Malicious File for Exploiting Forensic Software

Aug 2013, Black Hat USA 2013
https://www.blackhat.com/us-13/archives.html#Haruyama
https://www.youtube.com/watch?v=WTxHfraFLS0

Commercial forensic software such as EnCase, FTK and X-Ways Forensics adopts the same library component for viewing file content. If the library component is exploitable, lots of forensic investigators are exposed to risks like malware infection and freeze of the software by checking crafted malicious files.

This presentation introduces anti-forensic techniques exploiting vulnerabilities of the component embedded in forensic software. Specifically, I show one malicious file can trigger arbitrary code execution on multiple forensic software products. The exploitation has great impact on forensic investigation because most forensic software includes it.

The presentation is made up as follows. First, I explain the file viewer component in forensic software and how to fuzz it with a custom script of forensic software, MiniFuzz and a kernel driver for anti-debugging. Next, I describe two vulnerabilities (heap overflow and infinite loop DoS) detected by the fuzzer then demonstrate arbitrary code execution and hang-up of forensic software process using malicious files. I also fill in the gaps on some tricks for exploiting heap overflow (e.g., overwriting function pointers, finding the condition of heap spraying with bitmap images). Finally, I refer to countermeasures.

Transcript

1. / / / / / / ./ / ./ / / / /
2. • /KMBJNF@ J BN FD KM HR MB J HTN J BMJB JF F F B 2 L J • MBNBJ FKJN – 9 9 -/ 9PIIF H @ E . 9 ,KJCBMBJ@B 2 L J B @ • 0 JAN KJN – ,. , / 9: :, TK K FN?KJ B @ • :KKHN – .J, NB .J9@MFL - T EKJ N@MFL B @ – E L @@F @K@KHKD JFC T @KI ?HKD • .J, NB ,BM FCFBA .S IFJBM NFJ@B & • RF BM @@F CKMBJNF@N EK I
3. • - • - • - - • •
4. 
     
5. • CE BF FC G E B F B G CB I B CBG BG – .CFG CAA E GCC F C G G F A E E • B F 1- F G • /E / GF ,B 1 BC C 5 – B M KGE G CBI EG CI E E BG G F G – FC F BG E E F FC G E • . ECFC G K B F C 0 E G BG , . /AB B BG E E F G CB . EC 0 0 A BG BG E E F G E B CE BF 0C G E
6. • / / , - / ./ / / / /. / • / , / / - / / / /. 2/ / -/ - /. - / – -/ 2 – 2/ / - /-2 / • / . / 2 . / ./ -/ ./ / – / /- 2 / / • / / - / / J • / / -2/. , 2/ / ,
8. • 3 – – – &
9. • 4 3 34 – 4 • 4 - 4C – 4 4 4 4 4 4 3 4 • 4 – 4 4D 4D 43 4 3 4 • 4 – G 4 4 4 3 4 4 • 4 3 E FF4
11. - -
12. • 6 E CF – 4 E D F AD AD ADAI EEF E5 D :A AI – - :AI E IAED AD F E E D :A AI • 6 I 3 I A D AED I I, – ( ED 0D. ) • 6E I I I I CE I 0D. F ) IE J – ED 8 7 1E D A • 8 7 ECC D AD I E E : A IE CAD IAED – ED 0D. -DIA E D A : F EAIAD :
13. • 4JAHP C J C DPJA J L N JE 3 JEPH 8 ACNN D I APICJ – I H A PN D HC A J A PNC JD J C H L J N RL HH • 5 7 - ( 0 2# (#(,, – DDCA C C N J. - ) J C H C – CN H C J 5PHS ( , 8 ACNN 3 JE#PL PN JE 4JD J C 6 L 1 : PHJC H S
14. •
15. • 3 E C CH I J C A 3 C JH HJ H – EC CH CE HN JOJC I • 48 )- - 9,: 081# (#( , 9-: – N J CH . , ( JEC J – 7 HEN H 4 E ( 9 : J C J J 0H 1 CH C A 2 I 6N J EHO 8 E J CEC
16. • B0 0B - ) 0 B 0 B 0B B B B 0 F B0B 0 . – ( 0 B 0 1 0 1 B ( 0 B0B 0 ( – 0 B B0 0B0 0 H0B – 0 H 0 10 0 – B • ) B B B B 0 – B B B 0 B B 0 B B0 B ) B B B
17. • . ? .E ? . .E . E 0 A – ( . ? A? A A ? 0 ? . . 0 . . ?? 0 0 0 0 • 0 A ? E . . 0 ( • – ). .?0 ?0 ? ? – ). .?0 0 ,0 . – ? 0 ? . . , .E
18. • F - 1 C 1 B 1 B 1 C E • 1 D B F C – • H 1 C D • 1 B H – F 1 • B 1 1 F D
20. • . • 5 3. - .
21. • /C FF6E FH – -H C C EF 6 6 F CE F CH H C E E 6E 6 • F F H F C – HEE FH FF EC 6 • , 6F – • 5 46 F – % – 3C EC EC 6 C 6 H 6 6 H 6 CH CE 6HF C E C L 2H FF 1EC 6 C . 6 0 E C , C 6 C
22. 
       
23. • E H H E – A E D N IE DI E E – D O, D 3 C D I D)E I EDO • 4H , 2 I D E C I ED (0 • E I ED I I I E HH I C D I H CC I N – 23(3427, (07) 11403 0 DI ED E ( I N )E I ED H D , E
24. • > > > > E – • > • F , DG – - E • > , D 6 • F > G > > E C
25. • A D M I – ( I D I E O E L M I E L I • . L / - ) 7 6 A • . DD D M I – 6 DD / - 7 6 A L 3L 0 • - LI I L M D I 6 I I O D • - LI I O D E 8 – / /4 , 1 C I - EE - L IE LI
26. 
    
27. • , ,. . , – . , • ) , - , . – , , , . , • . , , . – , . , , , ( , – . , , ,
28. (8 : ) ! 2 8 28 8
29. F ? I TM ? [ LM :V CM PV T O 0P[[ / # I TM# U [M PV T O M MUJMLLML (#P[U2 F ? I TM ? [ LM :V V[I V U T[ TM M_ T [IJTM ] TVM IJ T [ M 0P[[ / #SJ# M [# O ] T L -. (2 F( 6< = V 8 aa 8 TM 8 aaM 0P[[ / #U N[# U MV L VT IL LM[I T #I _3 L1 .2 F) 5 UUIVL < VM 6<<#a 0P[[ / # N[N MV # U L VT IL #P[UT2 F E> - ( ? I TM ? [ LM :V ] TVM IJTM [ LMV IT N M ] M 6 0P[[ / R]V#R MV R E> - ( VLM_#P[UT2 F 5E7 ( ( 0P[[ / ]M#U [ M# O O J V ]MVIUM# O 3VIUM15E7 ( ( 2 F ? I TM 5 [ IT I[ P D LI[M 4L] T ( 0P[[ / # I TM# U [M PVM[ S [ M [ R T ( -..- #P[UT2 F- E> ). . ? I TM ? [ LM :V ] TVM IJTM [ J NNM ]M NT 0P[[ / R]V#R MV R E> ). . VLM_#P[UT2 F. 5E7 ( ( - 0P[[ / ]M#U [ M# O O J V ]MVIUM# O 3VIUM15E7 ( ( - 2 F M]MV[ VO [PM M_ T [I[ V N M U LM PMI [ V ] TVM IJ T [ M 0P[[ / JT O #[M PVM[# U J L I P ]M . - ) M]MV[ VO [PM M_ T [I[ V N M U LM PMI [ V ] TVM IJ T [ M #I _2 F 7_ T [ [ VO [ [ IT I [ / 9MI I VO 6MU [ N ML 0P[[ / # MTIV#JM VLM_# P ( M_ T [ [ VO [ [ IT I [ PMI I VO LMU [ N ML 2 F 9MI M[:VN UI[ V N V [ V 0P[[ / U LV#U N[# U MV T J I VL LM S[ II( ]1] #- #I _2 F ( 8 MV N[ I M IVL ? I TM ? [ LM :V 0P[[ / # M [# O JT O M [ ( N MV H N[ I MHIVLH I TM#P[UT2 . AMNM MV M