A New CVE-2015-0057 Exploit Technology

Recommendations

Info

Timeline 2015 February June 2016 - February 10, 2015, Patch Tuesday - Microsoft corporation pushed many patches including CVE-2015-0057. On the same day, Udi Yavo, the CTO of enSilo and the discoverer of the vulnerability, released a technical blog on that topic. - June 17, 2015, A new variant of the Dyre Banking Trojan was detected by FireEye. This is the first time CVE-2015-0057 was found to be exploited in the wild.
Timeline 2015 July December 2016 - July 8, 2015, NCC Group published their technical blog, describing their 32/64-bit exploit technique in detail. - December 17, 2015, Jean-Jamil Khalife published his 64-bit exploit code on internet.
Page 1 and 2: A New CVE-2015-0057 Exploit Technol
Page 3 and 4: Introduction - About me (yu.wang@fi
Page 5: Part Two Background of the Vulnerab
Page 9 and 10: The Old-school Kernel Attack Surfac
Page 11 and 12: Which Object Can Be Used? 1 typedef
Page 13 and 14: tagPROP and InternalSetProp Pseudoc
Page 15 and 16: Two Obstacles 1. The write ability
Page 17 and 18: NCC Group's 32-bit Exploit Method 1
Page 19 and 20: NCC Group's 64-bit Exploit Method 1
Page 21 and 22: Part Four A New CVE-2015-0057 Explo
Page 23 and 24: Obstacles Solutions 1. The full con
Page 25 and 26: Misaligned tagPROPLIST +-> | | | |
Page 27 and 28: Obstacles Solutions 1. Using the Zo
Page 29 and 30: DEMO - A New CVE-2015-0057 Exploit
Page 31 and 32: Other Problems - Heap Data Repair -
Page 33 and 34: Dead Code? 1 /* 2 * update the disp
Page 35 and 36: MS15-010
Page 37 and 38: User32!gSharedInfo
Page 39 and 40: Think Deeply - Win32K subsystem's l
Page 41: Q&A yu.wang@fireeye.com

A New CVE-2015-0057 Exploit Technology

Create successful ePaper yourself

Delete template?

Save as template?