Kernel Hijacking Is Not an Option: MemoryRanger Comes to The Rescue...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Kernel Hijacking Is Not an Option:
MemoryRanger Comes to the Rescue Again
Igor Korkin
Independent Researcher
2020

WHOAMI
▪ PhD, speaker at the ADFSL conference since 2014 and the BlackHat
▪ Windows OS Kernel Security Researcher:
▪ Rootk...

▪ Three attacks on kernel memory data:
1. Handle Table Hijacking
2. Hijacking NTFS structures
Bypass file sharing access c...

▪ Three attacks on kernel memory data:
1. Handle Table Hijacking
2. Hijacking NTFS structures
3. Token Hijacking
Process P...

AGENDA: ATTACKS ON FILES+TOKENS & MEMORYRANGER
▪ Three attacks on kernel memory data:
1. Handle Table Hijacking
2. Hijacki...

6
PREVIOUS RESEARCH ON MEMORYRANGER:
PAPERS+SLIDES+DEMOS
(2019) MemoryRanger Prevents Hijacking
FILE_OBJECT Structures in ...

KERNEL DRIVERS CAN COMPROMISE THE OS SECURITY
7
OS Built-in Drivers
NT OS Kernel
• Scheduler
• Memory Manager
Kernel Data
...

▪ RobbinHood Ransomware - 2020
▪ Exploits a legitimate buggy driver to load a malware driver
▪ Malware driver disables end...

▪ RobbinHood Ransomware - 2020
▪ Exploits a legitimate buggy driver to load a malware driver
▪ Malware driver disables end...

▪ RobbinHood Ransomware - 2020
▪ Exploits a legitimate buggy driver to load a malware driver
▪ Malware driver disables end...

MemoryRanger
Don’t mess with
kernel data!

Episode 1
Bypass File Sharing Access Control via
Hijacking File Structures
16

SCENARIO OF ATTACKS ON FILES
17
Researcher s Driver
Secret Formula
Open a file in an
exclusive mode
NTOS Kernel
(2) Try to...

SCENARIO OF ATTACKS ON FILES
18
Researcher s Driver
Secret Formula
Attacker s Driver
(1) Try to access the
file via ZwCrea...

SCENARIO OF ATTACKS ON FILES
19
Researcher s Driver
Secret Formula
Attacker s Driver
(1) Try to access the
file via ZwCrea...

Researcher s Driver
Corrupted Data
Attacker s Driver
(1) Try to access the
file via ZwCreateFile
Open a file in an
exclusi...

ZwCreateFile()
File handle
ZwWriteFile()/ZwReadFile()
NTOS
Output buffer
+
status
ZwCloseFile()
status
File name
+
ShareAc...

ZwCreateFile()
File handle
ZwWriteFile()/ZwReadFile()
NTOS
Output buffer
+
status
ZwCloseFile()
status
File name
+
ShareAc...

INTERNALS OF ZwCreateFile
23
ZwCreateFile( ,
ShareAccess=0)
Security Ref. Monitor
NTFS driver
Access Control Lists
?
Disk ...

INTERNALS OF ZwCreateFile
24
ZwCreateFile( ,
ShareAccess=0)
Security Ref. Monitor
NTFS driver
Access Control Lists
?
Disk ...

INTERNALS OF ZwCreateFile
25
ZwCreateFile( ,
ShareAccess=0)
Security Ref. Monitor
NTFS driver
Access Control Lists
?
Disk ...

INTERNALS OF ZwCreateFile
26
ZwCreateFile( ,
ShareAccess=0)
Security Ref. Monitor
NTFS driver
Access Control Lists
?
Disk ...

INTERNALS OF ZwCreateFile
27
ZwCreateFile( ,
ShareAccess=0)
Security Ref. Monitor
NTFS driver
Access Control Lists
?
Disk ...

INTERNALS OF ZwCreateFile
28
ZwCreateFile( ,
ShareAccess=0)
Security Ref. Monitor
NTFS driver
Access Control Lists
?
Disk ...

29
ZwCreateFile( ,
ShareAccess=0)
Security Ref. Monitor
NTFS driver
Access Control Lists
?
Disk driversDisk drivers
ZwCrea...

SECURITY REFERENCE MONITOR PREVENTS ILLEGAL ACCESS
30
ZwCreateFile( ,
ShareAccess=0)
Security Ref. Monitor
NTFS driver
Acc...

INTERNALS OF ZwReadFile/ZwWriteFile
31
I/O Manager
Object Manager
Security Ref. Monitor
NTFS driver
File handle
Disk drive...

INTERNALS OF ZwReadFile/ZwWriteFile
32
I/O Manager
Object Manager
Security Ref. Monitor
NTFS driver
File handle
Disk drive...

INTERNALS OF ZwReadFile/ZwWriteFile
33
I/O Manager
Object Manager
Security Ref. Monitor
NTFS driver
File handle
Disk drive...

INTERNALS OF ZwReadFile/ZwWriteFile
34
I/O Manager
Object Manager
Security Ref. Monitor
NTFS driver
File handle
Disk drive...

▪ ZwCreateFile checks shared access permissions
▪ZwWriteFile and ZwReadFile do not bother about access
permissions
SUMMARY...

36
I/O Manager
Object Manager
Security Ref. Monitor
NTFS driver
File handle
Disk driversDisk drivers
File Object
Kernel Ha...

I/O Manager
Object Manager
Security Ref. Monitor
NTFS driver
File handle
Disk driversDisk drivers
File Object
Kernel Handl...

I/O Manager
Object Manager
Security Ref. Monitor
NTFS driver
File handle
Disk driversDisk drivers
File Object
Kernel Handl...

Handle Table Hijacking
Hijacking
FILE_OBJECT
Hijacking NTFS
Data Structures
I/O Manager
Object Manager
Security Ref. Monit...

Handle Table Hijacking
Hijacking
FILE_OBJECT
Hijacking NTFS
Data Structures
I/O Manager
Object Manager
Security Ref. Monit...

Handle Table Hijacking
Hijacking
FILE_OBJECT
Hijacking NTFS
Data Structures
I/O Manager
Object Manager
Security Ref. Monit...

Handle Table Hijacking
Hijacking
FILE_OBJECT
Hijacking NTFS
Data Structures
I/O Manager
Object Manager
Security Ref. Monit...

Handle Table Hijacking
Hijacking
FILE_OBJECT
Hijacking NTFS
Data Structures
I/O Manager
Object Manager
Security Ref. Monit...

HANDLE HIJACKING ATTACK
44

HANDLE HIJACKING ATTACK
Handle Table Hijacking
Hijacking
FILE_OBJECT
Hijacking NTFS
Data Structures
I/O Manager
Object Man...

KERNEL HANDLE TABLE
46
File Object
Kernel Handle Table
Object Header
Entry Entry...
File Handle
8 bytes
EntryEntry
index
O...

HANDLE TABLE HIJACKING
47
ObjectPointerBits
Attacker s Driver
File handle
Researcher s Driver
File handle
Copy
content...E...

HANDLE TABLE HIJACKING
48
ObjectPointerBits
Attacker s Driver
Object Header
File handle
Researcher s Driver
File handle
Se...

ObjectPointerBits
Attacker s Driver
Object Header
File handle
Researcher s Driver
File handle
Secret File File Hijacker
Ob...

DEMO: HANDLE TABLE HIJACKING
50
Kernel
mode
User
mode
Hard
Disk
Driver
ZwCreateFile()
•ShareAccess=0
Secret file
OS Compon...

DEMO: HANDLE TABLE HIJACKING
51
Kernel
mode
User
mode
Hard
Disk
Driver
ZwCreateFile()
•ShareAccess=0
Secret file
Driver
Zw...

DEMO: HANDLE TABLE HIJACKING
52
Kernel
mode
User
mode
Hard
Disk
Driver
ZwCreateFile()
•ShareAccess=0
Secret file
Driver
Zw...

DEMO#1: HANDLE TABLE HIJACKING
The online version is here –
https://www.youtube.com/embed/5NNSXfTRtiQ?vq=hd1440
53

HOW TO PREVENT THE HANDLE HIJACKING?
54
▪ We have to block WRITE access to the ObjectPointerBits
▪ We have to grant READ a...

HOW TO PREVENT THE HANDLE HIJACKING?
55
Attacker s DriverResearcher s Driver
read read
• read=true
• write=true
ObjectPoin...

MEMORYRANGER ISOLATES DRIVERS BY
RUNNING DRIVERS IN SEPARATE KERNEL SPACES
56
MemoryRanger and Enclaves details are here:
...

The Current Situation
OS Code
OS
Data
RSRCH Entry
Attacker
Default enclave for OS
and driver loaded before
Enclave for RSR...

The Current Situation
OS Code
OS
Data
RSRCH Entry
Attacker
Default enclave for OS
and driver loaded before
Enclave for RSR...

MEMORY MAP: MEMORYRANGER PREVENTS HANDLE HIJACKING
The Current Situation
OS Code
OS
Data
RSRCH Entry
Attacker
Default encl...

MEMORY MAP: MEMORYRANGER PREVENTS HANDLE HIJACKING
60
The Current Situation
OS Code
OS
Data
RSRCH Entry
Attacker
Default e...

DEMO#2: PREVENTION OF HANDLE TABLE HIJACKING
The online version is here –
https://www.youtube.com/embed/5Pz-IXvQDiY?vq=hd1...

62
MemoryRanger Prevents the Handle Hijacking
MemoryRanger
restricts WRITE
access to the
ObjectPointerBits
field
Attacker ...

63
MemoryRanger Prevents the Handle Hijacking
MemoryRanger
restricts WRITE
access to the
ObjectPointerBits
field
Attacker ...

HIJACKING NTFS DATA STRUCTURES
64

HIJACKING ATTACKS ON FILES STRUCTURES
Handle Table Hijacking
Hijacking
FILE_OBJECT
Hijacking NTFS
Data Structures
I/O Mana...

NTFS DATA STRUCTURES
66
PVOID FsContent
File Object
File Control Block
PVOID FsContent2 ERESOURCE
FAST_MUTEX
File on the D...

HIJACKING NTFS STRUCTURES
67
Attacker s Driver
FILE_OBJECT
Researcher s Driver
FILE_OBJECT
Secret File File Hijacker
NTFS ...

HIJACKING NTFS STRUCTURES
68
Attacker s Driver
FILE_OBJECT
Researcher s Driver
FILE_OBJECT
Secret File File Hijacker
NTFS ...

HIJACKING NTFS STRUCTURES
69
Attacker s Driver
FILE_OBJECT
Researcher s Driver
FILE_OBJECT
Secret File File Hijacker
NTFS ...

BSOD - RESOURCE_NOT_OWNED (0xE3)
70

void ExReleaseResourceLite(PERESOURCE Resource){
…
CurrentThread = KeGetCurrentThread();
if (IsOwnedExclusive(Resource)) {...

void ExReleaseResourceLite(PERESOURCE Resource){
…
CurrentThread = KeGetCurrentThread();
if (IsOwnedExclusive(Resource)) {...

1. Overwrite control block structures
2. Patch ThreadID-related fields using attackers ThreadID:
▪ Resource->OwnerEntry.Ow...

DEMO: HIJACKING NTFS STRUCTURES
74
Kernel
mode
User
mode
Hard
Disk
Driver
ZwCreateFile()
•ShareAccess=0
Secret file
Driver...

DEMO: HIJACKING NTFS STRUCTURES
75
Kernel
mode
User
mode
Hard
Disk
Driver
ZwCreateFile()
•ShareAccess=0
Secret file
Driver...

DEMO#3: HIJACKING NTFS STRUCTURES
The online version is here –
https://www.youtube.com/embed/bHEf2fNkqbc?vq=hd1440
76

The Current Situation
OS Code
OS
Data
RSRCH NTFS
Struct
Attacker
Default enclave for OS and
driver loaded before
EPT point...

The Current Situation
OS Code
OS
Data
RSRCH NTFS
Struct
Attacker
Default enclave for OS and
driver loaded before
EPT point...

DEMO#4: PREVENTION OF HIJACKING NTFS STRUCTS
The online version is here –
https://www.youtube.com/embed/CSvq-VyxFH4?vq=hd1...

80
Preventing the Hijacking NTFS structures
MemoryRanger
prevents Hijacking
NTFS structures
Attacker s EnclaveRSRCH s Encl...

Episode 2
Privilege Escalation via Token Hijacking
81

82
EPROCESS
OS kernel core (Scheduler, etc)
SYSTEM:4
Kernel
mode
User
mode
EPROCESS AND TOKEN IN WINDOWS

83
EPROCESS EPROCESS
OS kernel core (Scheduler, etc)
SYSTEM:4 CMD
Kernel
mode
User
mode
EPROCESS AND TOKEN IN WINDOWS

84
TOKEN
EPROCESS
EX_FAST_REF Token
EPROCESS
EX_FAST_REF Token
OS kernel core (Scheduler, etc)
Privileges
SYSTEM:4 CMD
Ker...

85
TOKEN
EPROCESS
EX_FAST_REF Token
EPROCESS
EX_FAST_REF Token
OS kernel core (Scheduler, etc)
Privileges
SYSTEM:4 CMD
Ker...

86
TOKEN
EPROCESS
EX_FAST_REF Token
EPROCESS
EX_FAST_REF Token
OS kernel core (Scheduler, etc)
•SidHash
•RestrictedSidHash...

87
TOKEN
EPROCESS
EX_FAST_REF Token
EPROCESS
EX_FAST_REF Token
OS kernel core (Scheduler, etc)
•SidHash
•RestrictedSidHash...

88
EPROCESS AND TOKEN IN WINDOWS: MSFT Defender
TOKEN
EPROCESS
EX_FAST_REF Token
EPROCESS
EX_FAST_REF Token
OS kernel core...

TOKEN INTERNALS
89
_EPROCESS
Dynamic Part
Static Part
_TOKEN

TOKEN INTERNALS
90
•UserAndGroups
•UserAndGroupCount
...
_EPROCESS
•SidHash
Dynamic Part
Static Part
_SID_AND_ATTRIBUTES:
...

AN IDEA OF TOKEN HIJACKING ATACK
91
_TOKEN
•UserAndGroups
•UserAndGroupCount
SID
...
SID
...
•SidHash
_SID_AND_ATTRIBUTES:...

AN IDEA OF TOKEN HIJACKING ATACK
92
_TOKEN
•UserAndGroups
•UserAndGroupCount
SID
...
SID
...
•SidHash
_SID_AND_ATTRIBUTES:...

TOKEN HIJACKING ATTACK
93
TOKEN
EPROCESS
TOKEN
EPROCESS
OS kernel core (Scheduler, etc)
SYSTEM:4 CMD
Kernel
mode
User
mode...

TOKEN HIJACKING ATTACK
94Commands to stop and disable Windows Defender —
https://www.carbonblack.com/2019/08/16/cb-tau-thr...

DEMO#5: TOKEN HIJACKING
The online version is here –
https://www.youtube.com/embed/7Dgtz_2oGJg?vq=hd1440
95

Enclaves for Newly Loaded DriversEnclaves for sensitive kernel data
EPT pointer
The Current Situation
OS Code
R/W
Token
St...

Enclaves for Newly Loaded DriversEnclaves for sensitive kernel data
EPT pointer
The Current Situation
OS Code
R/W
Token
St...

Enclaves for Newly Loaded DriversEnclaves for sensitive kernel data
EPT pointer
The Current Situation
OS Code
R/W
Token
St...

Enclaves for Newly Loaded DriversEnclaves for sensitive kernel data
EPT pointer
The Current Situation
OS Code
R/W
Token
St...

DEMO#6: PREVENTION OF TOKEN HIJACKING
The online version is here –
https://www.youtube.com/embed/_zGAR7wvM4g?vq=hd1440
100

101
TOKEN
EPROCESS
TOKEN
EPROCESS
OS kernel core (Scheduler, etc)
SYSTEM:4 CMD
Kernel
mode
User
mode Console
Driver
token_...

102
TOKEN HIJACKING IS BLOCKED BY A NEW DATA-ONLY ENCLAVE
Here is a new data-only enclave
TOKEN
EPROCESS
TOKEN
EPROCESS
OS...

Episode 3
MemoryRanger
103

MEMORY RANGER ARCHITECTURE
104
https://github.com/IgorKorkin/MemoryRanger
OS
Memory Access Policy (MAP)
Access to the prot...

1. Windows OS security features provide limited kernel memory protection
2. Handle Hijacking = copy 6 bytes of structure
3...

106

107
MemoryRanger
protects the OS!

Igor Korkin * igor.korkin@gmail.com * igorkorkin.blogspot.com

EXTRA SLIDES
109

DEMO: PREVENTING THE HANDLE HIJACKING ATTACK
110
MemoryRanger Prevents the Handle Hijacking
MemoryRanger
restricts WRITE
a...

DEMO: PREVENTING THE HIJACKING NTFS STRUCTURES
111
Driver
ZwCreateFile()
•ShareAccess=0
Secret File
Driver
hijacking_ntfs_...

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

Top clipped slide

View on SlideShare

1 of 111 Ad

1 of 111 Ad