https://www.zoemurmure.top/archives/2022/ Recent content in 2022 on Logic Security Hugo -- gohugo.io en Tue, 10 Jan 2023 15:09:38 +0800 https://www.zoemurmure.top/posts/x64_paging/ Tue, 10 Jan 2023 15:09:38 +0800 https://www.zoemurmure.top/posts/x64_paging/ Preface During the process of learning HEVD (HackSys Extreme Vulnerable Driver), I found there were many concepts I didn’t fully understand, which prompted this article. The content is translated from reference^[1]^, with minor adjustments to the content and structure for learning purposes. Basic Definitions First, let us clarify the reason for the existence of paging: it is to implement virtual addresses, making the translation between virtual and physical addresses more https://www.zoemurmure.top/posts/hevd_stackoberflowgs/ Tue, 10 Jan 2023 11:18:29 +0800 https://www.zoemurmure.top/posts/hevd_stackoberflowgs/ 0. Preface HackSys Extreme Vulnerable Driver (HEVD) is a Windows driver with multiple vulnerabilities developed for learning kernel exploit techniques. This article describes how to bypass a stack overflow vulnerability with /GS protection under a Windows 10 64-bit environment, involving two security mitigations: SMEP and /GS. Only part of the code is posted in this article. For the complete code, please refer to: https://github.com/zoemurmure/HEVD-Exploit 1. Target Function TriggerBufferOverflowStackGS __int64 __fastcall TriggerBufferOverflowStackGS(void *src, unsigned __int64 Size) { char dst[512]; // [rsp+20h] [rbp-238h] BYREF memset(dst, 0, sizeof(dst)); ProbeForRead(src, 0x200ui64, 1u); DbgPrintEx(0x4Du, 3u, "[+] UserBuffer: 0x%p\n", src); DbgPrintEx(0x4Du, 3u, "[+] UserBuffer Size: 0x%X\n", Size); DbgPrintEx(0x4Du, 3u, "[+] KernelBuffer: 0x%p\n", dst); DbgPrintEx(0x4Du, 3u, "[+] KernelBuffer Size: 0x%X\n", 512i64); DbgPrintEx(0x4Du, 3u, "[+] Triggering Buffer Overflow in Stack (GS)\n"); memmove(dst, src, Size); return 0i64; } 2. https://www.zoemurmure.top/posts/hevd_stackoverflow/ Tue, 10 Jan 2023 11:18:24 +0800 https://www.zoemurmure.top/posts/hevd_stackoverflow/ Target Function TriggerBufferOverflowStack __int64 __fastcall TriggerBufferOverflowStack(void *Src, unsigned __int64 Size) { char Dst[2048]; // [rsp+20h] [rbp-818h] BYREF memset(Dst, 0, sizeof(Dst)); ProbeForRead(Src, 0x800ui64, 1u); DbgPrintEx(0x4Du, 3u, "[+] UserBuffer: 0x%p\n", Src); DbgPrintEx(0x4Du, 3u, "[+] UserBuffer Size: 0x%X\n", Size); DbgPrintEx(0x4Du, 3u, "[+] KernelBuffer: 0x%p\n", Dst); DbgPrintEx(0x4Du, 3u, "[+] KernelBuffer Size: 0x%X\n", 0x800i64); DbgPrintEx(0x4Du, 3u, "[+] Triggering Buffer Overflow in Stack\n"); memmove(Dst, Src, Size); return 0i64; } Mitigation: SMEP^[3]^ Definition SMEP, i.e., Supervisor Mode Execution Protection, ensures that the application does not execute code in untrusted user-mode memory when running at a higher privilege level.