Kernel Pool

[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Introduction ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Population People who write exploits People who write Windows overflows People who write Windows Kernel Pool Overflows

Other considerations ,[object Object],[object Object],[object Object]

Diversity increases QA costs dramatically

Addresses May Vary ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Kernel Pool vs. Userland Heap ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Kernel Pool ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Pools Definitions ,[object Object],[object Object],[object Object],[object Object],[object Object]

Non Paged Pool ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Paged Pool ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Session Paged Pool ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

nt!_POOL_DESCRIPTOR ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Pool Descriptor ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

ListHeads 0 1 2 3 4 511 ... 8 bytes 24 bytes 24 bytes 32 bytes 24 bytes Each chunk of data is preceded by a 8 byte header structure

nt!_POOL_HEADER ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Chunk Header ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Free Chunk Header ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Lookaside Lists ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

nt!_GENERAL_LOOKASIDE ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

nt!MmNonPagedPoolFreeListHead ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Allocation Summary ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Simplified Allocation Algorithm nt!ExAllocatePoolWithTag (1/2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Simplified Allocation Algorithm nt!ExAllocatePoolWithTag (2/2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Free Chunk Splitting ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Splitting Schema Free Chunk Free Chunk Free Chunk Free Chunk Free chunk at the beginning of a page, allocated chunk goes at the front Otherwise, allocated chunk goes at the end

Free Summary ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Simplified Free Algorithm nt!ExFreePoolWithTag (1/2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Simplified Free Algorithm nt!ExFreePoolWithTag (2/2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Merging Schema Free Chunk Busy Chunk Free Chunk Free Chunk Free Chunk Free Chunk Chunk being freed Merge #1 Merge #2

Pool BugChecks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Some BugCheck Conditions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Exploitable Overflows? ,[object Object],[object Object],[object Object]

Kernel Pool Unlink ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Notations Our chunk Chunk we overflow Overflow Potential list entry depending on chunk type Kernel Pool Overflow Header Next Header List Entry

Different Write4 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Write4 on Merge with Next Case #1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Exploit Case #1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Write4 on Merge with Previous Case #2 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Exploit Case #2 (1/2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Exploit Case #2 (2/2) ,[object Object],[object Object],[object Object],[object Object],Header Next Header Header Overflow List Entry Overflow PreviousSize of next chunk Merge Next Header Fake Header

ListHeads Write4 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

ListHeads Illustrated (1/3) ListHeads[n] Flinks Free Chunk Free Chunk Free Chunk : Overflowed list entry Flink Blink Flink Blink Flink Blink Flink Blink

ListHeads Illustrated (1/3) ListHeads[n] Blinks Free Chunk Free Chunk Free Chunk : Overflowed list entry Flink Blink Flink Blink Flink Blink Flink Blink

ListHeads Illustrated (2/3) ListHeads[n] Free Chunk Free Chunk PLIST_ENTRY b,f; f=ListHeads[n]  Flink  Flink; b=ListHeads[n]  Flink  Blink; b  Flink=f; f  Blink=b; Allocation of size n unlinks ListHeads[n]  Flink Flink Blink Flink Blink Flink Blink

ListHeads Illustrated (3/3) ListHeads[n] Free Chunk PLIST_ENTRY b,f; f=ListHeads[n]  Flink  Flink; b=ListHeads[n]  Flink  Blink; b  Flink=f; f  Blink=b; ⇦ might AV Allocation of size n unlinks ListHeads[n]  Flink ListHeads[n]  Flink is now under our control! Flink Blink Flink Blink

MMFREE_POOL_ENTRY Write4 ,[object Object],[object Object],[object Object],[object Object],[object Object]

What? Where? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Some Ideas Non Exhaustive ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Write4 into the Kernel ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Edx points to something we control Jmp edx being 2 bytes long, we can pick the upper 2 so that the write4 doesn't trigger an access violation

Fixing the Kernel Pool ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

History ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

IGMPv3 Membership Queries RFC 3376 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Vulnerability ,[object Object],[object Object],[object Object],⇦ Failed!

Trigger ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Issues (1/2) ,[object Object],[object Object],[object Object],[object Object],[object Object]

Issues (2/2) ,[object Object],[object Object],[object Object],[object Object],[object Object]

Solutions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Dirty Way 256<(n%0x10000)*4+8<4080 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Why would it work? ... ... 0x14 byte buffers Kernel Pool is filled with n 0x14 byte buffers Buffer closest to our allocated buffer is the 1 st one to be copied and freed Requires a “carpet” of ~13000 contiguous 0x14 byte buffers (not too hard) Our buffer will be allocated before those (we pretty much exhausted all the free chunks) Overflow

Clean Way (0x10000-(n%0x10000))*4=8 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Conclusion ,[object Object],[object Object],[object Object]

NUMA ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Literature ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object]

Kernel Pool

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (19)

Similar a Kernel Pool

Similar a Kernel Pool (20)

Último

Último (20)

Kernel Pool