Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/407 Thanks!
Hello and welcome to my talk about Emet
Amore Cuttone.
My name is Jennifer Gruebel, and I'm
going to tell you something about exploit
development and especially about how to
pybus different mitigation techniques
in the next minutes.
So let's have a look at the plan for
today.
First of all, I will give you a short
introduction about my personal and my
company after that to come to the basics,
so I will introduce concepts
like address regulation or trade
execution prevention to you.
I will also talk about the Firefox
winnability, which I will use during this
talk to demonstrate the proposed
techniques on top of it after that
to come to the first event related
chapter. It's about finding or locating
Emmett in memory, and we will
see why this is important in this
chapter. And after that, I come to
advance cautery use technique, which
is a technique which is already public,
well-known by explorer developers.
But I think if you are trying to talk
about how it can be bypassed, this
technique is really useful and that's why
I've included it here.
After that, we come to a different
mitigation techniques of Emet so that
they would talk about five different
protections.
So the return or indeed the programing
protections and about address base
protection and how we can prevent these
mitigation techniques
at the end. I will give you some final
thoughts and show you the demonstration.
And you also have time to ask him some
questions.
As already mentioned, money invested in
different groups are working since
about two years ago as a security
consultant at a concert.
And I'm also currently a student at the
Technical University of Vienna.
I am doing there my bachelor's thesis
about exploitation.
And I really want to thank my professor,
Kristin Platzer Sorry
that he gave me
this possibility to write about such a
great topic.
I also have here once lied about my
company second site.
I think the most interesting part for you
is that we are currently hiring.
So if you want to work as a security
consultant in Germany, just drop me
a mail or just go to our website or come
to me after the talk.
Now, BASIX.
Expectation was quite easy 15
years ago, so in the year 2000, if you
have to write Buffalo or follow a state
based buffalo, you just have to pay it
until you reach the return address or at
the return address was a hard call.
That address pointing again to the SEC
and police the area code and are
scheduled to be executed.
And everything is working nowadays.
Everything becomes a little bit harder
because we have many, many different
protections there, which must be
bypassed.
So are on the left side, you see a
picture of some of the names of these
protections.
This is not a complete list, but from the
perspective of the tech, we have to
bypass all these mitigation techniques.
And the two biggest ones here are
teeth, execution, prevention, depth and
address. Islamisation Yesil are
just a quick question.
Who have, you know, state execution
prevention? Just raise your hand.
OK, it's good to have, you know,
address mispronunciations.
OK, so just go very quickly
over this and then we move on.
The idea of addressing Islamisation is
that everything is loaded at a random
address in the memory.
So first start Firefox's or any
application two times everything.
The old code sections or data sections
will be loaded, a random address so
fraught. So from the perspective of the
attacker, I don't know anything
where the data is in memory
and the idea of data execution
prevention. On the other side is that
data which is stored on a stack or under
the heap, there should just be data
stored, which is read and write, but not
executable.
So that means I can just make a sound,
uh, the pictures as read
and write, but not as executable.
That means if I stole my childhood on a
stack and tried to execute it, it would
just segmentation for it because this
page is not marked as executable.
And yes,
that typical of to the state execution
prevention is to use a technique which is
called return data.
That means I'm just returning to already
existing caught in the program.
So I'm just executing one, two, three
instructions which are currently there in
the program and then return to the next
one to three and structure instructions
and then train all these instructions
together. The new logic in the program,
for example, logic to disable data
execution prevention and
see why it's so hard to address B
sterilization and execution prevention
together, because if SLR
is also there, this address of this
already exists in Courtice randomized.
So I don't know where this already
existing code is stored in memory.
So the typical way is the first thumbhole
address Islamisation, for example.
I can turn to winnability into an
information disclosable winnability
by making Patchell overwrites or I
think the length of Springfields or
something like that, and then leaked
the base address of one module.
And based on this module attent
developer option to disable data
execution prevention, you will see this
concept in some slides, some
later slides, and I'll
show you the Firefox winnability
and this case I have chosen
the Firefox array, right winnability,
which is a little bit older once it's
from 2011, because
then I can show you the exploitation code
without risking that any attacker
can abuse this code here.
It also works very reliable against all
different kinds of operating systems to
starting from Windows XP suspect zero
until Windows eight, that one and two
Kampala's address Islamisation data
execution prevention.
We are not doing stuff like keep spraying
because he springs one technique which
can be used to defeat aggressive
Islamisation, because the idea is
that it just store the data in the
complete memory range.
So just spraying the data is a complete
memory range. That means you can use any
address because the data is everywhere.
And the problem here is that the price
would freeze for some seconds
while we are doing the spraying.
And that means that the victim could
notice that an attack is ongoing.
And this case, if the victim goes to my
website, you really notice nothing.
So there is no difference.
The price is not crashing.
It just looks like a normal website.
It is just infected with my payload.
Unfortunately, I don't have enough time
to talk about all details of this
winnability today.
So if you want to find out more, just
have a look at this great talk by
Heartiness.
It's called A Tale of it's called a tale
of two Firefox's box.
You can find it on YouTube or just have a
look at my Petrilla work, which I will
release in two or three weeks.
For everyone who doesn't know the array
reduce functional dysfunction can
be used to invoke a callback functions on
all elements of
so giving one second.
So, yeah,
for anyone who does not know the reduced
function, it can be used to invoke a
callback function, all elements of an
array. So let's say that the callback
function is the print function.
It would just go to the first element,
invoked his function.
Also print the first element and
then the next one, print this one and so
on until it reaches the last element
and the array reviews right function
on the other side. Just start with the
last element, with the right element
and go from right to left.
And starting with the last element means
that you start with the element that
index length minus one.
And the problem is that in charge script,
you can just set the Langfield to any
value which we like.
In this case, if I said the Langfield to
a very huge value, like 060
Zero in this case.
The problem isn't that the index is
declared a sustained integer, and that
means that index can drop down to
negative number.
So I assign a length, a very
huge value index becomes negative,
and that means I can access elements
outside the scope of the array.
And you will see this here
on the next slide.
So if it's something at index zero
in the array, it would come up here
in memory first or something at index
one. It comes here.
You see the disarray here has a capacity
of six elements.
So we can store six elements here.
And if I try to index zero,
it says that this is a lot because six is
smaller than the capacity of the three.
So this is a lot. Another example is
if I try to access the last element,
this is also large.
But if I try to access higher elements,
elements outside the scope of this array,
this is not a lot.
But if I use a negative index,
this would be always a lot because only
the upper boundary is checked.
So I can access elements which are stored
in front of this disarray.
If I look at an array in transcript,
you would end up with this data structure
here. So we have your data
structure and I have different
fields describing disarray.
And as I mentioned, if I start something
at Index zero, it would come here at
index one. It would come to this location
here and every entry consists
of eight bytes.
So the first four parts are used to store
the data entry.
For example, if I store an integer, the
integer value would be stored here.
And the second two parts,
four parts are used to store
the data type.
For example, if it's a string, if it's an
object, if it's an integer and so on,
for if it would be and string,
it would just say here it's a string and
the first four part would be used as
a pointer pointing to a string data
structure.
You also see here that we
this disarray here has a fixed
size.
So, for example, I can just store 10
elements in this case here.
And if I try to add just one more
elements and distant elements, this green
array would be relocated.
This is lottery.
So it would come here to a new memory
location, which is bigger to fulfill the
request.
And then we have a pointer
at this point that's always pointing to
the actual used slots
array. So typically it's pointing to this
location.
But if it's going to be relocated, it
would be pointing to this new
used memory.
And I come to the first attack.
So what I have done is I just relocated
this array to
to a location of the fixed size 512
bytes. And then I just that made many,
many locations of the same size before
making this location.
The pins that have full control over the
memory, which is in front of this lottery
to the blue marked memory here is under
my control and I can send it to anywhere
else, which I like it for now.
Used to Langfield of Cecile's zero
and so on. It would become the negative
index minus one. That means I'm just
accessing working with this memory, which
is under my control, and here I can
just set the data. Type two five
zero zero five zero five
year means it's a string.
That means the first point thirty first,
what is interpreted as 3.0.
I can then just say at this point,
pointing again to my own data here
and there, specify fields
of the string, like the length of the
string or the address of the string.
And I can just say that this address is
pointing to the memory, which I want to
read, because then this code returns me
a string pointer and I can just read from
this string
you see here.
This is the implementation of this court
in script.
You see, this is the Langfield I just
said the dislocation here, the length
then invoked the religious right
functional, give the league function
ascorbic functional.
This is this function here.
Then the current element, which is pass
this argument is the element which is
under my full control.
It just verifies the data type is really
strong. And if it's something I just
said here by the
throw an exception to accept this reduced
function here and just catching
it here and just returning the string,
and I can read from the string the memory
which I want to read.
So I'm not able to read any memory in
this program.
The next step is to get called
executioner, the air can achieve
this by just changing the data from a
string to an object because every
object has at its start applying
to the actual paper.
And inside this virtual people watch
people virtual function pointers
are stored. So if you go a little bit
back.
If the data type of current
would be object, I would invoke this
line here, the type of function of it,
so it would just follow the object
pointer, then followed
the pointer inside this table at
this relative offset from the start
to the so the type of function
pointer and then just invoked this
type of function.
And since I have full control of the
point of the object, I would have full
control over the ultimate pointer.
That means I can just point out that it
point to my own data and can let
the type of function point to my
childhood and executed.
In this case, I've just chosen the set
element function instead because it has
some benefits, which allows me
that the process will not crash after
executing this winnability of tricking
winnability.
So the attack looks like this.
I just change the data type to zero
seven, which is the data type of an
object. That means the first you got to
interpret that as an object pointer.
If at the end follows the majority white
pointer, I come here.
This is the relative offset which is
added inside this virtual table to reach
the set element factor pointer.
And if I invoke dysfunctional, I
can just let it point to my own shoket
and to show good will be executed.
At the end, you see that I have sort
of called C3, which is the code for a
return, so this OP could have just
returned from the set element function
and Firefox would just continue
execution, as would nothing had happened.
The problem is this, is that.
This attack would just work against all
the systems like Windows XP suspect zero,
because the shareholders in this case
thought under heap and because of data
execution prevention, the heap is not
marked as executable.
That means we have for us to have to
somehow this evil data execution
prevention by using a rope chain.
And the problem of the rope chain is that
the next location to the next
address of the instructions is taken
from the location.
A stake point is pointing to.
So from the stake.
And as the name implies, Steck point
to stability, pointing to the attack, but
we don't have control over this location
there, so we cannot place the address
of the next instruction.
We only have control over this red marked
area here on the hip.
And that means that the first half is the
first Gachet have to somehow shift
from the stack to the hip to be
able to control the address of the next
Gachet.
So we have to find one such gadget and
we can do this by looking into the
Firefox's module.
If you have a look here, discordance from
the Firefox's module you see here,
this is a champ operation and this
jump operation started using two bytes.
So the 72 says it's a champ and
C nine would be the relative offset,
which goes upwards because it's bigger
than it is.
And the problem is that using retargeted
programing, we don't have to jump to the
return to the start of this in structure.
You can just return to the middle of it
and really interpret this code
here as a new instructions.
We can build new instructions which are
not there, but just jumping into the
middle of already existing instructions.
So if you look here, if
you just jump to the start of it, C9
would be now interpreted as a leaf
instruction.
And Leaf is exactly doing what I want to
do because it takes the content of the
base point, the biggest and most
enthusiastic pointer.
And the base point is currently pointing
to this red area, which is under my
control.
I have a quick digression about
how to find such propagators
a sink, because they're are quite bad in
time. I just skip this.
You can have a look at it after the talk.
But the basic idea is that making syntax
based searches like this case here,
there are many, many different
possibilities to make the same behavior.
This another instruction and you have to
try out all of them to find one because
they are in the program and this is
very time consuming.
So what I was doing is I was just using
my image to emulate the gadgets
and then start a behavior
based on this gadgets.
So, for example, I just started this
gadget, immolated this
gadget several times.
That's different, starting with business,
and then observe the behavior of it and
start to behave it together with
structured in the database.
And then I can McBee based
searches like Give me old gadgets, which
can be used to set this record store to
zero.
So this greatly reduces the workload.
And I come to the first Šemeta related
chapter.
So if you start and that he would end up
with this user interface on the upper
part, you can contribute
to the operating system that protects
us like data, execution, prevention or
recipe's. Liberalization is the HILDUR
running processes and which are protected
by Emet.
And if you click the button,
you can make fair process configurations.
In this case, I've just enabled all
protections for Firefox
and a now start my Firefox exploit.
You would see that Firefox just crashed
and at the bottom you see that amateur
detective tech is ongoing.
In this case, the tech pivot mitigation
technique detected this attack.
So just remember, for the latest tech
people, communication detected
that an attack is ongoing.
Before making before talking about
different techniques, we have to make
some general considerations.
So what we really want to do is we want
to protect against real world attackers.
So that means we have to think
think like a real world attacker because
they don't want to protect against some
very academic approach as an
academic by those techniques which are
just working against one specific
operating system.
So what are the codes of real world
attackers? They want a bypass technique
which works reliably
against all different kinds of operating
systems. So if 100
victims go to my website, I wanted 100
victims are infected and
it must work against all operating
systems and also suspect levels and
against all amateurishness.
And even if it is or is not there,
another nice thing is that the exploit
should be easy to reuse.
So, for example, if I spent one month
to develop all my father's techniques
for Firefox winnability, I just want to
make copy and paste if I to find out
winnability in Internet Explorer or
something like that, that I don't want
to spend another month to implement
everything from from scratch.
So this last scene brings us to the
idea that we can build everything
on top of Amathila because it works
by injecting its own library
to all protected applications.
And then it just took functions, critical
functions and say, execute my uncle
before invoking dysfunctional.
And if the checks succeed and walk to
function, if not, just terminate
the application before doing anything
else.
And is there anything else, a great
target to build everything on top of it?
Because if you have to bypass Emet, we
know rematerialize over there.
So if you write everything based
on Amathila on Firefox, we know
it's also there if I try to attack a top
reader or something like that.
So the first step is that we find Emmett
Till in memory, other researchers,
for example, the researchers from
Offensive Security, also
found ways to bypass Emmett and
approach from offensive security or to
require the different Emmett Till first
in memory. So I really recommend to
you that you have a look at this great
blog posts of offensive security,
only to talk about their technique.
But what they were doing is they just
assumed that one of the modules is
important to get module handle functional
and then they are just fighting a rope
chain which invokes this function and
give it as argument.
Emmett and dysfunctional just returned
image base of it.
But the problem in this case is that
if the mod if the attack, the application
is not important, dysfunctional, it's
just not apply.
And in addition, it adds additional
dependencies in some cases.
So I tend to develop my own approach.
I call this approach to hook approach.
And it's already mentioned Emmett
works by hooking critical functions.
So some examples for critical functions
are virtual ELAC or virtual protect
because they can be used to disable the
execution prevention.
Other examples are inexact because, of
course you can invoke any program
or load library because you can use it to
load an additional module from a window
share.
So from the attacker share.
And this way, Emmett can implement some
checks before invoking the function like
the detective of mitigation technique,
which we already saw in the picture.
So this defective mitigation technique
just checks if the stick point is
currently pointing to the stack or if it
was shifted away to the hip.
So in our case, we just shifted away.
And that's exactly how Emmett detected
an attack is ongoing here.
To understand the hook approach, we have
to take a look at the implementation of
the virtual protect a function
and how Emma talks this function.
So this is the implementation inside
concert, the tool of virtual protect
you see here, this
implantation is just for execution.
So this is the standard Prolog, which is
all this. There is a blind
trust review. What's the standard analog
here? And then we're just making a jump
to jump into the implementation
of it.
But if we protect now this application
is Emet, it would change
dysfunctional and just places here
a hook. So it would just make.
Replaces the first block with
a jump to its own court and then replaces
a random number of Pieterson the
breakpoint.
And if you follow this jump, the Supreme
Court will come to court, which
was allocated by Emet.
And you see here, it's just
pushing some some arguments sort of stack
and after that to make a final call
into Amytal.
So what the hook approach tries to do
is it just follows follows this first
hook, the first jump until it comes
to dislocation and then just goes
downwards and extracts that
address, which is used as called Target.
And as soon as I have a pointer in a
material, I can just go downward until I
find the beheader.
And then I've extracted the image space
zuheir something other interesting.
It's the third push value.
This value here, this
value points exactly the
dislocation here.
So because Amatus copied
of the old bytes the
old implementation of the function
and replaced them with the hook in court,
and it has to start out by somewhere
in memory. And this is exactly the
location where it was the old bytes.
This will be important in at the later
moment. So just remember it.
So this is a summary of the hook
approach, I'm just resolving to
the input address table entry of one of
the critical functions, then I can just
read the first five bytes.
If it's a move, if it's a move
in structure, I know that it's not there
because this function is not hooked.
That means I can just wander, explode
without any input purposes.
And if it's a chomper, just follow this
jump until I find that image space.
And yeah, then I'm done
here. This is a rope chain which
implements this quick
question. Who have you already written a
rope chain? Just raise your hand.
OK, I just go
over very quickly over the first three
lines and that everyone
everyone knows what's going on here.
So this is the address
which I write to the stakeholders.
This addresses are overwrites, the return
address.
And at this address, these
assemblance structures are stored.
So it would basically just
start executing disassembling structures.
It would execute a year
because the stack pointer is currently
pointing to this location.
It would just take this value here
and pop this value into the UK's register
and then start executing the next line,
which is this line here.
It would just make a move.
That means I just popped the
pointer to the virtual ELAC input
address table entry into X, and with
this line I'm just resolving the input
address table entry.
And the next line would just move
this content from the X register into
the idea register using some
push and pop because there was no move
instruction and so on that would just
continue doing the stuff
that you see here that I have used
hardcoded values based on the Emet
version.
So, for example, if it's Emet for that
one, I need to use this offset and
for a 5.0, I need to use this
disvalue.
And the problem is that currently I don't
really know which version is there.
So this approach is very bad.
So it would just work against against one
specific Emet version,
which is not what we like.
If I try to target a local application
like a video application or something
like that, I really have to write a
better option. But this is very, very
complex because then I have to make
additional jumps inside chain and
this increases the size a lot.
But if you are dealing with a proposal
like winnability, you can
apply this advanced country use
technique.
Basically, the idea of returning to the
program is that we reduce or abuse
over existing code in the program, but
if you are taking a Proserpina every day
or something like that, we know that
there must be court related to handle
data structures in Talisker, for example,
to handle strings.
And the idea is not that we can just use
a rock chain or the ability
to manipulate these data structures.
So, for example, we can just say that the
string is not pointing to a new location
and then return to Charley's script and
implement everything in a script.
I later found out that this approach was
already public
or discussed by Younggu
this year.
So have a look at this great talk if you
want to find out more about this.
Here are some examples of first examples
that you can just manipulate the string.
And let's say that the string is not
pointing to the hook in code and they can
implement the complete parsing inside
JavaScript.
Another very nice example is the third
example here.
In this example, we can just say that the
string starts at the code section of any
load of modules, for example, Amathila,
the Langfield, etc.
the length of this code section.
Then we can use functions such functions
like index off to search inside this code
section to dynamically find
charts. So we dynamically find the
relative offset for this captured
so we can save.
Tell me the location where I can find
a pop up return and structure
and that means I can just write my
exploit, for example, at 5.1
and if Microsoft later releases
M at four, five to two or something like
that, it would just
keep working because I could find
everything.
So using this technique, I can write
very reliable code
here. This is an implementation in such
a script, so I'm just calling this
arbitrarily kibbitz function,
which retransmit a string
from the address of the virtual lock
function. And then I can just use
excessive Turbit's and say, yeah, if
it's a moving structure, just
the right exploit without any input
purposes and if it's a Trump instruction.
I know. Am it there to just follow
this chump.
And just iterate and find
the instructions, so it would be the code
of the current structure.
I'm just looping until I find this call
instruction structure and then say, yeah,
if it's this code, it's a Suppan
structure. That means the size of
just skipped through parts if it's a
push and structure at five parts
and so on, until I find the code and
structure and as soon as I have found
the current structure, I can read the
header.
And in this case I'm just reading the
check Sonfield and the Time Standfield.
And based on these values, I can identify
which version of this they are set
and I know which version of this there
and the image base of it.
And I'll come to the different
protector's.
As already mentioned, it
contains five different alternative
agreement protections, and if you want to
bypass these protections, we have three
different possibilities, three different
approaches.
The first approaches that we can just
bypass each protection separately.
So this is described in this paper by
Todd DeMott gives a great
overview about it.
Another idea is that we can
use the tricks developed by offensive
security. So what they were doing
is they just reversed Amathila and found
out that there is a global flag and
difference. Laws like a set of forwards
or protections are just disabled.
So what they are doing is to trust a
rather shorter chain which disables
serious artist flag
and recommendatory.
My talks that Microsoft moves
this flag to a read-only location because
if it's read only, they cannot override
it.
But Microsoft has chosen
another approach with a 5.0.
They just include it to point to the
flag. But the problem is that recording
at this point is quite easy inside the
rope chain. So in the second blog post
from Offensive Security, they
used this approach. They just caught the
pointer and just apply the same technique
is the release of five to one.
Microsoft fixed it by using
a redounded section, as I mentioned.
But the problem now
is that there's a third trick.
So there's another trick which can be
used to bypass Emet.
A lot of sense of security is now doing
is they're just using you to sort trick
to make the S.A.
This the only section of.
Right. They block anything.
They can just apply the same trick by
overwriting this flag.
So as soon as this trick is not patched
by Microsoft, it's just possible applied
again and again.
But as soon as they would fix this,
this is a trick.
It would really require us that we bypass
each protection separately, which really
puts a higher workload on the attacker.
This approach was developed by myself
during my research, but I think
about the same time offensive security
also fantastic because it's
quite easy to find.
And here's the idea that you can just
make Darroch system codes because I'm
completely in userspace.
And if you just make a code directly to
the kernel and it has no way to to
somehow get in between of this and just
see that an attack is ongoing
and not talk about the different
protections separately and how we can
bypass them.
And at the end, I just talk a little bit
about the tricks.
Labor is the first protector and
to use the idea that emptiness.
They're taken from loading additional
modules from windowsills,
and I didn't really had to purchase
this one because I'm not loading any
additional modules from the shelves, but
it can have a look at this, bypassing all
of the things talked by Aroon Portnoy
if you want to see a bypass.
But I think this was just working for a
three to five.
But, yeah, finding a way
around this would not be too hard.
And protection is the main protective
protector.
Here is the idea that functions
like Protect and virtual ELAC
are prevented from making the stack
executable because the stack should
never, ever contain executable code.
And you can easily be bypassed
this one. But just making any other
location executable.
For example, the heap.
But this requires that we modify the
chain. So typically we are quite lazy.
We just use a tool such as more not to
generate the rope chain.
Since this case is dropped in which this
evil deeds, execution, prevention
and this was generated using Moonah,
that important factor is that push
it. The instructions used to invoked
us to virtually lock function
and this would also push the arguments to
the stack. And that means that don't have
control over these arguments.
So I'll have developed my own rope chain.
In this case, I'm using
a push and structure to invoke the
function. That means I have full control
over all the arguments and can just say
that the address, the target address is
not pointing to the heap instead.
I come to disrupt, you know, a little bit
later, the step
up mitigation technique was already
mentioned, used the idea
that that just verifies
if the participants got a stake and was
not shifted away, because in my case, I
just had shifted away to the hip
to bypass this.
You can just copy
everything from the hip back to the stack
before invoking the critical function
you see here. This is the code to do
this. It's not very interesting.
Just in a while loop. I'm just copying
everything there and using an exchange.
I just go from the
hip to the static.
The current mitigation technique is a
very interesting one, because we have
three different possibilities to invoke a
function. So first of all, we can
call a function. This is the valid case,
but you can also jump to the start of the
function or we can make
a fake function return so we can push
the function address and push the return
address and directly making a return.
That means it just jumps to this address
here.
And if you apply return to programing,
the typically are using this approach
here.
And what Emily's not doing is
if we make the valid case, the last one,
if you call a function, the structure
would push the return address.
So it would push the address of the next
instructions, this address here
to the stack and contend with this
this return address and just go backward
and check if there's really a call to
this function there.
So this is what it is doing.
And if you are doing, you're the second
or third approach.
There would be no such return address
there. And that's how Šemeta Texas
attack and we can pass this
one. But just returning instead of
returning directly to the fact we can
return to a call of the function.
So.
This approach was developed
by Chad DeMott and he was using
this gadget here.
So instead of directly returning to
virtual ELAC, we return
to the start of this call here
to this location here.
So if it now goes back, what it would so
the return address would be this one
here. So it would just go here, Pequod
five bytes and check if this is a call
and say this is fine and the
protection is bypassed.
But I see some problems with this sketch
at here. So first of all, it addresses
if you have a look at the addresses, you
see that from a Windows library.
That means it would just work against one
specific operating system,
against one specific suspect level,
which is bad because we cannot
detect any other operating system in D.C.
here that are many, many references
there, which can maybe lead to a
segmentation fault.
So this is quite bad because it's this
core to actually look is quite far away
from the from the return.
So I was using instead is a gadget
inside a Magilla.
And you see here, it's again a
code of virtual product.
And you have just one memory reference
here. But I can assure that this is not
crashing after that.
Just to compare and just take this chart,
which leads to a return to return would
go to the next Gachet.
But what to do if there's
no such question at all, which is very
near to return and what we can
do is we can just use any call to any
request. So in my rope chain,
I feel my push.
This is making to the code, to the
function and this just.
Invokes this quote here,
so I'm making here a call to aid
and trust and trust that it is pointing
to the target function, which I want.
So you see here,
I'm just popping.
Yikes. That means the next is popped into
it. This is the address of the
ELAC address, table entry.
This line just resolves it.
And the exchange I'm just moving the
value into either just ensuring
that ID is pointing to this location
as I see it here, that it is currently
pointing to virtual ELAC.
And after that, there's just a chance.
This cannot lead to a segmentation fault.
And then I just take this chump discourse
here.
And no reference at all
to this, cannot Kresh.
The last straw protectionism flow,
and it just brings the idea of this
cold mitigation technique, it
just applies to this technique
for return addresses and the stakes are
just simulates execution forward and
applying this technique again and again
for our return addresses.
But if you Pybus call mitigation,
these protections also Pybus at the same
time during a later
stage of an execute.
Could this mitigation technique also
triggers? Because of my childhood and
I don't find out that I can just make a
call to itself, sow discord here just
cause the pop instruction and then I pop
the push to return address.
So this court is expected to do nothing
but just confusing the simulation of the
default simulation so
this can be used to sort of bypass this
protective mechanism.
And I'll come to the trick, which can be
used to bypass all these protections
at one at one
time and use the idea that I can
just make direct system codes because
it is completely userspace, you can just
check yourself and functions.
And if I make that clear, call to the
colonel and it has no possibility to
intercept a score.
And the problem is that Hotfooting
system code numbers is bad because
from one operating system or from one
suspect level, the system must change.
So I cannot hardcourt these values.
So one approach could be that A, the
option which first identifies the
the reaction of the operating
system at the suspect level and then just
many hard core values for all different
kinds of operating systems.
But we have something better.
If you have, again, a local networks, a
function is this
one here? This is the implementation
insight into delay.
So if I invoked a virtual product
functional, it would call the
implementation of it inside Concerta to
this would just forward the execution to
the current base implementation and the
current base implementation just for its
execution to the internal version.
So to this version here you see here, the
first line just moves the system
code, no Intralytix Register
and then the following two lines just
make the call into the kernel so that
these two lines depend on the exact
operating system.
In this case, it's a 32 bit system.
And if I follow this, it just see it
as a center.
And if a now product is dysfunction
within it, it just does the same again.
It just looks the functions.
It replaces the first part as a jump.
And if I follow this code, you see here
that the third push
argument points to this blue marked area
here, so has just copied away
despite the dislocation.
And the problem is that I can get
this piece address, but just adding some
relative offsets.
So it's very easy to find the space
address here.
Then I can just extract to push, push,
augment.
This points to this location and it can
target chumped at this location.
So I can just jump over all, protect us
from Emet, execute
that system code and just return to
my next gatot.
It's easier to see the implementation of
it. This is a little bit more complex
rope chain, so I don't want to go into
too much detail here.
But it's so big because
it's finding itself in memory and then
modifying itself, that's why it's a big
here.
Now come to the last mitigation
technique, it's the export address table
access filtering.
The idea here is a trial court
typically has to pass a field, which is
called the address of Functions Field
inside the header of moderates such
as the Constitution base or
entity level module to locate
functions such as law library or cat
processing address.
And what it is doing is it just places
to break points on this field
here.
And as soon as one instructor is trying
to read this field, this
breakpoint is triggered and court
kicks in and can do additional
checks. For example, we can check if
the instruction belongs to Lord of
Mauduit and it's valid.
And if it's not belong to law, the
module, for example, it's stored on the
heap. It's most likely from a code and
that means execution can be
terminated.
And we have, again, many, many different
ideas, how this protection can be
bypassed. So, first of all, you can just
use, again, a rope chain because then the
instruction is from a load of modular or
we can use some other techniques.
But the problem with the first three
techniques is that we have to modify
the shell code, then use this technique
because developers are typically very
lazy. We can use this to
last approach here.
You can just say remove all the
breakpoints before executing our own
chokehold and to
remove the breakpoints.
We have, again, many different
possibilities.
So the main approach was developed
by a Pyon Jalapeno.
You can have a look at his blog posts
here, but the problem is that he was
using hardcoded system call numbers
so he U.S. assets, red contacts intend
to continue. Your system called to do it.
So what I was doing then was I just
used the API instead and just returned
to a location inside Amytal.
Which code? This API function,
but since I'm 5.0 and is also hooking
these functions.
So it's not possible to apply this
technique anymore unless we first
disable all protections using the
approach from a sense of security.
But I think this is in the
next releases of amateurs will not be
possible to apply.
And that's not that's why I think it's
not so interesting here.
So the first approaches are just using
the system code numbers.
But the downside is that this would just
work against one specific operating
system.
And so back then,
I fear some other techniques.
But for the newest version
of amateur, not so interesting.
So just skip them.
So just some methods
to do it.
But I think the most interesting
one is that we can just jump over the old
hooks to our clean water system called
as mentioned in the ROPS chapter.
So this technique has no disadvantage.
It works against all Windows versions and
also respects and against all Šemeta
versions.
And I come to find thoughts, amatus,
many, many more protector's,
but I think
these two protections, there are
protections and Yev are
the most interesting one
from the technical perspective.
And protections are, for example, the tax
office of DR. I can say that
I can trust Lord Chala from the Internet,
but not from the Internet.
Another one is, for example, scientific
trust, which verifies the certificates or
seop. But seop trust protects
exception, handles it from the from
the operating system.
But as soon as he can perhaps address
mistranslations, copies easily be
bypassed.
Then Heap's Premedication and Eyepatch
Location are it's very easy
to bypass this once it's detected, is
to just use an address which is not
protected by Emet.
So if you want to find out more about
this, just look at my slides from
the Roxxon.
But I think it's not so interesting.
Network address, translation and bottom
up randomization just increase the
functionality of address mistranslations.
But if you can address this,
these are papers can also
be bypassed and places
and interesting protection because it
should protect my current
exploit my current version of the
exploit. But it doesn't I don't really
know why, but we are currently discussing
this situation with Microsoft.
But even if it would protect against
my current version of the exploit, it
would not be too hard to extent exploit
to or to bypass this one.
I have here a quick recap of
just awful.
We'll just skip this one here, just
a summary of what I have told you today.
View from that contact would really
appreciate the work together with
Microsoft on improving the results of
image releases with many, many different
ideas, how it can be improved,
but of course, no protection is 100
percent bulletproof.
I fear a demonstration with you
there, I can see the explode in action.
See, everything is green, so all
protectors are enabled.
Firefox is protected.
Then you're all protectors are
enabled. If you click advanced
options step, you see that the
expanded access, filtering plus
protections configured correctly.
And if now start, Firefox is the
old explorer just out to bypass us.
You see that it's crashing and detected
that the tech is ongoing.
And if I restart Firefox and refresh
the Trotskyist.
See, it's still protected, and
for now you have one Mr. Bypass,
that calculator's points up.
And you ought to see that Firefox
is not crashing, so we can just execute
the plot again and again and
the victim really knows nothing, that
there is something ongoing,
I fear a summary of the workload.
So I think the initial exploit out
and the bypasses was
quite easy. So it just took me about
three to five days.
I think if you really tried to make it
very fast, you can do it in one day.
But yeah, I was doing
this in my free time, so I was watching
TV and stuff like that.
I am doing this. So it just took me three
days.
And then I think the first bypass
really was high effort.
I can't estimate and can tell you how
long it took, but it's easier to exploit.
Cornfed has about five thousand lines of
code, so it's really huge.
So it took me a really
much time.
But my idea was that I just
developed many, many different ideas to
bypass these mitigation techniques.
So it just showed you hear some of the
techniques which can be used.
And that means I can just configure also.
If at the time Šemeta updated itself
to 5.0,
it was quite easy to mitigate the great
exploit. It just took me five minutes
because I just had to configure to
use other techniques and
add four lines of code because I had to
pass two additional simple instructions.
So I'm passing through the simple
instructions and saying if it's a push,
it's the size of five and just had to
add to have such instructions.
And the same applies for the
release of five to one.
So this is the current version of it
took me about 40 minutes because
they tried to break my Escandon
down approach. So I'm looking at pointer
to delay.
And from this point I just got done what
until I find to be header
and see it on the next
slide.
So these are the sectors of a
this is the header and does the tech
sector so have a pointer inside this tech
section and then I just go downwards.
So your
dislocation to find the header
and to see that there is no gap in
between. So if you add to
the space address, you're the size, which
is 1000, you would end
up exactly with this address here.
So it's exactly the address of the text
section. The same applies for
M at 5.0.
So if you add up here, this one,
you come up to the next address
and what embeddable stand doing in and at
five to one was that
if I let you this one thousand,
I don't come to this tech section.
So there's a hole in between
this unsnapped memory and for try
to scan down, I just
access this memory, just segmentation
for thing. So what I'm doing, instead of
just search for the start of the tech
section and then I can just
substract the relative offset of it to
reach the header or I
don't really have to extract
all. So it's quite easy to bypass this
one.
You see here, it's also working against
the newest version of Emmott, just verify
two days ago that this is the actual
version.
Yeah, yeah, you have some contact
information.
And just remember that we are currently
searching for a new employer.
So you're interested that you can just
drop me a mail or send to
our office or mail?
Yeah. Thank you for your attention and if
you have any questions.
Thank you for this very nice talk to me
if you have any questions, please do line
up at the six microphones we have here
at the ground level.
While you're doing this quick
announcement today at
5:00 pm at the ferry dust rocket
in front of the building, there will be a
meeting for the flight
to freedom, not fear demonstration.
If you want to join them, just go down
there at 5pm today.
We have a question at microphone number
two.
OK, thanks for the very interesting
thought.
What I wanted to know.
So you said that after the rough terrain,
you can return execution to it, right?
Yeah, I have it on the slide
that this requires some
some conditions. So it must be able to
trigger the winnability without
crashing duplications.
And of course, you need some scripting
support. So if you attack a local
application, it's not apply.
OK, but the question is, what if
the Rob gadget's you're using
changes the value of some calice
the registers because
then it could do like spoiled execution
of the rest of the, you know, the
environment, JavaScript environment.
Sorry. Again, it didn't.
So if one of the Arab gadgets changes
the value of kholi saved register,
it will not be restored when you
return. And so there's the risk to
spoil the execution of the JavaScript
environment.
Ah, what I'm doing is I just fix
everything before returning, so
I'd just touch that.
Ah, this case, I'm just
touching the data structure but you don't
really have to execute a Getchell at all.
You can just you started winnability in
this case. So, for example,
I have really abstracted many things away
from this presentation to make it very
basic.
But what you can do is with the
vulnerability you can directly, instead
of executing a rope chain, you can
directly right to memory.
So you don't really have to use a chain
to write to memory at all.
So, for example, if
I go back, you.
So, see, you're the second.
The second example in this case.
Here you are in the second example,
tells you that you can use this advanced
country use technique to write to memory.
So what you can do is.
You can generate an array of memory
and redirect the right of disarray
to override the data structures, for
example, that don't really have to
execute a doctrine at all.
Are there any more questions?
There is a question from our signal Angel
on Iasi, yes, is
Emet often used as a company?
I didn't really see it very often because
the problem is with their compatibility.
So for example, if I'm using at home my
Firefox is just crashing or three or four
days because Mezzeh is that that's an
attack. But in reality, that's not a
Texas has a high false
positive rate.
And I think that's the main problem
of it.
But and I also think that's
a problem, that it's not so easy to
deploy into domain.
So, yes, thank you.
Any more questions?
Yes. Microphone number two, please.
And do you consider Windows secure to
operate in a corporation organizations?
Sorry.
Would you recommend deploying windows
within organizations
windows?
Yes, it's hard
to say, but in my opinion,
in my opinion, in the basic configuration
of windows, it's harder to exploit Linux
because Linux you have to
to compile it,
because in my opinion, you have to
Linux, you have to add the compiler
flack for PI for position dependent
executables that addresses
the reputation is really effective.
So if it's just compiler and executable
in Linux, it's not relocated
to another to another location.
So the code section will be always at the
same location.
And the problem is that many standard
applications have
not addressed limitation there.
And the situation is better on Windows.
But it just depends,
because if more people are using windows
that take us, try to attack windows and
yell.
Any more questions?
No, seems like we have two
additional questions from our side.
Yeah, um, uh, have you tested
this technique with other exploits?
Uh, I have
tested this with a test of his test
application for myself.
And I also verified that it is working
for, uh, for falsely
exploit, but with other
prospects because I didn't test it is
because I know it's just working because,
um, because I
have built everything based on emptily.
But in this case, this special
ability really allows me to do much stuff
because I can just read from memory, I
can write to memory as I like,
and I'm not questioning anything, so I
can just read it again and again.
So in this case, it's quite easy to do
it. If you really have to bypass
a local application like pharmacy
or something like that, everything
becomes a little bit harder because you
cannot apply to advance coproduced
technique so that you cannot execute task
called inside a local application.
And that means you have to implement
everything inside the rope chain.
And that means everything becomes really
hard because you don't have to make an
additional jumps to ensure that it
reliable against all different kinds of
operating systems.
But it's still possible.
We have another question from microphone
number three.
Hey, thank you for the presentation.
Are there any plans to implement some of
those protections on the colonel side?
I mean, I've seen Hope Gardens,
Sentinel by Corps and Emet,
everything is implemented on the
USERSPACE and some of those
protection, I assume, and I know could be
implemented.
Colonel, I just want to know why.
I just know that implements the
nitpicks protection.
This is a protection for current
vulnerabilities, but I'm not aware of
other tools to implement anything
internal for windows.
So sorry.
I don't know.
Another question from our Segolene Royal.
Um, yes.
Isn't the size of expert court
phone lines of court with or without
Emet and five thousand with
huge uterine in terms of added
complexity?
Yeah, that's I think that's the idea of
šemeta.
What they say it is that they know that
it can be broken, but they just want to
add additional workload for the attacker.
So if I would be an attacker
and 100 percent go
to my website and just one person as
a neighbor, it would not make
it sink. It would not make any sense to
add bypasses for Anne-Mette because
it's just one person, which I miss.
But if more persons would use Emet,
I would add this work
additional workload.
But in this five thousand
lines of code, I really have implemented
many, many Pybus techniques.
So if you just want to bypass it one
time, it's quite easy.
For example, the exploitation code from
offensive security has about 300 lines of
code or something like that and can also
bypass Emet.
But in my case, five thousand lines of
code are generated because I have
implemented about six or 10
methods to bypass each protector.
So that's why it's so much.
I think we have no further
questions from the audience, thank you
of the fine Gullberg.