Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1034 Thanks!
[Music]
so our next speaker is going to be
talking about modern Windows um user
space exploitation um he is a security
researcher at msrc Israel please give a
big round of applause to so
[Applause]
[Music]
I'm okay hi H so so first of all um
thanks a lot for all of you um to come
up here H I know that there is a great
competition so I really really
appreciate it and so my name is isar I'm
at the msrc um like um based in Israel
and uh so actually I'm here to talk with
you today like about how we can execute
arit code on latest Windows
system and so just a little bit like
about myself I a security researcher my
old point in life is about reversing and
exploiting vulnerabilities and I'm Al
I'm also highly addicted to ctfs I'm in
pasten CTF team and which I hope that
you like probably heard of us by now um
and I actually want to like kick off the
talk with very
important like a question so like what
do you think H the point in life is so
so of course the point in life is to
execute arbitrary code that
and and there is actually a very simple
and trivial process for that right I
mean all you need to do is to find some
really awesome K zero day vulnerability
and you have something in the middle and
then profit and back then about 200
years ago it was really really easy I do
hope that you all do recall the times
that the stuck in the Heap were were
executable and everything is fixed and
you have no SLR whatsoever and you can
corrupt function pointers and jump to
them and basically Nothing Stops you
well those times were H fun easy but
also really really dangerous well we
don't have that anymore right since we
have mitigations we have mitigations
everywhere and uh actually we have quite
a bunch of
them
and and the thing that I like really
want to do today is to talk about the
internals of the
mitigations understand them and most
importantly see all of the all of the
Primitives that you need to gain in
order to bypass them since it's really
non it's really know a trivial
process
and and I feel personally that the best
way in order to achieve that is to find
one single vulnerability and to exploit
it on many different operating systems
with increasing and increasing amounts
of different
mitigations so that's exactly what we
are going to do right now and so
actually my intentions were to take a
real Windows core vulnerability and to
exper it because it's fun but sadly I
saw that if I would the talk will
probably last 3 hours and we don't have
time because there is a great like mctf
that is going right now and I like have
to
go but instead we will take a like
really really awesome Windows CTF
Challenge from the insomia CTF teaser
from
2017 and uh on the way we will send the
message that I personally like really
want to see more windows CTF
challenges it's awesome so please do
that H and and we are going to achieve
codee execution on many different on
like many different operating systems
and take together the journey H to
bypass many many
mitigations okay so what we are dealing
here with uh the wind World Challenge it
was a great challenge based on the west
World um TV series sadly I didn't watch
it since I was extremely busy in the
last two years just like reversing
hyperv but H but the challenge is like
really cool H it basically try to
implement some kind of narat which is
which basically like let you create both
robots and humans and you can move them
on like on some map and you can make
them talk to each other and interact
with each other and fight and do like
awesome stuff H and important note here
is that both robots and humans have like
um like a best class shared H which is
person um and the interface simply like
let you do those actions those
operations on any person instance each
time that I will state person instance I
mean of course like both like robot or
or human they are simply inheritance
from
person now this is not a how to find
vulnerabilities talk this is an
exploitation talk so let's cut to the
Chase and and dump all of the
vulnerabilities so vulnerability number
one we have an un we have an
uninitialized attribute in the person
instance um each person has a like a
member of is conscience that tell you if
the person is conscious or it isn't um
the person con the so the person
Constructor keeps in mind to initialize
that value to false but the person copy
Constructor forgets it so if you can
trigger the person copy Constructor and
and like of course you can you have an
uninitialized you have an uninitialized
value which takes whatever was on the
hip before
which is cool H and we have also a use
after free buug um um in the challenge
we need to share to like share pointers
to person instances and like between
many many different objects and and like
and like component um but it's kind of
like a problem since since you like have
to know when you can free the chunk so
so the challenge use sh pointers which
is kind of some like wrapper for pointer
which has like like the um ref count
which like simply counts the like amount
of objects that took a reference to you
so each time some other object took a
reference to you it increment the
pointer by one each time it leave you
it's it like deck de pointer by one and
when the ref count like reaches zero the
object can be freed the problem is that
there is some flow in the challenge that
you can take a robot and to transform it
to human and now this is really cool but
the problem is that the code that does
that use STD move where it actually
duplicates the object and does duplicate
the shared pointer now this is really
really wrong because this actually break
the whole point of shared pointers the
right thing to do here is to increment
the ref count and that's it and instead
you duplicate the shared pointer and you
have two different shared pointer which
points to the same Chunk in memory and
of course this is really really wrong
since when one of those shared pointer
will reach a zero the person Chunk in
memory will be freed and you have a
dangling pointer from the other shared
pointer to a freed chunk and then the
fun begins so cool awesome
um so yeah the problem is that you can
say that you have a vulnerability if you
don't have a flow right you have to to
trigger the flow H so we actually can do
it by um take a robot and to and to
transform it to human just like I told
you and this happens when you have both
robots and human in the center of of the
maze okay and you have those
preconditions to be met and and you see
that one of the preconditions is that
the person is conscious will be set
meaning not
false and we can do that by the first
vulnerability of the UN initialize value
so combine those two vulnerabilities
together we can make the flow of
transform a robot to human and we have
dlin pointer from the other shared
pointer to a free Chunk in
memory okay and now after that we armed
with use after free vulnerability H let
the actual fun begin okay so let's so
let's start to walk we start start with
execute codee on Windows 7 the first
thing that we need to do is to
understand the allocator right because
we have like use after free bang and
like trivially the thing that we like
need to do first is to trigger some
allocation some other object allocation
to fall in the exact same spot on the
hip that the last person chunk got freed
okay and this is usually how it's not
used after free bugs and the problem is
that we have many many different
allocators and each allocator have has
its own logic and the way it tracks free
chunks and you have to understand the
allocator that you are dealing with uh
if you want to exploit the vulnerability
so of course we're in Windows so we H
work with the lfh the low fragmentation
hip H this is the font and
allocator in in like us space since
Windows Vista now I don't want to talk
about lfh internals is highly documented
all like basically all over the internet
I will simp simp stated that is really
like J Malo if you are
familiar and and you have the struct
which called user blocks which is a pool
of same size chunks in the hip and every
time you do a maloc you get a chunk from
there and like every time you free the
Chun like goes back and you have no
cesing no consolidate no fragmentation
like like whatsoever um cool the problem
is that in back then in Windows 7 we
have a like a metadata which called free
entry offset which sets in the first two
bytes inside the free chunk after the
header which mean that it has no
encoding and no sore and no protection
whatsoever and this like metadata
indicates to the allocator which chunk
needs to be returned to the H to the
user in the next allocation and simply
like corrupting this field is a like
give you extremely strong primitive um
the second problem is that the lfh in
Windows 7 it allocates chunks
continuously in memory so shaping lfh in
like window 7 is basically not really a
a problem and you can see it if you take
some some uh
tester and execute it on like a Windows
um 7 machine and so you can see on the
left side that I simply spray some side
on the hip and on and on the right side
you can see that the all of the chunks
all of the allocations Fall one after
the other very very nicely everything is
like everything is
like predictable and the most fun Point
here is that thanks to the free entry
offset the lfh keeps free Chunk in last
in first out fashion so the stab like
Malo free malok will will actually for
sure return the same chunk so we can
exploit the use after free B here very
very
easily okay now that we can allocate
some other object on the same fre person
address in memory we can start again in
Primitives because if we want and of
course you want because it's the goal in
life to get arbitrary code execution we
need to gain probably like relative or
arbitrary read right so each person has
a name SD string name and the interface
simply like let you dump the name it's
print it over the socket H with the info
command H but the name is like simply a
like SD string it's a pointer in the
person instance but I can allocate
whatever I want there like string even
which I basically can control every
single bite there so I can fake the name
pointer and set it to fixed address in
memory arbitrary address for my
choice and then I can dump it the great
thing here is that the length of the
name is also a fi in the SD string which
it's in the person instance so we
basically have arbitrary with arbitrary
length and it's and it's cool in the
very same way and in in the very same
fashion we have arbitrary rights with
arbitrary length right because the
interface basically let you to update a
name as well so yeah it's
cool and now that's that's that's like
not enough because we want to execute
code so we can corrupt some pointers but
it's actually way way easier we have a
function a virtual function in the class
it's not even in in in the v table you
don't need to deal with double
references it's function pointer inside
the class called on encounter which get
triggered each time two different
persons meet on meets on the map so by
by like basically spray string set in
the relevant offset fixed address and
then move two different persons to the
same spot we have the ability to jump to
arbitrary address and and like execute
code okay cool
um but I know that I will probably need
to read more than one address right you
will probably need to read like more
than ones so we can make a really really
elegant trick I really like this stuff
in exploits it's like really really cool
um you can corrupt the on encounter
function to to points to actually get S
and then move persons on the map and
each time they meet the get S function
will be trigger as the on encounter
function but it's really cool since the
get S gets the first argument that on
encounter with get which is a person
address in memory so I can send data
over the socket which will write on all
like all the fields all the attributes
of the person
instance and I do that without trigger
any other vulnerability whatsoever okay
I like S I like simply like trigger the
the vulnerability once and then I can
write on all of the fields of the
structure like over the socket
which is like really really cool tricks
like that it's it's the exact stuff that
make exploits reliable and and it's
really really important to make sure
that we trigger the vulnerability as few
times as
possible okay fantastic let's keep going
H so we have arbitrary read right jump
Primitives it's cool yeah basically life
is easy H but we have aslr everything is
under aslr the DLS the main binary the
Hep the stock
we don't know where everything is so we
need to start like licking pointers the
problem is that I don't have the
Primitive to read something relative to
me I read absolute addresses and I don't
know which address to put there so I so
I probably need to D some allocation of
some other object which add the same
offset as the as the SD name in the
person class it has some other pointer
to hip to stack to library to like
function pointer whatever you want wants
well SD Vector actually meets those
those those the demands so by basically
trigger SD
Vector we can do this trick H now
apparently person in reality have
friends okay H and like person in the
challenge also have friends and each
person has a vector of all of its
friends so by so by simply taking single
person and like add seven different
friends to it the SD Vector this
containing all of it friends will be the
exact same size as the person instance
and it's really really important because
we are in the lfh and and the chunks are
like organized together when they are in
the same size so we can trigger the
location of some SD Vector dump the name
of the person and we get the retable of
De CD Vector which is in the r data
section of the main
binary well the that's easy but the
problem is that I from obvious reasons I
can't control on the fields on the
attributes of the SD Vector so the
length of the fake length of the name
will be huge number and I don't have any
control over that so I do leak the
pointer but the process dies during the
copy now this is fine because we are in
a CTF and the process basically
relaunches and thanks to the fact that
in like user space um all of the DLS and
all of the binaries get randomized in
boot that's correct but H they still but
but they still where they are in virtual
memory for the entire system lifetime so
the process dies it relaunched and every
pointer that you lick stay where it was
except of course for the stock and the
hip that gets like randomize in the
process creation but all of the DLS and
the main binary will stay will stay
where they were okay now we need to
choose the C to execute arit code right
well we can call out function pointers V
tables we can call the stock and do rope
we can basically even load some D some
onside DL with our code and it will be
executed um we
can we can to allocate read write
execute Chun we can do basically what
what whatever we want and Nothing Stops
us uh so um let's do the r okay let's uh
let's let's create some chunk read
execute write Shell Code and jump to it
and now it's time for demo um uh I do
hope that on stage the demo behave just
like they did downstairs H if not uh we
I will publish all of the code H and you
can execute it at home please please do
so so let's go to the to the like
Windows 7
exploit and I have the IP right here
somewhere okay
awesome and let's launch the VM um since
we are in a CTF H I simply decided that
the that the like arbitrary code that we
will execute will
be to like read the flag and the flag is
I love Ida since we all love Ida and uh
let's execute the
challenge just to make
sure what's happened okay yeah
84 let's hope that again the physics on
stage is like just like a downstairs so
we leak the address of the main binary
we liak the address of the u3 base since
I have some like pivots there Kel 32 the
Heap the stock and if we do upop
we have the flag okay so the first Dem
Mo rocks thank
you awesome yeah the posted CES of
course it's like a CF it's it's cool and
we go to the journey to the next
operating
system Windows 10 t one so we take the
very same PC that we
executed like uh just now we and if you
try to execute it trust me it will fails
and it will fails since the shape fails
and the shape fails since we H have a
lot of change a massive change like
between the allocator the lfh between
Windows 7 and in Windows
8 and seriously like a lot of really
cool and awesome Engineers like in like
they invested like a lot of time in that
and the the lfh looks extremely
different um
first of all we don't have this free
entry offset field which which is really
really good instead we have a bit map
which simply indicates where each Chunk
in the user blocks if it's allocated or
if it's freed um moreover all of the all
of the allocations are randomized the
order of the allocations cannot be
predicted so easily as it was before and
if you take the very same tester that
you had in Windows 7 and execute it on
like Windows 10 threshold one or8 yeah
it's it's like basically the same you
can see on the right side that all of
the addresses are in complete chaos you
can't know what comes after what and the
state is really not predictable at as it
was before now since we don't have the
free entry offset field the stab like
Malo fre Malo won't won't re there in
the same Chun right because the
allocation are randomized so it's not
that rivial anymore to call Malo and to
get get the last free chunk actually
with extremely high probability you
won't get this chunk okay
cool now I want to byass it right
because we agree together that the point
in in in life is to execute arbitrary
code so we need to bypass the mitigation
um like otherwise we don't have like a
reason to leave so um in order to bypass
the mitigation we have to to like to
like understand the implementation and
and to see where the random comes from
okay so um it's really really
interesting and from now on we have the
bit map which indicates for each chunk
if it's freed or if it's like allocated
so the allocator choose a random
position on the bit map and scans from
there in a linear fashion until it sees
bits that indicates free chunk it simply
flip the bits and return this chunk to
the user and there you go and of course
since the position is in the bit map is
random the allocation order will be
random but the question remains how the
random position is chosen so we have a
like like a new symbol in ND which
called rlp L frag he random data which
is a fixed address of a 100 hex values
which are random truly random seriously
guys this is not the issue here okay all
those values are simply like created
from K 32 random and C32 the D um and
that's fine there are cryptographic
random
the and um each time we hold a pointer
to this random data array and every time
you do a maloc I take the current like
random value from the array and this
random value is used as the
index for scan in the bit map so of
course you can see from here that H the
allocation like order will be random
let's see this happens so sorry so here
so here on the like right side you see
the like user blocks which are the
chunks on the hip and and you can see
the bit map which describ it now let's
let's call Malo okay so we choose some
like random position in the bit map and
we start to scan from there now we like
happen to choose zero which like
indicates free Chunk we simply Flip Flip
the bits and return the chunk to the
user now we call another Malo and we
take another random value this like
random value like it happens to be a
allocated chunk right there so we start
to scan from there in a linear fashion
until we see free chunk and there H we
flip the bit and return the chunk to the
user now of course there is a serious
very serious issue here because the all
of the random values are in static array
which size of 100 hex so what's happen
if we try to like allocate more than
like 100 hex allocations which basically
happen really really fast like even if
you don't do it your process will
probably does allocations all the time
so the pointer will wrap around the
array but the but the values were random
before but they are stay intact and
there and they're the exact same
values so if you try to execute this PC
which which which I which like simply
does allocate
free the chunk and then for FF times do
like alloc free alloc free alloc free
and do the allocation again the second
allocation after the loop will use the
exact same random value from the array
in the bit map and those for sure by
definition it will return to you the
exact same chunk that got like returned
in the first
allocation the whole point of the loop
is just to increment the pointer on the
random data array and to make it overlap
that's it and this is really really
deterministic okay this kind of like
bypasses is is like really really cool
it's extremely like makes me happy to
see tricks like that and uh of course
that's
exactly H solve my problem since I can
execute this PC and and see that it
works perfectly with probability one we
get the same
chunk okay awesome so we solved the
shape issue and now we can continue with
the exploit because this is the point of
the the talk right H so yeah H now we
need to like execute code so I probably
want to call to some function which will
Li me the like address of the stock
since it is easy to leak all of the DLS
and the main and like the main binary
just like I did but and the Hep of
course it's again it's pretty easy to
liak the stock um is like a little more
complemented in this challenge so let's
call to RT LP get stack limits in like
ndd it should lick me the
stock Crush in 29 and in 29 is the fast
fail feature we have it since Windows 8
and basically if your process does that
it means hey dude I detected some really
inappropriate behavor something really
really bad happened I don't know like
what to do game over I'm out
bye H and yeah if if you process do
that something B happen Okay and uh okay
let's go simple bit up in the stock and
see like where it comes from and it
comes from G check iol fptr and it's
kind of interesting since the first
argument to this function was the
address that I tried to jump to you see
that it's actual bite code in
ndl so we have CFG which is control flow
guard H the job of CFG is to basically H
make sure that every every indirect
branch is okay in the sense that every
time that you try to jump or call to
some address to function pointer again
indirect Branch colar discs colar BS um
symbols in your binary you have a white
list of function that the address that
you try to jump to has to be in this
white list if it doesn't abort and this
exactly what happened here H there are
many no
end like by and rock around for it and
Jo Ali gave a great and awesome talk
about it in the last offensive con about
CFG CI internals issues we have there
how to fix them H if you into it please
check it out it's really really awesome
talk okay H but again the point in life
execute arbitrary code and like all of
that stuff we need to bypass CFG and
it's not that bad because CFG does make
the life way way harder because we don't
have any pivots right I I can jump to
the middle of function because for sure
it's not in the white list I can't jump
to to like to like RTL restore context
and and all of the functions that H give
me controlling of of of of the RSP or
the lick it to me and all of the
problematic functions are like forbidden
now okay but we don't have yet something
that that checks the Integrity of the
return addresses on the stock so if we
lick the stock and use the arbitrary
right primitive that we have already and
write rope it's fine because we don't
have yet something that validate the
Integrity of the return addresses okay
so let's do it uh again it's really it's
really really important to see demo
H we I had some um random going on with
like threshold one VM here
um something happened there I hope that
on stage it will be fine if not again
the code will be published you can
execute it at home and see that it is
cool so let's go to threshold
one again we are in like a CTF so we
should have a
flag and of course past 10 because past
10 yeah I love Ida blah blah blah Okay
so we do have a flag let's try to
execute the the PC this is the right IP
yeah and again let's hope that
everything will be
fine okay so we lick the address of the
main
binary and we link the address of the
UCR ND
rope oh man
okay interesting yeah sometimes the VM
does like some problems let's try it
again yeah okay yeah the VM does does
does like some problems uh okay sorry
but you can execute it at home and like
check it out there let's see if uh now
it will work yeah code has random so
this is why we have vulnerabilities
right um again the licks work
fine we have the flag
honestly I think that I'm about to have
a heart attack so sorry for that but it
BRS eventually so cool
okay fantastic I love Ida so much and
hyperv is the best thing ever is a great
flag uh
indeed Okay so let's keep going H
Windows 10 Redstone 5 the latest kind of
H if we try again to execute this PC on
likeon 5 you see that it will fails and
it will fails
deterministically um and um this is
because the shape fails again and we
fixed uh the issue in the random in the
lfh it's got service of course because
it is a very serious issue and since
build
16179 we don't have this issue anymore
and the random got fixed if you want to
check it out H all of the internals been
different and stuff you can see in this
tweet link I like all about it h you
have everything there please check it
out H but again we need to bypass the
random now please keep in mind that the
demand that I have here is not really to
it's not to restrict right I don't have
to take two different chunks and they
need to be continuously one after the
other all I need is to spray some
allocations and I just want one of them
to fall in the person free chunk that's
it okay so even if you have random I can
try to spray and see if it will succeed
right now of course the to allocation
won't do it 10 10 allocation probably
not a million allocations will
definitely work so the question is where
the where is the threshold and for that
I like simply wrote some tester okay
those are the numbers of the allocations
that I had to spray in order to catch
the last free chunk and you see that the
like numbers aren't so bad
right and okay so let's simply
try sorry for that let's try to to uh to
H spray not FF double than that works
great I really like the times when
theory and practice meet and it
basically work with multiply the the Kil
count of the spray in the Cod and like
that's it so the shape
works and now we try to execute
arbitrary code just like we did before
and everything should be
fine well not we have in 29 again and we
crush and and life he said because we
have ACG which stands for arbitrary code
guard this mitigation does exactly what
its name suggests okay it basically
forbids you to execute arbitrary
code by by by like in by like introduces
two new restrictions the first is the
sorry the first one is that you can't
allocate and you can am up h plus X
Pages at all it will simply fail virtual
alloc e x will fails if you try to give
it h the flag of page execute this
exactly what would happen if you try to
like execute this this PC okay I don't
have time for that but I will publish it
and the second restriction is is that
you can edit the permissions of existing
code so com so two so those new
restrictions combined you can't execute
arbit code unless you bypass the
mitigations and now there were some some
like no cool bypasses for that in other
versions they of course got services
fixed um but keep but keep in mind that
again there is nothing that make sure
the Integrity of the ret addresses on
the stock so
R so w on the stock Works 2,000 years
ago it works today and it's still cool
um now it's not really a problem right
because I can call load Library e and
try to load some some onside dll so I
have cig which is called Integrity guard
which basically forbids you to load
onside D okay we make sure that the
digital signature is fine and if not
about so loads and side D want do the
trick now I really wanted to talk about
Edge since Edge is a really really cool
use case for that edge has cig a cig ACG
CFG and many many XY G's in in it many
many guards but I don't have the time um
um great shout out for um fatrick from
Google project zero he found many
bypasses really really cool and and he
and he like wrot a really cool PDF about
it and please check it out I don't have
like time for that it will be here I
publish the slides and all of the links
so you can see it at home and Alex
anesco my best buddy found a really cool
core bypass for ACG not just for Edge
okay he found the really cool bypass for
ACG inside the operating system and he
had a great talk about it every talk of
Alex is awesome so check it out Alex I
love you H and H now we have to go back
to the point in life arit Cod and stuff
so let's bypass ACG and
CAG so just to make sure that uh we can
do something let's do rope on the stock
but I don't want to do a very long g
chain because it's how to maintain and
offset change and it's cool like in CTF
when you have a very short R chain but
in like real world scenario probably you
want to do some complex stuff and and
try to implement a long logic in rope
it's it's not like it's not like pretty
fun it's very dirty work we do it in
like iOS exploits all the time but if I
can avoid it I W so let's try to create
process shell execute EX system or like
something like that just to make sure
that we still can control what's like
going on here so we have the Redstone
5m let's get
let's let's kick it off H go to Redstone
5 and let's try to call system I have
the IPM yeah sometime okay and and we
have the explo for system and again
I I will publish uh the PC and you can
actually see that the PC is like really
really really elegant H
and and you can see that the Rope sorry
for that
um the Rope is simply
called system okay system with the
command type flag okay so let's do it
and this is the VM yeah of course we
don't have memory okay cool good point
um are we are we ready sorry for the
delay come on come
on it was F
before yeah
okay
so yes so no so so the flag gu now will
be
um
AA okay because we don't have time for
that um fantastic type
flag
okay I sure that you will see the AA
like once it licked H we have the
challenge and we try the PC
out yeah the IP is 93 note
83 okay let's hope again that that the
physics is like still fine the base of
of the main binary the base of the UCR
come
on fantastic and I also need ntid and
now before we execute the Rope
please please just let me um execute
windy bar and to like attach the process
because I have a feeling that we will
need it and let's break point on
system okay we have a break point I'm
I'm so sorry for the team it's it's like
inside the VM call R and we have a hit
on system and of course I do expect that
the first argument will be type flag now
if I do go we need to see the flag
right
access violation and the process dies
and we are inside
system okay yeah yeah yeah so what's
what's the heck is going on here so of
course uh we have a another
mitigation if the slide will work yeah
it works fantastic yeah child process
restriction this this the exact behavior
that I expect see because you really
don't be allowed to call system in like
many processes you don't have a very
good reason to do it I mean I have
because I exploit vulnerabilities but
you at home don't really want that Elsas
will be able to call system it is really
no point in order to do that and so
child process restriction is really
really cool mitigation because it's very
very simple is one bit in the process
that forbids the process to create a
children as sub processes that's
it it's really really cool because it
kill a lot of different exploits and
make of course the life way way way way
uh difficult of course I can't uh not
lick the flag in front of you on like
Redstone 5
so H let's make sure that we still have
the AA we do and we have an exploit
that lick the flag ah sorry thank you
um now you should see
it okay awesome and yeah the laptop
doesn't
respond
sorry is everything fine okay so the so
so we have the VM and we have the
exploit now um You you kind of already
know how I like about to lick the flag
right we saw all of the mitigations we
see how much harder it gets but I always
get to the same Tech uh technique right
do rope on the stock so instead of the
very simple rope that that I just showed
you it's very very short it's very
elegant like one of the shortest SW I
ever did just called system instead of
of that I have a different
drop H again the main looks the same
just Leck the like address and and like
the Rope but the Rope now do open read
um put s flash all in order to liak the
flag so the Rope is like way way longer
and still it's fine because it's a CTF
in real world H this kind of like
approach to implement everything like in
rope works but it's really really kind
of Last Resort right I really want to do
more
like elegant stuff uh okay um again
physics on stage uh like a lot of random
should be fine and let's lick the
address of the main
binary done UC base come
on fantastic
ndl L
A thank
you thank you so much again everything
will be published it's a CDF challenge
but of course the point is to learn how
to do it and uh to do it
like in a good way H so this is for the
demo okay so what's going on right now
before we go back to the CTF um there is
much more than I could have told you in
this 45 60 like minutes talk I really
wanted to talk about Edge and about like
a lot of stuff but I didn't but but I
but I didn't have the time and you can
always like DM me on on a Twitter come
and talk to me like right now come to
Tel Aviv we have great food uh and we
can talk and H yeah we have containers
and like sandboxing H we are actually
like working right now on some really
serious like improvements for CFG it's
it should be awesome H we will keep you
posted and I kept telling I I kept like
telling you that we yet we have nothing
that checks the Integrity of the retan
addresses on the stock yet we tried rfg
which is return flow guard just like C
in Linux okay but um we had to pull it
off actually since we had a very
reliable built-in rest
condition in that feature it was really
really reliable to exploit it basically
trivial Jo Al gave a great talk about it
with the PC with the example H internal
details again check his talk it's really
awesome H so we are like waiting for
sets by Intel um basically rfg did very
very simple trick it implemented Shadow
stock which is a separate stock for only
the return addresses in software and
then when you do R in your code you you
compare the return address for the h
stock and the return address saved on
The Shadow stock and you don't know
where the shadow stock is and if the
like addresses are different abort and
again we had some trivial race condition
there so we pulled it off but set by
Intel is a shadow stock in the processor
in the processor itself so it should
like mitigate RS all like all
together H actually I really really like
kernel and like below kernels and like
hypervisors and we have awesome stuff
going in ring zero we actually
introduced um lfh in like Kel space
which is a life changer for Kel
Corruptions really seriously a life
change of since the lfh is way secure
than the uh way the like Windows pools
worked before we have VBS and vssm which
is crazy H we actually have smap only
for plus up dispatch flows because uh
it's kind of like limited like right now
but it is a start and it works great uh
there is great documentation about it
all all over the place H all over the
Internet check it out but more
importantly is that we want your help so
uh I don't know I just love to wake up
in the morning and talk to awesome
people about awesome stuff that I rever
so if you find some cool bypass talk to
us it's like really cool H you can
always DM me on Twitter mail come to me
right now and H I really really like
open to stuff and I and I like love to
talk to to like cool people about about
like Co exploits uh so do that um there
is something else that uh that we are
trying to do and it actually works great
and there is the approach of trying to
kill a back class all together okay if
you saw J Al tweeted about his in it all
mitigation which basically do like M
said zero for all of the structures it
should kill a lot of
information
disclosure it like works great and the
guy awe which is awesome great challenge
H so in his right up he actually wrot
that in in the first place H the
challenge like did work because Visual
Studio 2015 by default has the/ sdl
compilation flag which M said zero all
of the structure so the first one
unability of the uninitialized value of
the E conscience in the person didn't
work it simply didn't happen you have
the vulnerability but it's basically
have zeros so we had to disable the flag
H so it's like really cool to see that
we don't intend and cool stuff like that
happen so yeah
H and it's time for shout out so again a
so
a so awe is the guy who wrote The
Challenge and the write up again like
great Rock and please do more like
Windows CTF challenges toas my best
friend for exploits whiskey and burgers
thank you for all of your help and uh
thank you for all of the brilliant
Engineers that actually keep track of
Twitter see all of the stuff that we
want and keep fixing that H it's really
cool and we have many many example that
I like simply tweet something and like
three three months later I B it and I
see it fixed it's like wasn't even some
kind of serious like vulnerability but
they do also aesome stuff so so keep do
that H you have some some reference for
all of the stuff that we did here and I
think that the last link got down like a
week before I sent a message um to the
insomnia I hope that it will H be up um
if not we will ask them they are really
really nice
guys and uh
[Applause]
[Music]
thanks
[Music]