James 1

Transcription

1 1

2 Google Project Zero Windows 2

3 Windows Windows 3

4 Windows 4

5 Windows 5

6 Windows 6

7 7

8 8

9 Windows 400 WIN32K

10 Windows 7 SP1 Windows 8.1 Windows 10 サービス ドライバ

11 Windows 7 SP1 Windows 8.1 Windows 10 Local System 53.69% 56.89% 61.14% Local Service 32.21% 31.14% 28.50% Network Service 14.09% 11.98% 10.36%

12 Windows 7 Windows 8.1 Windows 10 自動 30.07% 26.19% 24.10% 無効 5.23% 3.57% 2.05% 手動 53.59% 43.45% 42.56% 自動 ( 遅延開始 ) 11.11% 26.79% 31.28%

13 13

14 14

15 Mozilla /** * Main entry point when running as a service. */ void WINAPI SvcMain(DWORD argc, LPWSTR *argv) { //... ExecuteServiceCommand(argc, argv); } 15

16 16

17 C# class Program { static void Main(string[] args) { if (args.length < 1) { Console.WriteLine("Usage: ServiceName args"); Environment.Exit(1); } } } ServiceController service = new ServiceController(args[0]); if (service.status == ServiceControllerStatus.Stopped) { service.start(args); } 17

18 RPC 18

19 COM Menu: Registry > Local Services 19

20

21 Windows 7 Windows 8.1 Windows 10 読取り 書込み 読み取りのみ

22 \Device\Harddisk1\SomeName NT

23 \Device\Harddisk1\SomeName NT \Device\Harddisk1 \SomeName

24 \Device\Harddisk1\SomeName NT \Device\Harddisk1 \SomeName

25

26 NTSTATUS DriverEntry(DRIVER_OBJECT *DriverObject,...) { // IoCreateDevice(DriverObject, 0, Name, FILE_DEVICE_UNKNOWN, 0, TRUE, &DeviceObject); // IoCreateDevice(DriverObject, 0, Name, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, TRUE, &DeviceObject); // IoCreateDeviceSecure(DriverObject, 0, Name, FILE_DEVICE_UNKNOWN, 0, TRUE, SecuritySddl, NULL, &DeviceObject); } 26

27 Windows Linux OS X Windows Ancillary Function (AFD) \Device\Afd \Device\Afd\Endpoint (>_<) DeviceIoControl

28 BOOL ConnectSocket(HANDLE hsocket, u_short srcport, const SOCKADDR_IN& inaddr) { // hsocket is opened file \Device\Afd\Endpoint ConnectData data = { 0 }; data.sin_family = AF_INET; data.sin_port = htons(srcport); data.inaddr = inaddr; DWORD dwsize; } return DeviceIoControl(hSocket, 0x , &data, sizeof(data), nullptr, 0, &dwsize, nullptr);

29 IP SMB DCE/RPC 29

30 IRP_MJ_DEVICE_CONTROL IRP_MJ_FILE_SYSTEM_CONTROL Classic IOCTL bugs FILE_ANY_ACCESS 0 FILE_READ_ACCESS 1 FILE_WRITE_ACCESS 2 METHOD_BUFFERED 0 METHOD_IN_DIRECT 1 METHOD_OUT_DIRECT 2 METHOD_NEITHER 3 30

31 IOCTL Online decoder: 31

32 DosDevice \??\C:\SomePath \Device\XYZ\SomePath 32

33 const int ProcessDeviceMap = 23; struct PROCESS_DEVICEMAP_INFORMATION { HANDLE DirectoryHandle; }; bool SetProcessDeviceMap(HANDLE hdir) { PROCESS_DEVICEMAP_INFORMATION DeviceMap = {hdir}; NTSTATUS status = NtSetInformationProcess( GetCurrentProcess(), ProcessDeviceMap, &DeviceMap, sizeof(devicemap)); return status == 0; } 33

34 NTSTATUS DoDeviceIoControl(DRIVER_OBJECT *Driver, PIRP Irp) { // PIO_STACK_LOCATION stack_loc =...; if (stack_loc->deviceiocontrol.iocontrolcode == IOCTL_SOMETHING) { UNICODE_STRING name = L"\\??\\C:"; UNICODE_STRING target = L"\\Device\\Target": IoCreateSymbolicLink(&name, &target); } } HANDLE hdir; UNICODE_STRING name = L"\\GLOBAL??"; NtOpenDirectoryObject(&hDir, DIRECTORY_TRAVERSE, &ObjAttr); SetProcessDeviceMap(hDir); 34

35 MS if (ProcessInformationClass == ProcessDeviceMap) { if (RtlIsSandboxedToken(NULL)) { return STATUS_ACCESS_DENIED; } return ObSetDeviceMap(ProcessHandle, DirectoryHandle); } 35

36 36

37 : C: MS DLL OBJ_IGNORE_IMPERSONATED_DEVICEMAP DLL id=240 37

38 DLL 38

39 フラグ名値解説 OBJ_CASE_INSENSITIVE OBJ_OPENLINK OBJ_KERNEL_HANDLE OBJ_FORCE_ACCESS_CHECK OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x0040 0x0100 0x0200 0x0400 0x0800 システムが大文字小文字を識別するように設定された場合に興味深い ( デフォルトは NO) Opens a link オブジェクトを開く レジストリキーのシンボリックリンクを開くことに使用 カーネルモードで設定されなかったら ハンドルを現行のプロセスに対してさらす カーネルモードで設定されなかったら リソースをセキュリティチェック無しで開く なりすまされたデバイスマップを無視する 39

40 ACL 3 1 ( ) Owner Group DACL 40

41 DeviceMap NTSTATUS SeGetTokenDeviceMap(TOKEN *token, DEVICE_MAP **device_map) { if (!token->logonsession->pdevicemap) { swprintf_s( &SourceString, L"\\Sessions\\0\\DosDevices\\%08x-%08x", token->authenticationid.highpart, token->authenticationid.lowpart); InitializeObjectAttributes(&ObjectAttributes, SourceString, OBJ_KERNEL_HANDLE,...); ZwCreateDirectoryObject(&DirectoryHandle, DIRECTORY_ALL_ACCESS, &ObjectAttributes); ObSetDirectoryDeviceMap(&token->LogonSession, DirectoryHandle); } *device_map = token->logonsession->pdevicemap; } 41

42 Owner DACL 1. (S4U )

43 Win32 Win32 API API COM1 -> \??\COM1 NUL -> \??\NUL c:\somepath\yourfile 43

44 Windows Linux OSX Linux OSX... Windows... 44

45 A B C Path Linux/OSX Windows A/B/C Valid Valid A/B/C/../../B Valid Valid A/B/D/../C Invalid Valid A/B/D /../C Invalid Valid const char* path = "c:\\my\\app.exe\" \\..\\..\\windows\\notepad.exe"; if (CheckSig(path)) { snprintf(cmdline, "\"%s\" arg", path); CreateProcess(NULL, cmdline,...); } 45

46 NTFS 46

47 47

48 Windows 48

49 Windows NULL 49

50 50

51 UAC c:\windows\ app.exe c:\windows\tracing\ app.exe 51

52 c:\windows\ app.exe c:\windows\tracing\ app.exe ALLOWED BANNED 52

53 AiCheckSecureApplicationDirectory C:\Windows C:\Windows c:\windows\ malicious.exe c:\windows\???? 53

54 NTFS c:\windows\ tracing:malicious.exe ALLOWED FILE_WRITE_DATA/FILE_ADD_FILE Windows 10 Windows

55 Windows Windows NTFS Windows Vista NTFS Windows NT

56 NTFS 56

57 C:\Windows\Temp C:\ProgramData 57

58 58

59 ( ) SysInternals Process Explorer Process Monitor WinObj WinDBG Rohitab API Monitor ( RPCView ( OleView.NET ( Sandbox Analysis Tools ( IDA Pro 59

60 60