Taking Windows 10 Kernel Exploitation to the next level
Novel KASLR bypasses and kernel pool exploitation to achieve code execution despite Windows 10 hardening.
Summary
Windows 10 Hardening
Since Windows 10 release and especially in Anniversary and Creators Updates, Microsoft introduced powerful exploit mitigations including full-scale KASLR and blocking of kernel pointer leaks.
Kernel Primitives
The presentation reviews powerful read and write kernel primitives that work despite recent hardening. Window and Bitmap object abuse provides generic approaches to leveraging write-what-where vulnerabilities.
KASLR Bypass
Previously unknown KASLR bypasses in Windows 10 Creators Update are disclosed. Kernel driver leaks provide initial information, but novel de-randomization techniques work without relying on direct driver attacks.
Code Execution
Obtaining kernel-mode code execution requires overcoming Page Table Entry randomization. Dynamic reverse engineering provides one de-randomization approach. Alternatively, arbitrary-size executable kernel pool memory allocation enables code execution transfer through hijacked system calls.
Related talks
Main Track 1·44 min
Saif El Sherei
Complete walkthroughs of Windows kernel exploitation using GDI bitmap objects with released exploits.
Briefings·28 min
Lukas Maar · Lukas Giner
Presents a novel timing side-channel attack on the TLB, combined with kernel allocator massaging, to derandomize the location of security-critical kernel objects in the latest Linux kernel.
Black Hat·54 min
Security researchers examine technical aspects of Analyzing & Breaking QNX Exploit Mitigations and PRNGs For Embedded Systems.