19th-20th November 2011 - Melbourne, Australia
In this presentation, we introduce a new exploitation methodology of invalid memory reads and writes, based on dataflow analysis after a memory corruption bug has occured inside a running process.
We will expose a methodology which shall help writting a reliable exploit out of a PoC triggering an invalid memory write, in presence of security defense mechanisme such as compiler enchancements (full RELRO, SSP...), or kernel anti exploitation features (ASLR, NX...).
We will demonstrate how to:find all the function pointers inside a running process, how to determine which ones would have been dereferenced after the crash, which ones are truncable (in particular with 0x00000000). In case all of the above fail, how to test for specific locations overwrites in order to indirectly trigger a second vulnerability allowing greater control and eventually control flow hijacking. All of the above without source code, indeed ;)
In the case of invalid memory reads, we will exemplify how indirectly influence the control flow of execution by reading arbitary values, how to trace all the unaligned memory access and how to test if an invalid read can be turned into an invalid write or used to infere the mapping of the binary.
We will also introduce a new debugging technique which allows for very effective testing of all of the above by forcing the debugged process to fork(). Automatically. And with a rating of the best read/write location based on probabilities of mapping addresses (because of ASLR).
Finally, since overwriting function pointers doesn't allow direct shellcode execution because of W^X mappings, we introduce a new exploitation technique which works even in the most hardcore kernels such as grsecurity. IT is called "stack desynchronization" and allows frame faking inside the stack itself.
Those techniques are implemented in the form of a proof of concept tool available under the Apache 2.0 license at : http://www.pmcma.org/ .
Jonathan is a security research engineer holding an Engineering degree and a Master in Artificial Intelligence. Born in France, he’s been living in Brazil and India, before currently working in Australia. Jonathan first came for Ruxcon last year... and never really left :) With about 15 years of practice of assembly, he is specialised in low level security, from raw sockets to cryptography and memory corruption bugs.
He has been credited for the discovery of complex vulnerabilities in cryptographic software (eg: Microsoft Bitlocker, Truecrypt, and most BIOS software of the market including HP, Intel or Toshiba ones most notably), mainstream software (Opera web browser, adobe reader, top tiers antivirus softwares) and Virtualization software. He is currently working as Senior Security Consultant and CEO at the Toucan System security company (http://www.toucan-system.com). His clients count some of the biggest Defense and Financial Institutions worldwide.
Jonathan is also the co-organiser of the Hackito Ergo Sum conference (HES) in France. Jonathan has been a speaker at a number of great intenational conferences including Blackhat US, Defcon, HITB (Amsterdam & Kuala Lumpur), Ruxcon (Australia), Hackito Ergo Sum (France), and is a recurrent speaker at H2HC (Brazil & Mexico).