <- MSR 0x174 (IA32_SYSENTER_CS) Stack Segment <- IA32_SYSENTER_CS + 8 EIP Register <- MSR 0x176 (IA32_SYSENTER_EIP) - KiFastCallEntry ESP Register <- MSR 0x175 (IA32_SYSENTER_ESP)
- 9. Kernel Hooking ? ???? Kernal Fuzzer? ???? ?? call flow case? ?? ? ??? ?? ? Target ??? ??? ??? ?? ??? ?? ＾Kernel syscall ?? ? argument, return value? ?? ? ? ?? ??? ????? ?? ??!￣
- 10. Kernel Hooking ? Kernel Hooking? ?? ?? API ???? ?????, API ??? ???? ? ??! ??? ??? ?? ?? ? ?? : ???? ?? ? ??? ??
- 11. ? ?? ?????? ?? ??... ? ?10 ?? ???? ?7?? ????? ?? ????? ?? ? ?????... ? Windbg ??? ?? Windows Driver develop
- 12. Kernel Hooking C MSR Hooking Ntdll.dllKernel32.dll USER level KERNEL level nt!KiFastCallEntry SYSEXIT nt!KiSystemCallExit DBGPrint argument Hook MSR ntdll!KiFastSystemCallRet SSDT nt!... nt!... nt!... Native API
- 13. Kernel Hooking C MSR Hooking 1. rdmsr ???? ?? KiFastCallEntry ?? ?? 2. wrmsr ???? ?? HookFunction ??? MSR Register? ? ? ?? 3. HookFunction??? Argument ??? ?? ??? ? ??? ?? KiFastCallEntry? jmp
- 14. Kernel Hooking C MSR Hooking 1. save MSR 176
- 15. Kernel Hooking C MSR Hooking 2. write MSR 176
- 16. Kernel Hooking C MSR Hooking 3. HookFunction
- 17. Kernel Hooking C MSR Hooking Success!
- 18. Kernel Hooking ? But how to print return value? ? ntdll!KiFastSystemCallRet? ???? return value? ????! User land?? Dll ??? ?? Copy on Write ??? ?? ?? ???? ? ??? ?? ?? ??? ???? ? ?? nt!KiSystemCallExit? ??? ??!
- 19. Kernel Hooking C Inline Hooking
- 20. Kernel Hooking C Inline Hooking Ntdll.dllKernel32.dll USER level KERNEL level nt!KiFastCallEntry SYSEXIT nt!KiSystemCallExit DBGPrint argument Hook MSR ntdll!KiFastSystemCallRet DBGPrint return SSDT nt!... nt!... nt!... Native API Inline Hooking
- 21. Kernel Hooking C Inline Hooking 1. ?? ??? ??? Inline Hoking ? nt!KiSystemCallExit ?? ??
- 22. Kernel Hooking C Inline Hooking 2. nt!KiSystemCallExit? HookedFunction? jmp ?? Inline Hooking? ?
- 23. Kernel Hooking C Inline Hooking 3. Inline Hooking? ?? ??? HookedFunction
- 24. Kernel Hooking C Inline Hooking Success! but...............................
- 25. Kernel Hooking ? ?? ?? ?? ? ????... ? ?? ?? ? ?? ???? ?? ?? ?? ?? ? User land?? ????? ???
- 26. ??? ???? ??? ?? ??~
- 27. 2? C Exploit Skills
- 28. Windows Integrity ? Windows? ?? ????? ??? ??? ?? ??? ?? ? ? ? UNTRUSTED - Anonymous ? LOW C Everyone, can not access to local resources ? MEDIUM C Authenticated Users ? HIGH C Administrators ? SYSTEM C LocalSystem, LocalService...
- 29. HackSysExtremeVulnerableDriver ? Hacksysteam?? ??? ???? ?? ???? ????? ??? ? ? ?? ?? Driver Double Fetch Pool Overflow Use After Free Uninitialized Heap Variable Uninitialized Stack Variable Insecure Kernel Resource Access Stack Overflow Stack Overflow GS Arbitrary Overwrite Null Pointer Dereference Type Confusion Integer Overflow easy hard
- 30. HackSysDriver Setting ? ??? ? Virtual KD C VMWare? ????? Windbg? ???? Windows ?? ?? ???? ???? ?? ? ? ? Windbg ? HEVD.sys C hacksys ??? ???? ?? sys ?? ? OSRLOADER C Driver load, unload? ???? ?? ? ?
- 31. HackSysDriver Setting ? ?? Windows ????? Windbg? ?? ? ?? ? HEVD.sys ??? ?? ?????? OSRLOADER? ???? ???? ??? ??
- 32. HackSysDriver Trigger IN Driver
- 33. HackSysDriver Trigger IN User
- 34. Input Buffer IRP I/O Manager User Kernel (Driver) IO_STACK_LOCATION HackSysDriver Trigger User -> Driver
- 35. Stack Overflow
- 36. Stack Overflow
- 37. 1. ?? ????? EPROCESS ??? ?? Stack Overflow
- 38. 2. SYSTEM ????? EPROCESS ??? ?? (PID = 4) ... Stack Overflow
- 39. 3. SYSTEM EPROCESS ????? Token ? ?? ? ? EPROCESS ???? ???? Stack Overflow
- 40. Windows 7 has no SMEP. let¨s call user shellcode function. Stack Overflow
- 41. Stack Overflow? ??? ?? Stack Overflow GS
- 43. ? Stack Cookie ?? ?? ? 1. Stack Cookie leak ? 2. Stack Cookie Failure check ?? ?? ?? EIP register control Stack Overflow GS
- 44. Case Userland End Of Stack Segment ... SE handler nSEH ... retn sfp Cookie buffer aaaa ... pop pop ret shellcode ... aaaa aaaa aaaa aaaa Stack Overflow GS
- 45. Case Kernelland memory fault exceptions that occur in kernel memory areas are not handled by exception handlers, but only crash the OS. So generate a memory fault exception due to the access of an unmapped page in userland. Stack Overflow GS
- 46. Arbitrary Write ? Write What Where
- 47. Arbitrary Write ? exploit ?? ?? ?? ??! ? SSDT Overwrite ? Hal Dispatch Table Overwrite ? TokenObject-> Privileges.Enabled Field Overwrite ? Hal Dispatch Table Overwrite? ???? ????!
- 48. Arbitrary Write
- 49. Arbitrary Write HalDispatchTable HalDispatchTable + 4Token Shellcode NtQueryIntervalProfile KeQueryIntervalProfile Userland Kernalland call NtQueryIntervalProfile
- 50. Arbitrary Write ? Hal Dispatch Table ????! ? Windows 7??? ????? NtQuerySystemInformation API? ?? ?? ??? ??? ?? ? ??
- 53. Null Pointer Dereference ? ???? ?? 0x00000000 ??? ???? ??? ? ? 0x00000000 ? ??? ??? ??? ??! ? ｀VirtualAlloc¨, ｀VirtualAllocEx¨? 0x00001000?? ?? ?? ? undocumented function NTAPI ｀NtAllocateVirtualMemory¨??
- 54. Windows 7 exploitation issue ? Executable NonPagedPool was the default ? Kernel ??? ??? ??? ?? ? ? ?? ? Kernel information leaks were available with NtQuerySystemInformation ? no SMEP, SMAP
- 55. Windows 8.1, 10 exploitation issue ? NonPagedPoolNx is the new default ? ??? ??? ???? ???! ? SMEP ? Windows 0xFFFFFFFFFD00448 (HAL Heap) contained a pointer to ntoskrnl.exe ? SIDT instruction leaks address of ntoskrnl.exe pointer (IDTR Register) ? Kernel address leak with GdiSharedHandleTable ? ROP base address ?? ? ??! ? Page Table Entry overwrite can bypass SMEP ? modify U/S flag
- 56. Mitigations Windows 10 1607 ? Remove Kernel address leak with GdiSharedHandleTable ? SIDT instruction leaks address of ntoskrnl.exe pointer mitigated ? ??? HAL Heap ???? ? ?? ? Page Table Entry Randomize
- 57. Mitigations Windows 10 1703 ? HAL Heap randomized ? now must leak ntoskrnl.exe pointer ? ?? base address ?? ? ??? leak ???
- 58. reference ? Hacksys Driver ? ?? https://github.com/hacksysteam/HackSysExtremeVulnerableDriver ? Hacksys Driver ??? https://hshrzd.wordpress.com/2017/06/05/starting-with-windows-kernel- exploitation-part-2/ ? Windows Kernel Architecture Internals - Dave Probert Windows Kernel Architect, Microsoft ? DEFCON-25-Morten-Schenk-Taking-Windows-10-Kernel-Exploitation-to- the-next-level-UPDATED
Editor's Notes
- #6: ??? ???? ?? ??, ???, IPC C ???? ? ??? ?? ????, ???? ???, ???, ?, ?? ??? ?? ?? HAL - ??????? PC? ???, CPU, ???? ??? ?? ?? ?? ?? ?, ???? ??? ?? Driver - ?? ??? ??? ??? ???? ????? ?? ?? PNP ???? C ?? ????? ??? ? ?? Legacy ???? C ???? ?? ?? ???? ???? ????? ??? ? ??
- #27: ??? ?? ??? ???? ?? ???? ?? ????...
- #30: ? ???? ?? ? Hacksys ? ???? ?? ??, ?? ??(SECURE?? ?)
- #32: ?? ??? ??? ??? https://hshrzd.wordpress.com/2017/06/05/starting-with-windows-kernel-exploitation-part-2/
- #33: CTL_CODE C DeviceType(??? ?? ??), Function(??? ??), Method, Access(??)
- #35: IRP(I/O Request Packet) C I/O ???? ???? ??? DeviceControl ??? ???? I/O ???? ????? ???? IRP? ??? ??? ? ? ???? ??? ????.