[Full-disclosure] HITB2011KUL - Post Memory Corruption Analysis

["research@xxxxxxxxxxxxxxxxxxxxx" <research@xxxxxxxxxxxxxxxxxxxxx>]

Title:
======
HITB2011KUL - Post Memory Corruption Analysis


Date:
=====
2012-01-26


References:
===========
Download:       http://www.vulnerability-lab.com/resources/videos/398.wmv
View:           http://www.youtube.com/watch?v=kOgarD9KCbg



VL-ID:
=====
398


Status:
========
Published


Exploitation-Technique:
=======================
Conference


Severity:
=========
High


Details:
========
In this presentation, we introduce a new exploitation methodology of invalid 
memory reads and writes, 
based on dataflow analysis after a memory corruption bug has occured inside a 
running process.

We will expose a methodology which shall help with writing a reliable exploit 
out of a PoC triggering 
an invalid memory write, in presence of security defense mechanism such as 
compiler enhancements 
(full RELRO, SSP) or kernel anti exploitation features (ASLR, NX).

In particular, we will demonstrate how to:

- Find all the function pointers inside a running process
- How to determine which ones would have been dereferenced after the crash
- Which ones are truncable (in particular with 0×00000000).

If case all of the above fail, how to test for specific locations overwrites in 
order to indirectly 
trigger a second vulnerability allowing greater control and eventually control 
flow hijacking. All of 
the above without source code, indeed ;)

In the case of invalid memory reads, we will exemplify how to indirectly 
influence the control flow of 
execution by reading arbitrary values, how to trace all the unaligned memory 
access and how to test if 
an invalid read can be turned into an invalid write or used to infer the 
mapping of the binary. We will 
also introduce a new debugging technique which allows for very effective 
testing of all of the above 
by forcing the debugged process to fork(). Automatically. And with a rating of 
the best read/write 
location based on probabilities of mapping addresses (because of ASLR). 


Credits:
========
Jonathan is a security research engineer holding an Engineering degree and a 
Master in Artificial Intelligence. 
Born in France, he’s been living in Brazil and India, before currently working 
in Australia. With about 15 years 
of practice of assembly, he is specialised in low level security, from raw 
sockets to cryptography and memory corruption bugs.

He has been credited for the discovery of complex vulnerabilities in 
cryptographic software (eg: Microsoft 
Bitlocker, Truecrypt, and most BIOS software of the market including HP, Intel 
or Toshiba ones most notably), 
mainstream software (Opera web browser, adobe reader, top tiers antivirus 
softwares) and Virtualization 
software. He is currently working as Senior Security Consultant and CEO at the 
Toucan System security company 
(http://www.toucan-system.com). His clients count some of the biggest Defense 
and Financial Institutions worldwide.

Jonathan is also the co-organiser of the Hackito Ergo Sum conference (HES2011) 
in France. Jonathan has been a 
speaker at a number of great intenational conferences including Blackhat, 
Defcon, HITB (Amsterdam & Kuala Lumpur), 
Ruxcon (Australia), Hackito Ergo Sum (France), and is a recurrent speaker at 
H2HC (Brazil & Mexico). 


Disclaimer:
===========
The information provided in this video is provided as it is without any 
warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, 
indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have 
been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing limitation 
may not apply. Any modified copy or reproduction, including partially usages, 
of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified 
form is granted. All other rights, including the use of 
other media, are reserved by Vulnerability-Lab or its suppliers.

                                                Copyright © 
2012|Vulnerability-Lab




-- 
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx or support@xxxxxxxxxxxxxxxxxxxxx


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/