Demystifying MS17 010 Reverse Engineering the ETERNAL Exploits
zerosum0x0 presents demystifying ms17 010 reverse engineering the eternal exploits: MS17-010 is the most important patch in the history of operating systems, fixing remote code execution vulnerabilities in the world...
Summary
Architecture and Background
MS17-010 is the most important patch in the history of operating systems, fixing remote code execution vulnerabilities in the world of modern Windows. The ETERNAL exploits, written by the Equation Group and dumped by the Shadow Brokers, have been used in the most damaging cyber attacks in computing history: WannaCry, NotPetya, Olympic Destroyer, and many others.
Vulnerability Analysis
Yet, how these complicated exploits work has not been made clear to most. This is due to the ETERNAL exploits taking advantage of undocumented features of the Windows kernel and the esoteric SMBv1 protocol.
Exploitation and Demonstrations
This talk will condense years of research into Windows internals and the SMBv1 protocol driver. Descriptions of full reverse engineering of internal structures and all historical background info needed to understand how the exploit chains for ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY work will be provided.
Remediation and Defensive Strategies
This talk will also describe how the MS17-010 patch fixed the vulnerabilities, and identify additional vulnerabilities that were patched around the same time.
Related talks
Main Stage·40 min
Nassim Asrir · Zackary Flack
Discloses a pre-authentication remote code execution chain against Synology DSM, demonstrating how attackers achieve root compromise via the S2S protocol.
Main Stage·40 min
Matthias Fischer · Patrick Wardle
Reveals critical baseband and firmware vulnerabilities in popular cellular modems that allow remote over-the-air exploitation and device takeover.
Main Stage·35 min
Ji'an Zhou · Lishuo Song
Discloses multiple memory corruption and deserialization vulnerabilities in PyTorch's TorchScript JIT engine that allow arbitrary remote code execution via malicious AI models.