SlideShare a Scribd company logo
Vulnerability design
PATTERNS
case: Kernel mode
PAST
Environment for exploitation
Simple
ioctl
W^X NX KASLR
Hardened
Pool
SMEP SMAP
Why kernel exploitation
Full control of
system
Simple
exploitation
Simple bugs
KERNEL ESCAPE
few lines of code, simple, effective – for that time
Modified sample from : https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sock_sendpage.rb
EVOLUTION
Exploitation hierarchy
User
Elevated user
(admin / root)
supervisor
Past exploitation shortcut
User
Elevated user
(admin / root)
supervisor
Present (+-) & Future : Step by step
User
Elevated user
(admin / root)
Supervisor
• DEP, ASLR, SEHOP, ProtectedFree, Isolated Heap, CFG,
Virtual Table Guards, EMET...
• sandbox, SELinux and alikes
• KASLR, SMEP, SMAP, ..
Why kernel escape
• Going to be more and more difficult, but ...
• still .. sometimes easier .. shortcut
• Natural bypass of SELinux
• Full control (cpl0 > cpl3)
• for now do not considering cpl-1, ...
exploitation ==> developing
• In past was very easy elevate privileges
• Now everything is fast moving
• You need to adapt to all changes & diversity
• Things are getting more complex
• Your exploitation code is expanding dramatically
• Every change can broke your black-box
• + Process of exploitation need more than ioctl
• Race conditions, complex mechanism break (ttf), sandbox
escapes ...
VULNERABILITY DESIGN PATTERNS
kernel case
selected vulnerability classes
• Out Of Boundary
• Basic types Over/Under flows
• Stack overflows
• Buffer overflows
• nullptr writes
• Race conditions –not generic, but ...
• may create other bug from above group
Out Of Boundary
Simple, mighty, generic
OOB
• Read
• Write
• SMAP – limitation, but not
eliminate oob
• GENERIC approach
Basic type Over/Under-flow
Generic, simple and useful when it comes to aligned rw
Stack Overflow
sometimes protected, sometimes not .. local vars ?
.. depends on compilation ..
Stack overview
• Local vars
• canaries
• Protect ret & args
• ... sometimes ... missing
• UNprotected inner calls ?
• Arg in main func preserved in register
• Inner call invoked, register may be putted onto stack
• Rewrite arg (or directly ret) on stack in inner call
• Return to main func with altered arg (in register)
• Can help more than it seems ;)
• Controlled copy, overwrite save your day
Buffer Overflow
Common case, can be also byproduct, heap hardening can be
problem
Buffer overview
• Windows kernel pool, SLUB
• not so predictable anymore
• but still far from not-predictable at some level
• kmalloc
• targeted kmalloc from user mode ?
• not so hard as can seems
• help with predictability
• Pool spray
• thread, process, pipe, socket ...
• caches (linux)
• can be problem for precise pool layout, but can be solved
nullptr pwn
spray, write, pwn .. 64b bit more effort ...
user part of cake
Pool
spray
kmalloc
Pipes
ThreadsLocks
ret2dir
Kernel IO
kernel pool
pipes, threads .. kmalloc .. spray
Kernel IO
If doable, then almighty ...
workers, locks, helpers
a lot of common issues per vuln task
CODING STYLE MATTERS
Elevation of Privilages
USER
• Find nt!_eprocess /
thread_info
• Patch credentials
• Bypass ACL policy
• Reverse engineer per policy
• Implement
• Keep up to date
• Good if not change
frequently .. Not that case 
KERNEL
• Elevate process
• Grant access important
operations (callbacks)
• File access
• Process access
• Registry access
• Network
• How effective without
framework ?
Kernel part of cake
• Boosting privs
• Why patching ?
• Recognize and grant access instead
• No LKM ? Are you sure ?
• Kernel exploitation may be equals to enable LKM
CC-shellcoding framework
• developing instead of shellcoding ?
• C++, boost, std ?
• Loading your own kernel modules ?
https://github.com/k33nteam/cc-shellcoding
more info : http://www.k33nteam.org/blog.htm -
CC-SHELLCODING
@KEENTEAM
2014 - $500,000
2015 - $??????? Pick a device, name your own challenge!
We are hiring!
 Kernel & app sec
 A LOT of research
 mobile, pc
 M$, android, OSX ..
Thank You! Q & A
@K33nTeam

More Related Content

PPTX
Guardians of your CODE
PPTX
Back to the CORE
PPTX
Racing with Droids
PPTX
Power of linked list
PPTX
Attack on the Core
PPTX
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
PDF
DeathNote of Microsoft Windows Kernel
PPTX
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Guardians of your CODE
Back to the CORE
Racing with Droids
Power of linked list
Attack on the Core
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
DeathNote of Microsoft Windows Kernel
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes

What's hot (20)

PDF
When is something overflowing
PPTX
Ice Age melting down: Intel features considered usefull!
PDF
Rainbow Over the Windows: More Colors Than You Could Expect
PPTX
Security research over Windows #defcon china
PPTX
How Safe is your Link ?
PPTX
Hacking - high school intro
PDF
How to Root 10 Million Phones with One Exploit
PPTX
Steelcon 2014 - Process Injection with Python
PPTX
Memory Corruption: from sandbox to SMM
PDF
PPTX
Practical Windows Kernel Exploitation
PDF
For the Greater Good: Leveraging VMware's RPC Interface for fun and profit by...
PDF
One Shellcode to Rule Them All: Cross-Platform Exploitation
PDF
Modern Evasion Techniques
PPTX
Software to the slaughter
PDF
Process injection - Malware style
PDF
Is That A Penguin In My Windows?
PDF
Defcon 22-colby-moore-patrick-wardle-synack-drop cam
PPTX
BSides Hannover 2015 - Shell on Wheels
PDF
NSC #2 - D3 02 - Peter Hlavaty - Attack on the Core
When is something overflowing
Ice Age melting down: Intel features considered usefull!
Rainbow Over the Windows: More Colors Than You Could Expect
Security research over Windows #defcon china
How Safe is your Link ?
Hacking - high school intro
How to Root 10 Million Phones with One Exploit
Steelcon 2014 - Process Injection with Python
Memory Corruption: from sandbox to SMM
Practical Windows Kernel Exploitation
For the Greater Good: Leveraging VMware's RPC Interface for fun and profit by...
One Shellcode to Rule Them All: Cross-Platform Exploitation
Modern Evasion Techniques
Software to the slaughter
Process injection - Malware style
Is That A Penguin In My Windows?
Defcon 22-colby-moore-patrick-wardle-synack-drop cam
BSides Hannover 2015 - Shell on Wheels
NSC #2 - D3 02 - Peter Hlavaty - Attack on the Core
Ad

Similar to Vulnerability desing patterns (20)

PDF
1000 to 0
PPTX
antoanthongtin_Lesson 3- Software Security (1).pptx
PDF
Unix executable buffer overflow
PPTX
Operating system enhancements to prevent misuse of systems
PDF
Linux Kernel Exploitation
PPTX
Fun with exploits old and new
PDF
Hacking the Linux Kernel - An Introduction
PPTX
Linux remote
PDF
Filip palian mateuszkocielski. simplest ownage human observed… routers
PDF
Simplest-Ownage-Human-Observed… - Routers
PPTX
Fundamentals of Linux Privilege Escalation
PDF
Aide 2014 - Fundamentals of Linux Privilege Escalation
PPTX
Linux privilege escalation 101
PDF
DefCon 2012 - Rooting SOHO Routers
PPTX
ETCSS: Into the Mind of a Hacker
PDF
Introduction to Memory Exploitation (CppEurope 2021)
PPTX
Anatomy of a Buffer Overflow Attack
PPTX
Linux security
PDF
Linux Security Crash Course
ODP
CISSP Week 14
1000 to 0
antoanthongtin_Lesson 3- Software Security (1).pptx
Unix executable buffer overflow
Operating system enhancements to prevent misuse of systems
Linux Kernel Exploitation
Fun with exploits old and new
Hacking the Linux Kernel - An Introduction
Linux remote
Filip palian mateuszkocielski. simplest ownage human observed… routers
Simplest-Ownage-Human-Observed… - Routers
Fundamentals of Linux Privilege Escalation
Aide 2014 - Fundamentals of Linux Privilege Escalation
Linux privilege escalation 101
DefCon 2012 - Rooting SOHO Routers
ETCSS: Into the Mind of a Hacker
Introduction to Memory Exploitation (CppEurope 2021)
Anatomy of a Buffer Overflow Attack
Linux security
Linux Security Crash Course
CISSP Week 14
Ad

Recently uploaded (20)

PPTX
Essential Infomation Tech presentation.pptx
PPT
Introduction Database Management System for Course Database
PDF
Audit Checklist Design Aligning with ISO, IATF, and Industry Standards — Omne...
PPTX
Odoo POS Development Services by CandidRoot Solutions
PDF
Adobe Illustrator 28.6 Crack My Vision of Vector Design
PDF
Digital Strategies for Manufacturing Companies
PPTX
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
PPTX
Online Work Permit System for Fast Permit Processing
PDF
Upgrade and Innovation Strategies for SAP ERP Customers
PDF
2025 Textile ERP Trends: SAP, Odoo & Oracle
PDF
Softaken Excel to vCard Converter Software.pdf
PPTX
history of c programming in notes for students .pptx
PPTX
Materi-Enum-and-Record-Data-Type (1).pptx
PDF
Claude Code: Everyone is a 10x Developer - A Comprehensive AI-Powered CLI Tool
PPTX
ai tools demonstartion for schools and inter college
PPTX
L1 - Introduction to python Backend.pptx
PPTX
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
PDF
How to Migrate SBCGlobal Email to Yahoo Easily
PDF
System and Network Administration Chapter 2
PPT
JAVA ppt tutorial basics to learn java programming
Essential Infomation Tech presentation.pptx
Introduction Database Management System for Course Database
Audit Checklist Design Aligning with ISO, IATF, and Industry Standards — Omne...
Odoo POS Development Services by CandidRoot Solutions
Adobe Illustrator 28.6 Crack My Vision of Vector Design
Digital Strategies for Manufacturing Companies
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
Online Work Permit System for Fast Permit Processing
Upgrade and Innovation Strategies for SAP ERP Customers
2025 Textile ERP Trends: SAP, Odoo & Oracle
Softaken Excel to vCard Converter Software.pdf
history of c programming in notes for students .pptx
Materi-Enum-and-Record-Data-Type (1).pptx
Claude Code: Everyone is a 10x Developer - A Comprehensive AI-Powered CLI Tool
ai tools demonstartion for schools and inter college
L1 - Introduction to python Backend.pptx
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
How to Migrate SBCGlobal Email to Yahoo Easily
System and Network Administration Chapter 2
JAVA ppt tutorial basics to learn java programming

Vulnerability desing patterns

  • 3. Environment for exploitation Simple ioctl W^X NX KASLR Hardened Pool SMEP SMAP
  • 4. Why kernel exploitation Full control of system Simple exploitation Simple bugs
  • 5. KERNEL ESCAPE few lines of code, simple, effective – for that time Modified sample from : https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sock_sendpage.rb
  • 8. Past exploitation shortcut User Elevated user (admin / root) supervisor
  • 9. Present (+-) & Future : Step by step User Elevated user (admin / root) Supervisor • DEP, ASLR, SEHOP, ProtectedFree, Isolated Heap, CFG, Virtual Table Guards, EMET... • sandbox, SELinux and alikes • KASLR, SMEP, SMAP, ..
  • 10. Why kernel escape • Going to be more and more difficult, but ... • still .. sometimes easier .. shortcut • Natural bypass of SELinux • Full control (cpl0 > cpl3) • for now do not considering cpl-1, ...
  • 11. exploitation ==> developing • In past was very easy elevate privileges • Now everything is fast moving • You need to adapt to all changes & diversity • Things are getting more complex • Your exploitation code is expanding dramatically • Every change can broke your black-box • + Process of exploitation need more than ioctl • Race conditions, complex mechanism break (ttf), sandbox escapes ...
  • 13. selected vulnerability classes • Out Of Boundary • Basic types Over/Under flows • Stack overflows • Buffer overflows • nullptr writes • Race conditions –not generic, but ... • may create other bug from above group
  • 14. Out Of Boundary Simple, mighty, generic
  • 15. OOB • Read • Write • SMAP – limitation, but not eliminate oob • GENERIC approach
  • 16. Basic type Over/Under-flow Generic, simple and useful when it comes to aligned rw
  • 17. Stack Overflow sometimes protected, sometimes not .. local vars ? .. depends on compilation ..
  • 18. Stack overview • Local vars • canaries • Protect ret & args • ... sometimes ... missing • UNprotected inner calls ? • Arg in main func preserved in register • Inner call invoked, register may be putted onto stack • Rewrite arg (or directly ret) on stack in inner call • Return to main func with altered arg (in register) • Can help more than it seems ;) • Controlled copy, overwrite save your day
  • 19. Buffer Overflow Common case, can be also byproduct, heap hardening can be problem
  • 20. Buffer overview • Windows kernel pool, SLUB • not so predictable anymore • but still far from not-predictable at some level • kmalloc • targeted kmalloc from user mode ? • not so hard as can seems • help with predictability • Pool spray • thread, process, pipe, socket ... • caches (linux) • can be problem for precise pool layout, but can be solved
  • 21. nullptr pwn spray, write, pwn .. 64b bit more effort ...
  • 22. user part of cake Pool spray kmalloc Pipes ThreadsLocks ret2dir Kernel IO
  • 23. kernel pool pipes, threads .. kmalloc .. spray
  • 24. Kernel IO If doable, then almighty ...
  • 25. workers, locks, helpers a lot of common issues per vuln task
  • 27. Elevation of Privilages USER • Find nt!_eprocess / thread_info • Patch credentials • Bypass ACL policy • Reverse engineer per policy • Implement • Keep up to date • Good if not change frequently .. Not that case  KERNEL • Elevate process • Grant access important operations (callbacks) • File access • Process access • Registry access • Network • How effective without framework ?
  • 28. Kernel part of cake • Boosting privs • Why patching ? • Recognize and grant access instead • No LKM ? Are you sure ? • Kernel exploitation may be equals to enable LKM
  • 29. CC-shellcoding framework • developing instead of shellcoding ? • C++, boost, std ? • Loading your own kernel modules ? https://github.com/k33nteam/cc-shellcoding more info : http://www.k33nteam.org/blog.htm - CC-SHELLCODING @KEENTEAM
  • 30. 2014 - $500,000 2015 - $??????? Pick a device, name your own challenge!
  • 31. We are hiring!  Kernel & app sec  A LOT of research  mobile, pc  M$, android, OSX .. Thank You! Q & A @K33nTeam