1. PCIT417

2. CVE-2014-1776 (UAF) CVE-2014-0322 (UAF) CVE-2013-3918 (ICARDIE) CVE-2013-3897 (UAF) CVE-2013-3893 (UAF) CVE-2013-3163 (UAF) IE CVE-2014-1761 (RTF) CVE-2013-3906 (OGL) CVE-2013-1331 (PNG) CVE-2012-0158 (MSCOMCTL) Office CVE-2014-0497 (Flash) CVE-2013-5330 (Flash) CVE-2013-5065 (PDF+EoP) CVE-2013-0640 (PDF XFA) Adobe

6. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

8. app.exe user32.dll ssleay32.dll ntdll.dll app.exe user32.dll ssleay32.dll ntdll.dll app.exe user32.dll ssleay32.dll ntdll.dll Boot 1 Boot 2 Boot 3 process address space

9. Exploit: Partial overwrite Only the high-order two bytes are randomized in image mappings Low-order two bytes can be overwritten to return into another location within a mapping Overwriting 0x1446047c with 0x14461846 Target address can be used to pivot Local Variables Saved EBP Return addres s Buffer overflow memcpy( dest,  Stack buf src,  Controlled length);  Controlled

10. app.exe user32.dll kernel32.dll ntdll.dll app.exe user32.dll kernel32.dll ntdll.dll app.exe user32.dll kernel32.dll ntdll.dll Boot 1 Boot 2Boot 3 process address space

12. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

14. void foo(char *szIn, int i) { int j = 0; char szOut[8]; strcpy(szOut, szIn); } Pushed Arguments EIP = Return of main() EBP - Frame Pointer Higher Addresses Function main () stack area j szIn i szOut

15. Pushed Arguments EIP = Return of main() EBP - Frame Pointer Higher Addresses Function main () stack area j = 0x0 szIn i C:\foo “AAAAAAAAAAAAAAAA\x6C\x11\xB0\x30” szOut= 0x05040504

16. Pushed Arguments Return address = 0x30B0116C EBP = 0x65656565 Higher Addresses Function main () stack area j = 0x65656565 szOut= AAAAAAAA szIn i C:\foo “AAAAAAAAAAAAAAAA\x06C\x11\xB0\x30” Return address of main() changed to point to a malicious code area

17. Pushed Arguments Return address = 0x30B0116C EBP = 0x65656565 Higher Addresses Function main () stack area Malicious Code szIn i C:\foo “AAAAAAAAAAAAAAAA\x06C\x11\xB0\x30” !!pwn3d!!

18. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

19. Local variables Previous Stack frame … Exception Registration Record NextHandler Buffer overflow void vulnerable(char *ptr){ char buf[128]; strcpy(buf, ptr); } void parent(char *ptr) { try { vulnerable(ptr); … exception … } except(…) { } }

20. Exploit: SEH Overwrite NH NH NH app!_except_handler4 k32!_except_handler4 ntdll!_except_handler4 0xfffffff f Normal SEH Chain NH 0x7c1408ac 0x414106e b Corrupt SEH Chain An exception will cause 0x7c1408ac to be called as an exception handler as: EXCEPTION_DISPOSITION Handler( PEXCEPTION_RECORD Exception, PVOID EstablisherFrame, PCONTEXT ContextRecord, PVOID DispatcherContext); pop eax ret

21. NH NH app!_except_handler4 k32!_except_handler4 NH ntdll!FinalExceptionHand ler NH app!_main+0x1c 0x4141414 1 Can’t reach validation frame! Valid SEH ChainInvalid SEH Chain ?

22. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

25. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

27. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

28. EAF DR0  kernel32[eat] DR1  ntdll[eat] DR2  kernelbase[eat]

29. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

31. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

33. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

35. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

37. OS and per process memory mitigations Per process only memory mitigations Non-memory mitigation New TP mitigation

38. FLASH Vector JSCRIPT9 Array VGX CDashStyle KERNEL32 MZ/PE IAT/EAT NTDLL MZ/PE IAT/EAT

40. Subscribe to our fortnightly newsletter http://aka.ms/technetnz http://aka.ms/msdnnz Free Virtual Hands-on Labs http://aka.ms/ch9nz Free Online Learning http://aka.ms/mva http://aka.ms/technetlabs Sessions on Demand