DEP/ASLR bypass without ROP/JIT - Yu Yang - CanSecWest

More documents

Recommendations

Info

“GIFT” (Got It From a Table) • Easy to use, like taking candy from a table Naming time • Wow64SharedInformation function point table • Use faked virtual table pointer • Really like a GIFT from an unknown coder ☺
Good news and bad news ☺ Totally <strong>ASLR</strong>/<strong>DEP</strong> free ☺ Language/SP independent ☺ Work on almost all use-after-free/vtable-overflow ☺ Target on IE, firefox, pdf reader, flash, office … ☺ Even don’t need shellcode ☺ Sometimes don’t need heapspray Need a Windows file sharing server ☺ It is not a real problem Only work on 32-bit process in x64 Windows ☺ This situation is very common Can not work on Windows 8
Page 1 and 2: DEP/ASLR bypass without ROP/JIT Yan
Page 3 and 4: Who am I Researcher @NSFOCUS Securi
Page 5 and 6: SharedUserData 0:000> d SharedUserD
Page 7 and 8: On x86 Windows: SharedUserData->Sys
Page 9 and 10: Example: MS08-078 ]]> eax
Page 11 and 12: eax=0c0c11db Example: MS08-078 msht
Page 13 and 14: Good news and bad news ☺ Totally
Page 15 and 16: SharedUserData->Wow64SharedInformat
Page 17 and 18: LdrHotPatchRoutine struct HotPatchB
Page 19 and 20: function funcB() { document.execCom
Page 21 and 22: Example: MS12-063 eax=00000000 ebx=
Page 23 and 24: Example: MS13-008 function CVE-2012
Page 25 and 26: Example: MS13-008 eax=41414141 ebx=
Page 27: Example: MS13-008 MS13-008 Demo
Page 31 and 32: Defense Why it can bypass EMET 3.5
Page 33 and 34: Off topic How to defend against unk
Page 35: Q & A

DEP/ASLR bypass without ROP/JIT - Yu Yang - CanSecWest

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?