ATTACKING WINDOWS BY WINDOWS

Recommendations

Info

Basic object: Window typedef struct tagWNDCLASSW { UINT style; WNDPROC lpfnWndProc; int cbClsExtra; int cbWndExtra; HINSTANCE hInstance; HICON hIcon; HCURSOR hCursor; HBRUSH hbrBackground; LPCWSTR lpszMenuName; LPCWSTR lpszClassName; } WNDCLASSW, *PWNDCLASSW; HWND WINAPI CreateWindowExW( __in DWORD dwExStyle, __in_opt LPCWSTR lpClassName, __in_opt LPCWSTR lpWindowName, __in DWORD dwStyle, __in int X, __in int Y, __in int nWidth, __in int nHeight, __in_opt HWND hWndParent, __in_opt HMENU hMenu, __in_opt HINSTANCE hInstance, __in_opt LPVOID lpParam); tagWND +0x000 head +0x058 spwndParent +0x090 lpfnWndProc +0x0d8 strName +0x0e8 cbwndExtra …………………………………… Window Extra Data
Window Extra Data • Two APIs: LONG WINAPI SetWindowLongW( HWND hWnd, int nIndex, LONG dwNewLong); LONG WINAPI GetWindowLongW( HWND hWnd, int nIndex); tagWND +0x000 head +0x058 spwndParent sizeof(tagWND) +0x090 lpfnWndProc +0x0d8 strName cbwndExtra +0x0e8 cbwndExtra …………………………………… Window Extra Data nIndex
Page 1 and 2: ATTACKING WINDOWS BY WINDOWS Yin Li
Page 3 and 4: About us Team member: • xin, godz
Page 5 and 6: • 46 acknowledgments!
Page 7 and 8: Old days.. Q1: Where to write? •
Page 9 and 10: Where to write?
Page 11: What to write?
Page 15 and 16: If we change a bit… • Bin: 1000
Page 17 and 18: Read from anywhere • Two APIs: LO
Page 19 and 20: Steal SYSTEM Token My Window (tagWN
Page 21 and 22: Pwn2Own 2016 Flash
Page 23 and 24: How to exploit 0 → 1 Q1: Where to
Page 25 and 26: The Function - CVE-2016-3355 DWORD
Page 27 and 28: My Exploit 1Create memory font 2Cre
Page 29 and 30: The Refcount! • Win32k object: 1:
Page 31 and 32: Make a Use-After-Free • API: BOOL
Page 33 and 34: Fake tagMENU Window Text (Fake tagM
Page 35 and 36: Let`s rule them all!
Page 37 and 38: Summary All Windows OS Trigger one

ATTACKING WINDOWS BY WINDOWS

Create successful ePaper yourself

Delete template?

Save as template?