Explains how kernel exploits work using an example from HackSys team's vulnerable driver. The example exploit works on vanilla Windows 7 machine.

1. Exploiting the Windows
kernel
By Japneet Singh

2. Agenda
• An unwelcome Guest!
• Warmup: Windows internals
• Windows kernel attack surface
• Exploit details

3. An unwelcome Guest!
• Demo components
• HEVD
• Exploit executable

4. Windows internals: Memory layout
• User mode
• Thread Stacks
• Heaps
• Mapped modules (EXEs and DLLs)
• Kernel mode
• Thread stacks
• Paged and Non-paged pools (heap in kernel mode memory)
• Mapped modules (Windows kernel, kernel mode DLLs, drivers)

5. CPU
MEMORY
I/O
I/O
I/O
Kernel
Process P1
Driver
D1
Driver
D2
Privileged
instructions
Non-Privileged
instructions
Paged
Pool
Non paged Pool
Stacks
Stacks
DLL 2
DLL 1Heaps
EXE
When Thread of Process P1 is running

6. CPU
MEMORY
I/O
I/O
I/O
Kernel
Process P2
Driver
D1
Driver
D2
Privileged
instructions
Non-Privileged
instructions
Paged
Pool
Non paged Pool
Stacks
Stacks
DLL 2
DLL 1Heaps
EXE
When Thread of Process P2 is running

7. Windows internals: System calls

8. Windows internals: Io Controls
• System call served by specific driver
• Send messages to a driver, and receive response
• Each message is assigned different identifier unique to that driver

9. Windows internals: Access token
• Every process running on Windows has an associated Primary token
• Token consists of
• User Security Identifier (SID)
• Group memberships
• Privileges
• Etc.
• Token is part of EPROCESS structure

10. Windows internals: Heaps/Pools
• Functionality
• Support API to allocate/deallocate
• Track allocated and free memory
• Handle internal fragmentation
• Troubleshooting aspects
• Structurally support ways to detect heap/pool corruptions
• Provide debugging aids
• Performance aspects
• Handle external fragmentation
• Coalesce adjacent memory areas when memory gets free

11. Windows kernel attack surface

12. Windows kernel attack surface
GDI
APIs
Device drivers
IoCtls
Win32
APIs

13. Exploit details
• What we want to achieve?
• Use after Free
• Kernel pool spray
• Shellcode execution
• Token stealing

14. What we want to achieve?
• We want to steal System token from System Process

15. What we want to achieve?
• We want to steal System token from System Process
• We need to find a vulnerability in a driver

16. What we want to achieve?
• We want to steal System token from System Process
• We need to gain RCE in kernel mode to execute our shellcode which
performs Token stealing

17. What we want to achieve?
• We want to steal System token from System Process
• We need to gain RCE in kernel mode to execute our shellcode which
performs Token stealing
• We know of a vulnerable kernel driver which has two vulnerabilities
• It allows Use After Free (will see shortly)
• It allows us to place a buffer of arbitrary size in kernel mode memory.
Contents of the buffer are in our control.

18. What we want to achieve?
• We want to steal System token from System Process
• We need to gain RCE in kernel mode to execute our shellcode which
performs Token stealing
• We know of a vulnerable kernel driver which has two vulnerabilities
• V1 - It allows Use After Free (will see shortly)
• V2 - It allows us to place a buffer of arbitrary size in kernel mode memory.
Contents of the buffer are in our control.
• We exploit the kernel driver vulnerability V2 to place a pointer to our
shellcode in kernel memory, and achieve execution of it using
vulnerability V1

19. What we want to achieve?
• We want to steal System token from System Process
• We need to gain RCE in kernel mode to execute our shellcode which
performs Token stealing
• We know of a vulnerable kernel driver which has two vulnerabilities
• V1 - It allows Use After Free (will see shortly)
• V2 - It allows us to place a buffer of arbitrary size in kernel mode memory. Contents
of the buffer are in our control.
• We exploit the kernel driver vulnerability V2 to place a pointer to our
shellcode in kernel memory, and achieve execution of it using vulnerability
V1
• Finally shellcode gets executed and we get System privilege by stealing
System Token

20. What we want to achieve?
• We want to steal System token from System Process
• We need to gain RCE in kernel mode to execute our shellcode which
performs Token stealing
• We know of a vulnerable kernel driver which has two vulnerabilities
• V1 - It allows Use After Free (will see shortly)
• V2 - It allows us to place a buffer of arbitrary size in kernel mode memory. Contents
of the buffer are in our control.
• We exploit the kernel driver vulnerability V2 to place a pointer to our
shellcode in kernel memory, and achieve execution of it using vulnerability
V1
• Finally shellcode gets executed and we get System privilege by stealing
System Token
• Then we launch cmd.exe as System user

21. Step 1: Allocation
Step 2: Free
Step 3: Use
Use after Free
Buffer
Callback
PTR
Buffer
Callback
PTR
PTR->Callback();

22. Step 1: Allocation
Step 2: Free
Step 2.5: Allocate at freed loc
Step 3: Use
(Ab)Use after Free
Buffer
Callback
PTR
Buffer
Callback
PTR
PTR->Callback();
Buffer
Callback
PTR

23. Question
• How can we allocate a controlled object at pre-determined location?

24. Kernel pool spray aka Grooming
• A - Allocate large number of objects to remove fragmentation
• B - Allocate large number of objects to create a big chunk of
allocation
• Create holes in B by deallocating alternate objects in B to make
further allocations deterministic
• Any further allocation of similar sized object would be in one of the
holes created in B

25. Pool grooming

26. Pool grooming: 1st spray

27. Pool grooming: 2nd spray

28. Pool grooming: Creating holes

29. Pool grooming: Filling holes with fake objects

30. Full sequence of exploit
• Groom the pool to create holes
• Allocate and free
• Allocate - Allocation will happen in one of the holes
• Deallocate – now we can place fake objects
• Create fake objects containing callback pointer to our shellcode
• Place fake objects
• Fill all the holes with fake objects
• Trigger UaF
• This leads to callback to our shellcode
• Shellcode performs Token stealing
• Now launch cmd.exe using stolen token

31. Token stealing
• Find EPROCESS of a System process
• Jump to token offset in the EPROCESS
• Copy token privileges into current EPROCESS token

32. References
• https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
• http://fuzzysecurity.com/tutorials/expDev/19.html
• http://www.mista.nu/research/MANDT-kernelpool-PAPER.pdf
• https://hshrzd.wordpress.com/2017/06/22/starting-with-windows-
kernel-exploitation-part-3-stealing-the-access-token/