Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Becks.io#5 Get start to Old Driver in Windows K...

NotSurprised
December 12, 2019

Becks.io#5 Get start to Old Driver in Windows Kernel

This talk will introduce the windows kernel driver architecture and dev & debug step, then share some driver problems that make PoE in last year.

NotSurprised

December 12, 2019
Tweet

More Decks by NotSurprised

Other Decks in Programming

Transcript

  1. Intro • UCCU Hacker • AIS3 2016 trainee • SITCON

    2019 speaker • MOPCON 2019 speaker • ITRI Engineer (serve my country) • 5-years Bachelor & Master of NSYSU Email : [email protected] > NotSurprised
  2. > • Some malwares use device drivers to escalate privileges

    – VirtualBox CVE-2014-2477 • Device Drivers already present in some Red Team toolkits – Mimikatz uses a driver (mimidrv.sys) to facilitate injection
  3. > • Windows Driver Model (WDM) • Windows OS driver

    catalogues : – bus driver (e.g. USB, PCI) – function driver (e.g. USB Adaptor) – filter driver (e.g. Anti-Virus)
  4. > & • After Windows 7, Filter compiling was migrate

    into VS, and refracture WDF, Minifilter from WDM • Minifilter is more easier to compile that traditional Filter, dynamic install/attach/unload also the new feature for minifilter
  5. > • VXD (Virtual X Driver) – Windows 95、Windows 98

    • KDM (Kernel Driver Model) – Windows NT • WDM (Windows Driver Model) – Windows 2000 ~ Windows 8.1 – DDK (Driver Developer Kit) • WDF (Windows Driver Frameworks) – Windows 7 ~ Windows 10 – WDK (Windows Driver Kit)
  6. > • WDM • KMDF • WDDM • NDIS (miniport,

    filter, protocol) • WFP • Native 802.11 • WDI • FileSystem (MiniFilter) • PortCls • KS
  7. > Applicaton Windows Servicce UserMode PnP Manager Setupapi.dll WMI Service

    WDM WMI Routine PnP Manager Power Manager I/O Manager function filter HAL ... ... .inf .cat registry I/O system Driver Kernel Mode User Mode
  8. > • In Windows OS kernel-mode is stack-like architecture, this

    kind Layered driver Architecture also been called Driver Stack. source : MSDN source: MSDN
  9. > Envuroment Subsystem/ Dlls I/O System Kernel Mode User Mode

    I/O Manager IRP header IRP stack location File Object Device Object Driver Object Start I/O Routine ISR DPC Routine Driver Entry & Dispatch Routine Unload Routine Create Read Write …
  10. > Envuroment Subsystem/ Dlls I/O System Kernel Mode User Mode

    I/O Manager IRP File System Manager Volumn Manager IRP source: The Windows 2000 Device Driver Book
  11. > Envuroment Subsystem/ Dlls I/O System Kernel Mode User Mode

    I/O Manager KMDF Manager I/O target KMDF DriverA KMDF DriverB KMDF DriverC KMDF0 / wdf01000.sys
  12. > Kernel Mode User Mode Reflector(Filter) Kernel Mode Driver Kernel

    Mode Driver Windows Kernel Driver Manager Applications Win32 API UMDF Driver UMDF Framework UMDF Runtime Reflector(Filter) Kernel Mode Driver UMDF Driver UMDF Framework UMDF Runtime UMDF Host Process UMDF Host Process Local Device Stack Local Device Stack WUDFx02000.dll UMDFCtrlDev
  13. > IRP FiDO FiDO FiDO FDO FiDO FiDO PDO Upper

    Filter Driver C Upper Filter Driver B Upper Filter Driver A Lower Filter Driver B Lower Filter Driver A Function Driver Bus Driver source: Windows Internals
  14. > • IRP(I/O Request Packets) work flow in Windows OS:

    source : MSDN Calculate drivers number and allocate IRP, then dispatcher to • WDF • function driver
  15. > Enviroment Subsystem/ Dlls I/O System Kernel Mode User Mode

    I/O Manager Filter Manager File System Manager File System Manager IRP IRP IRP MiniFilterDriverA MiniFilterDriverB MiniFilterDriverC 1. 2. 3. 4. 5. 6. 7.
  16. > Envuroment Subsystem/ Dlls I/O System Kernel Mode User Mode

    I/O Manager Filter Manager File System Manager File System Manager IRP IRP IRP MiniFilterDriverA MiniFilterDriverB MiniFilterDriverC 7. 6. 5. 4. 3. 2. 1.
  17. > • IRP (I/O Request Package) is a data structure

    in Windows kernel, it has been designed to store input/output data • IRP is a complicate data structurer, there’s 2 major attributes: MajorFunction & MinorFunction, which stand for IRP’s major type and type’s detail description • Same MajorFunction will present different behaviors with different MinorFunctions
  18. > • IRP_MJ_DIRECTORY_CONTROL • IRP_MJ_READ • IRP_MJ_WRITE • IRP_MJ_QUERY_INFORMATION •

    IRP_MJ_SET_INFORMATION • IRP_MJ_CREATE • IRP_MJ_CLEANUP • IRP_MJ_CLOSE • IRP_MJ_DEVICE_CONTROL • IRP_MJ_LOCK_CONTROL • IRP_MJ_SET_VOLUME_INFORMATION • IRP_MJ_QUERY_SECURITY • IRP_MJ_SET_EA • ……
  19. > • IRP_MJ_DIRECTORY_CONTROL • IRP_MJ_READ • IRP_MJ_WRITE • IRP_MJ_QUERY_INFORMATION •

    IRP_MJ_SET_INFORMATION • IRP_MJ_CREATE • IRP_MJ_CLEANUP • IRP_MJ_CLOSE • IRP_MJ_DEVICE_CONTROL • IRP_MJ_LOCK_CONTROL • IRP_MJ_SET_VOLUME_INFORMATION • IRP_MJ_QUERY_SECURITY • IRP_MJ_SET_EA • ……. FILE_CREATED FILE_DOES_NOT_EXIST FILE_EXISTS FILE_OPENED FILE_OVERWRITTEN (overwrite) FILE_SUPERSEDED (replace) FILE_ALLOCATION_INFORMATION FILE_BASIC_INFORMATION (insert、time、privilege) FILE_DISPOSITION_INFORMATION (delete) FILE_END_OF_FILE_INFORMATION FILE_LINK_INFORMATION FILE_POSITION_INFORMATION FILE_RENAME_INFORMATION (rename) FILE_VALID_DATA_LENGTH_INFORMATION
  20. > Use these information to determine file should be backup

    or not (size, position, format) source: MSDN
  21. • After Microsoft publish minifilter framework, there also come up

    with WDM to WDF, Windows 7 to Windows 10. Microsoft migrate those develop framework into Visual Studio. Notice that there still lots version conflict problems • WDK installer can be downloaded from official website, SDK should be select to install during Visual Studio installing progress • Visual Studio 2017 & 2019 default not install SDK, need to select the checkbox • ARM/ARM64 > 、 、
  22. >

  23. >

  24. >

  25. >

  26. > • SERVICE_BOOT_START (0) (DevieceDriverOnly) • SERVICE_SYSTEM_START (1) (DevieceDriverOnly) •

    SERVICE_AUTO_START (2) • SERVICE_DEMAND_START (3) • SERVICE_DISABLED (4)
  27. > • UTF16 encode : 魯 a = 9B 6F

    00 61 • ASCII encode : 9B 6F 00 61 = › o a String Type Description char *str = {"kd string"} ANSI string wchar_t *wstr = {L"kd string"} Unicode string size_t len = strlen(str) ANSI string len size_t wlen Unicode string len printf("%s %ws %d %d", str, wstr, len, wlen) print format OutputDebugString("%s", wstr) print format
  28. > C WDK unsigned long ULONG unsigned char UCHAR unsigned

    int UINT void VOID unsigned long * PULONG unsigned char * PUCHAR unsigned int* PUINT void * PVOID
  29. > HANDLE Event UNICODE_STRING ObjectName Length MaximumLength Buffer 4 byte

    2 byte 2 byte 4 byte HANDLE Event UNICODE_STRING ObjectName Length MaximumLength Padding Buffer 8 byte 2 byte 2 byte 4 byte 8 byte
  30. > • On Microsoft Windows 2000 and later versions of

    the operating system, "\??" is equivalent to "\DosDevices". • For example, the object name of the "C:\WINDOWS\example.txt" file is "\DosDevices\C:\WINDOWS\example.txt". Path Type Description \\abc\xyz MSDN C:\abc\xyz MSDN \\.\C:\abc\xyz MSDN \\?\C:\abc\xyz MSDN \\?\UNC\abc\xyz MSDN \??\UNC\abc\xyz MSDN ?\UNC\abc\xyz Undocumented in WindowsServer 2012 2016
  31. >

  32. > • User module User-mode extract data from communication port,

    according data structure in UK.h to split the data buffer
  33. > Filter Manager Read Write Rename Delete User mode Kernel

    mode I/O Manager Minispy(Kernel) File System Driver Physical Device Minispy(User) Storage Driver Stack MinispyUK.h
  34. > • Use Driver to change IRP content. • If

    need error message, deny it. Fake I/O
  35. >

  36. >

  37. >

  38. >

  39. >

  40. >

  41. >

  42. >

  43. >

  44. • Windows drivers – Signed – WHQL signed – EV

    signing cert (A Must for Win10 signing process) > source: この勇者が俺TUEEEくせに慎重すぎる
  45. > LoJax • First UEFI malware found in the wild

    • Implant tool includes RwDrv.sys driver from RWEverything • Loads driver to gain direct access to SPI controller in PCH • Uses direct SPI controller access to rewrite UEFI firmware
  46. > Slingshot • APT campaign brought along its own malicious

    driver • Active from 2012 through at least 2018 • Exploited other drivers with read/write MSR to bypass Driver Signing Enforcement to install kernel rootkit
  47. > • ASRock Drivers – CVE Name: • CVE-2018-10709, CVE-2018-10710,

    CVE-2018-10711, CVE-2018-10712 • ASUS Drivers – CVE Name: • CVE-2018-18537, CVE-2018-18536, CVE-2018-18535 • GIGABYTE Drivers – CVE Name: • CVE-2018-19320, CVE-2018-19322, CVE-2018-19323, CVE-2018-19321 • ......
  48. > ASROCK + ASUS + GIGABYTE • Arbitrary ring0 virtual

    memory read/write • Port mapped I/O access • MSR Register access • Arbitrary physical memory read/write • CR register access • ......
  49. > • Most drivers specify only the FILE_DEVICE_SECURE_OPEN characteristic. This

    ensures that the same security settings are applied to any open request into the device's namespace.
  50. >

  51. >

  52. >

  53. > • MinimumRequiredLength – The minimum buffer size, in bytes,

    that the driver needs to process the I/O request.
  54. > • Model specific registers (MSR) exist in CPUs. Contrary

    to the name, some MSRs are actually part of the official x86 or x64 architecture and not "model specific" • The transition to kernel-mode is done via an MSR – syscall -> read MSR -> call MSR pointer (Ring-0) -> kernel function handles the syscall logic • Default on modern systems we only care about MSR_LSTAR (0xc0000082) • Can inspect via rdmsr command in windbg
  55. > • You can probably see where this is going

    • Exposed wrmsr (__writemsr) instruction gives us a pointer to overwrite primitive – Function pointer is called when any syscall is issued – Called from Ring-0 source: Fireeye
  56. > • Win8+ Supervisor Mode Execution Prevention (SMEP) - BSODs

    if CPU detects execution of a user-mode VA while in Ring-0 • As a response to Spectre and Meltdown Microsoft added Kernel Page Table Isolation (KPTI), KPTI maintains a separate set of page tables for user- and kernel-mode EZ MODE ~Win8 SMEP Win8+ Spectre+Meltdown KPTI source: Fireeye
  57. > • HyperV & PatchGuard catches MSR and CR3/CR4 modifications

    • Adding some sort of cookie check post-CR3 restoration could raise the bar – Require attackers to also have arbitrary kernel reads • More driver install notifications – Hardware drivers have confirmation prompts on install – but not software drivers? • Windows Driver Samples should import their security advises on MSDN
  58. > • Device Driver Debauchery and MSR Madness – Ryan

    Warns & Tim Harrison - FireEye • Get off the kernel if you can’t drive – Jesse Michael - DEFCON 27 • Reverse Engineering and Bug Hunting On KMDF Drivers – Enrique Nissim - IOActive • Windows Drivers Attack Surface – Ilja Van Sprundel • Windows Internals 6,7, MSDN – Microsoft • Practical Malware Analysis – Michael Sikorski & Andrew Honig
  59. > • 在 Win64,PatchGuard x64 一言不合就藍屏 Process/3rdAPI (wxWidgets.lib) Windows API

    System Service Dispatcher (KiSystemService) NtCreateFile SSDT User Mode Kernel Mode ntdll.dll NtClose P.S. 如何破解PatchGuard有一整串討論跟實作喔~
  60. 因為是載入 Driver,所以所調用的 Kernel API 時 Table 所指的記憶體位置並不確定 因此,直接用 Kernel 函數名稱取址並非其運行時

    Table 所指的記憶體位置 Hook 函數時需要另外使用 MmGetSystemRoutineAddress( ) 函數確切取得運行時記憶體位置 > • In Win32 System Service Dispatcher (KiSystemService) NtCreateFile SSDT User Mode Kernel Mode ntdll.dll NewCreateFile
  61. > • 根據函數名稱找到 SSDT 位址 • cli 關閉中斷(interrupt) • 關閉處理器寫入保護

    (0fffefffh取代CR0保護) • 改寫函數指標(pointer) • 復原處理器寫入保護 • sti 開啟中斷
  62. > • Hold the shift while click reboot button. SHIFT

    One Time Solution source: Netflix
  63. > • cmd.exe (system administrator ) > bcdedit /set TESTSIGNING

    ON Enable by command Inndy大神: 也可以在 Kernel 找到確切驗證位址後關掉
  64. > • I assume you build your own dirver already,

    if you try to use sign function within VS project, that’s another issue. • You should already have .cat, .sys & .inf (with sign function in VS, you will get your own usable .cer if you set it right.)
  65. > • MakeCert -r -pe -ss TEST -n "CN=TEST.org" test.cer

    > • CertMgr /add minispy.cer /s /r localMachine root • CertMgr /add minispy.cer /s /r localMachine trustedpublisher
  66. > • SignTool sign /v /s TestCertStoreName /n TestCertName /t

    http://timestamp.verisign.com/scripts/timstamp.dll DriverFileName.sys