What happened Microsoft has shipped an emergency security update affecting most Windows users. This update partially addresses a security vulnerability known as PrintNightmare that could allow...
The post Microsoft Urges Customers to Update Windows as Soon as Possible appeared first on McAfee Blog.
We live in a world that thrives on digital connectivity. According to We Are Social, Canadians are now spending half a day more...
The post The Ultimate Guide to Safe Sharing Online appeared first on McAfee Blog.
Last weekend I played TCTF Qualifier online and spent all of my time on this challenge, but still failed to solve it in time. After the contest, I finally solved this challenge. This is a crazy nested challenge: we firstly need to use side channel attack to leak admin_key.txt; then we need to exploit ss_agent to get the ability to open and operate on /dev/ss; then we need to exploit ss.ko to get the root shell; finally we need to exploit qemu to get the flag outside. Since the qemu part has no relation to other parts of the challenge, and it’s my teammate rather than me who solved this part, I will not cover it in this writeup.
0x01 Reverse Engineering ss_agentThis is a menu Pwn challenge. In initialization, it firstly adds a flock to itself to prevent multiple instances being run, and reads admin_key.txt to a global buffer. It has 4 options:
The kernel storage access is implemented by ioctl and mmap, the user-space code is shown below:
char *__fastcall get_ss_mmap_page(unsigned int slot) { char *result; // rax signed int fd; // [rsp+10h] [rbp-10h] int fd_4; // [rsp+14h] [rbp-Ch] char *v4; // [rsp+18h] [rbp-8h] fd = open("/dev/ss", 2); // open /dev/ss if ( fd < 0 ) return 0LL; if ( (ioctl(fd, 0, slot) & 0x80000000) == 0LL ) // use ioctl to set the slot { v4 = (char *)mmap(0LL, 0x10000uLL, 3uLL, 1uLL, (unsigned int)fd, 0LL); // use mmap to map the kernel storage into user space fd_4 = close(fd); if ( v4 && fd_4 >= 0 ) result = v4; // return the kernel page if there is no problem else result = 0LL; } else ... return result; }The format of kernel storage is 8-byte data length + data + 32-byte key, as we can see when ss_agent writes the storage.
__int64 __fastcall write_to_storage(unsigned int slot, char *a2, unsigned __int64 len, char *a4) { __int64 result; // rax char *v7; // [rsp+28h] [rbp-8h] if ( len > 0xFFD7 ) return 0xFFFFFFFFLL; v7 = get_ss_mmap_page(slot); if ( !v7 ) return 0xFFFFFFFFLL; *(_QWORD *)v7 = len; _memcpy((v7 + 8), a2, len); _memcpy(&v7[len + 8], a4, 32LL);// layout: length + data + key if ( (int)munmap((__int64)v7) >= 0 ) result = 0LL; else result = 0xFFFFFFFFLL; return result; }However, to exploit this ss_agent, we have to leak admin_key.txt first, otherwise we cannot trigger the double free bug.
ss.koThis is the kernel module that implements /dev/ss device. The functionality can be briefly described as follows:
When we use this kernel module, following occurs step by step:
To inspect memory of ss.ko and set breakpoint to ss.ko, we need to know its address in memory. My approach is shown as following:
Now we are going to leak admin_key.txt using time-based side channel attack. We observed that: 1. memcmp function is implemented byte-by-byte; 2. page fault that calls sub_90 takes quite long time. Therefore, we can manipulate the layout of slot 0 so that the first byte of admin_key is in the first page and remaining parts are in the second page. Therefore, when we call kick, if first byte of our input does not equal to first byte of admin_key, the second page will not be accessed so comparison should be fast; otherwise the second byte will be accessed, causing page fault and sub_90 to be called, which makes comparison slow. We can use this approach to brute-force first byte of admin_key. Then we can shift the admin_key to left (e.i. reduce length of name) by 1 byte and use the same approach to get the following bytes.
Note that we cannot do this in Python pwntools, because network latency fluctuation is much more than the difference mentioned above. Instead, we have used C to implement such attack. We upload the program to remote and run it directly, so there will be no network latency. Anonymous pipe is used for IO interaction, and __rdtsc is used for time difference calculation, you can read exploit code for more details.
Another thing to note is we need to ensure sub_90 to be called when handling page fault, otherwise the latency might be insignificant. This is the case if we separate name registration and kick comparison into different process instances.
The full exploit is here.
0x03 Exploit ss_agentAs I briefly mentioned above, there is a double free bug in ss_agent. Trying the double free for small-size chunk, we found that there is no crash, and there is tcache string in the binary, so I would say the static binary is generated using possibly libc-2.27. Knowing this, we can write exploit like a normal menu challenge:
Instead of using pwntools, I used C for this part again, because I found that sending binary data via qemu interface causes problem.
To debug this binary, I patched it so that only heap operations remain. Thus we can run it without /dev/ss. This makes debugging much more convenient since we don’t need to deal with kernel stuff anymore.
The full exploit is here.
Initially I thought I could have root once ss_agent is compromised, because it has a setgid being set. However, this is wrong. The access permission of /challenge/ss_agent is -rwxr-sr-x and access permission of /dev/ss is crw-rw----. Therefore, although ss_agent can access /dev/ss, it does not run in root; instead, it runs in the group of root; and such group privilege even does not persist after an execve system call.
However, we need to run arbitrary code that can operate on /dev/ss in order to exploit ss.ko. I came up with 2 approaches:
Obviously, the second one is more convenient for us.
0x04 Exploit ss.koNow we come back to ss.ko in order to get root shell. The bug is in page fault handler: v2 <= 0xFFFF is a signed comparison; if v2 is negative, we can pass the check and map unintended page into user space. Since v2 is a 32-bit signed integer, we can call mmap with size 0x100000000, and access the last few pages to make v2 = -0x1000 * n. It turns out returned_vpage will be page before mmap_buffer.
In addition, to prevent sub_90 from being called, we need to ensure _bittest to return 1. Fortunately, the bitmap is behind mmap_buffer exactly, so if we set the last page of mmap_buffer to 0xff, _bittest can always return 1 for small negative index.
By debugging, we found there are many useful leaks in the pages before mmap_buffer: we can leak the Linux kernel address and ss.ko address easily.
I have come up with 4 approaches for exploitation, but finally only the last one works:
The full exploit is here.
0x05 ConclusionThis nested challenge is really complicated, but I have learned a lot from it. In addition, I think it is better to put one flag at each stage, instead of one flag for the whole exploit chain.
Many Windows applications and services are implemented using an automation infrastructure called Component Object Model (COM).
COM has been around for decades and its useful for programming, sharing of code at binary level, usage from scripting languages, and well, red teaming.
Wide Usage of Component Object ModelMany products are implemented as COM objects, including Microsoft Office. Using PowerShell (or other languages) COM objects can be created to fully automate applications and services.