$hell on Earth

The winning submissions to Pwn2Own 2016 provided unprecedented insight into the
state-of-the-art techniques in software exploitation. Every successful submission
provided remote code execution as the super user (SYSTEM/root) via the browser or
a default browser plug-in. In most cases, these privileges were attained through the
exploitation of the Microsoft Windows® or Apple OS X® kernel. Kernel exploitation,
using the browser as an initial vector, was a rare sight in previous contests.
This white paper will detail the eight winning browser-to-super-user exploitation chains
demonstrated at this year’s contest. Topics such as modern browser exploitation,
the complexity of kernel use-after-free vulnerability exploitation, the simplicity of
exploiting logic errors, and directory traversals in the kernel are also covered. This
paper analyzes all attack vectors, root causes, exploitation techniques, and remediation
for vulnerabilities.
Reducing attack surfaces with application sandboxing is a step in the right direction.
However, the attack surface remains expansive and sandboxes only serve as minor
obstacles on the way to complete compromise. Kernel exploitation is clearly a problem,
which has not disappeared and is possibly on the rise. If you’re like us, you can’t get
enough of it—it’s shell on earth.