USA 2000

### Overview In this talk, Joey explores the evolution of exploitation techniques on Windows NT and Windows 2000, detailing how attackers move from initial entry to user-mode persistence, and ultimately escalate into ring 0 (kernel mode) to subvert the Trusted Computing Base (TCB). The presentation emphasizes that while security practitioners have begun to recognize user-mode buffer overflows and format string attacks on NT platforms, the industry has largely failed to appreciate the full impact of an adversary operating at kernel level, where protective mechanisms and security monitoring tools can be completely blinded.

### Key Topics - **Evolution of Win32 Exploitation Payloads**: A historical review tracing early work—referencing Aleph One, Solar Designer, DilDog, Barnaby Jack, and Greg Hoglund. Early payloads progressed from simple file uploads via vulnerable CGI scripts and guest account elevation to downloading executables, binding netcat or cmd.exe to listening ports, and developing reverse command shells. - **Bypassing Egress and Restrictive Environments**: Analysis of reverse command shells to bypass incoming firewall/router restrictions, followed by multi-tier/cascading payloads where tiny shellcodes (e.g., 250 bytes) allocate memory and fetch larger (up to 64KB) unconstrained payloads. It also examines socket recycling techniques, where exploits in IIS ISAPI extensions or CGI applications hijack already-established socket handles to evade both incoming and outgoing traffic rules. - **Limitations of User-Mode Attacks**: Why defensive products like host-based intrusion detection systems (e.g., CyberCop Monitor) and file integrity monitoring tools (such as Tripwire) can easily detect user-mode anomalies, prompting attackers to seek stealth and persistence within ring 0. - **Motivations for Kernel-Level Exploitation**: Stealth, reliable system-wide surveillance (e.g., patching keyboard drivers to intercept keystrokes before thread message queues), undetectable covert communication channels (such as hooking internal tcpip.sys functions processing ICMP packets), and making subtle modifications to databases or files across the entire operating system. - **Kernel-Mode Injection Techniques**: How attackers transition into ring 0 beyond traditional driver loading, specifically noting kernel buffer overflows, accessing the `\Device\PhysicalMemory` section object, and leveraging native NT APIs.

### Technical Details The speaker highlights multiple mechanisms for escalating into and operating within the kernel: - **Privilege Escalation**: Exploiting COM objects instantiated by Microsoft Transaction Server (MTS) components running in the local system context without third-party plugin authentication, or using the `at` scheduling service to elevate from administrator to local system privileges. - **Kernel Memory Patching**: Mentioning Greg Hoglund's demonstrated two-byte patch to `SeAccessCheck` in the Security Reference Monitor, which grants all access to all objects by anyone, completely rendering auditing and discretionary access control lists ineffective. - **Subverting Security Monitors**: Demonstrating that tools relying on OS integrity (e.g., Tripwire) fail when the underlying operating system is manipulated to lie about file state. - **Alternative Ring 0 Injection Vectors**: 1. **Kernel-Mode Buffer Overflows**: Present in third-party or OS kernel drivers, traditionally treated as mere local denial-of-service bugs. 2. **`\Device\PhysicalMemory`**: A kernel section object created by the memory manager that maps physical RAM directly (used legitimately by graphics drivers to access PCI memory-mapped I/O and for 16-bit DOS Virtual Machines/v86 environments), allowing direct physical memory manipulation. 3. **`ZwSetSystemInformation`**: Using this native API with the information class `SystemLoadAndCallImage` (noted as class 38) to load an arbitrary Portable Executable (PE) image into kernel address space, create a ring 0 thread, and execute it.

### Takeaways Security and forensics tools heavily rely on the integrity of the operating system itself. If an attacker transitions from user mode into ring 0, they compromise the TCB, allowing them to hook kernel network stacks (like tcpip.sys) and manipulate OS reporting mechanisms. Defensive engineering and forensic analysis must look beyond signed drivers and user-mode activity to recognize, detect, and counter direct kernel manipulation.