14. Alessandro Magnosi: Leveraging Emulated Read-Only Filesystems and NTFS Glitches for Inf. & Pers.

### Overview In this talk, Alessandro Magnosi (known online as Class Virus), a managing consultant at BSI, discusses modernizing and emulating techniques reminiscent of Stuxnet for compromising Windows systems in Operational Technology (OT) environments. Originating from a red teaming engagement where his team was tasked with compromising an engineering workstation via a Siemens Step 7 installation workflow, the presentation focuses on overcoming modern Windows security controls. Magnosi demonstrates how emulated read-only filesystems (CDFS/ISO) and NTFS/NT Object Manager quirks can be combined to bypass event logging and load unsigned or vulnerable drivers.

### Key Topics - **Stuxnet and the OT Kill Chain**: Contrasting IT penetration testing with the two-phase OT cyber kill chain, which focuses on accessing OT networks, PLCs, and engineering workstations. Magnosi recalls Stuxnet's original architecture (LNK shortcuts, user-mode propagation, and stealthy kernel rootkits via direct registry creation and `NtLoadDriver`). - **Modern Driver Loading Defenses**: Navigating Driver Signing Enforcement (DSE), Microsoft's Driver Blocklist, Certificate Revocation Lists (CRLs checked via MinCrypt/SymCrypt), and Virtualization-Based Security (VBS) with Hypervisor-Protected Code Integrity (HVCI), Extended Page Tables (EPT), and Kernel Data Protection (KDP). - **Bring Your Own Vulnerable Driver (BYOVD)**: Typical vulnerabilities abused in drivers, including arbitrary MSR access (`IA32_LSTAR`), physical memory access (for token swapping via `EPROCESS`), and arbitrary kernel virtual memory read/write primitives. - **CDFS In-Memory Overwrite Flaw**: Exploiting Windows CDFS/UDF handling to remap read-only mounted ISO files to read-write pages, allowing on-the-fly modification of seemingly immutable mounted media. - **Driver Path Hijacking**: Abusing NT Object Manager symbolic links, reparse points, and the permanent `\SystemRoot` / `\BootDevice` symlink to deceive Sysmon and ETW driver load event logging.

### Technical Details Magnosi highlights how modern Windows security mitigates legacy bypasses. Post-HVCI, code runs across Virtual Trust Levels (VTL0 for normal kernel, VTL1 for hypervisor), and EPT prevents modifying page permissions (W^X enforcement). While KDP protects sensitive data structures, page remapping attacks can theoretically copy structures to read-write pages, though hardware features like Intel BTRP (Branch Tracker / Redirection Protection) and Intel CET mitigate these vectors. Bypassing modern constraints requires either techniques like Kernel Forge (ROP on kernel wait threads), SSDT overwrites, or temporarily disabling code integrity requiring administrative reboots.

To load a vulnerable driver covertly, the speaker details toolsets developed during research: - **IOCDF CDFSlib**: Overcomes the read-only assumption of mounted ISO files. When CDFS/UDF reads content into memory via `CcCopyRead`, the pages can be remapped to RW, enabling modification of files on the mounted ISO without unmounting. - **Driver Jack**: Manipulates how drivers resolve paths. Since driver loads rely on the `\SystemRoot` symlink (which points to `\BootDevice`), an attacker with `SYSTEM` privileges can call `NtMakeTemporaryObject` to lower the reference count on the permanent symlink, re-point `\BootDevice` to the emulated CD-ROM device, and perform a drive letter swap.

When `NtLoadDriver` executes, the system resolves the driver from the modified ISO path while Event Tracing for Windows (ETW) and Sysmon report the execution path as a legitimate system file (e.g., on `C:`). When chained with Bring Your Own Vulnerable Driver tools (like KDU or LP mapper), this provides an evasive path to kernel code execution.

### Takeaways - Windows security features like the driver blocklist can often be disabled with administrative privileges or bypassed due to infrequent updates, though hardware-rooted defenses (HVCI, CET, BTRP) significantly raise the bar for kernel exploitation. - Defenders should not rely solely on driver path logging in Sysmon or ETW, as symlink and drive swap abuse can spoof the recorded path. - Recommended detection and mitigation strategies include: monitoring drive letter changes and modifications to the `\BootDevice` symlink, detecting `SYSTEM` and `TrustedInstaller` impersonation, implementing hash cross-checking (comparing the in-memory/loaded driver hash to the file on disk), enforcing WDAC whitelisting over standard blocklists, and keeping hardware up to date.