A Guide to Kernel Exploitation : Attacking the Core

A Guide to Kernel Exploitation: Attacking the Core discusses the theoretical techniques and approaches needed to develop reliable and effective kernel-level exploits, and applies them to different operating systems, namely, UNIX derivatives, Mac OS X, and Windows. Concepts and tactics are presented categorically so that even when a specifically detailed vulnerability has been patched, the foundational information provided will help hackers in writing a newer, better attack; or help pen testers, auditors, and the like develop a more concrete design and defensive structure. The book is organized into four parts. Part I introduces the kernel and sets out the theoretical basis on which to build the rest of the book. Part II focuses on different operating systems and describes exploits for them that target various bug classes. Part III on remote kernel exploitation analyzes the effects of the remote scenario and presents new techniques to target remote issues. It includes a step-by-step analysis of the development of a reliable, one-shot, remote exploit for a real vulnerabilitya bug affecting the SCTP subsystem found in the Linux kernel. Finally, Part IV wraps up the analysis on kernel exploitation and looks at what the future may hold. A Guide to Kernel Exploitation 4 Copyright 5 Table of Contents 6 Foreword 12 Preface 14 Book Overview 14 How This Book Is Organized 14 Conclusion 16 Acknowledgments 18 About the Authors 20 About the Technical Editor 22 Part I. Journey to Kernel Land 24 Chapter 1. From User-Land to Kernel-Land Attacks 26 Introduction 26 Introducing the Kernel and the World of Kernel Exploitation 26 Why Doesn鈥檛 My User-Land Exploit Work Anymore? 32 An Exploit Writer鈥檚 View of the Kernel 36 Open Source versus Closed Source Operating Systems 41 Summary 41 Related Reading 42 Endnote 42 Chapter 2. A Taxonomy of Kernel Vulnerabilities 44 Introduction 44 Uninitialized/Nonvalidated/Corrupted Pointer Dereference 45 Memory Corruption Vulnerabilities 49 Integer Issues 52 Race Conditions 56 Logic Bugs (a.k.a. the Bug Grab Bag) 62 Summary 67 Endnotes 67 Chapter 3. Stairway to Successful Kernel Exploitation 70 Introduction 70 A Look at the Architecture Level 71 The Execution Step 81 The Triggering Step 94 The Information-Gathering Step 113 Summary 121 Related Reading 122 Part II. The UNIX Family, Mac OS X, and Windows 124 Chapter 4. The UNIX Family 126 Introduction 126 The Members of the UNIX Family 127 The Execution Step 149 Practical UNIX Exploitation 161 Summary 216 Endnotes 217 Chapter 5. Mac OS X 218 Introduction 218 An Overview of XNU 219 Kernel Debugging 223 Kernel Extensions (Kext) 231 The Execution Step 250 Exploitation Notes 251 Summary 289 Endnotes 290 Chapter 6. Windows 292 Introduction 292 Windows Kernel Overview 294 The Execution Step 308 Practical Windows Exploitation 331 Summary 362 Endnotes 363 Part III. Remote Kernel Exploitation 364 Chapter 7. Facing the Challenges of Remote Kernel Exploitation 366 Introduction 366 Attacking Remote Vulnerabilities 367 Executing the First Instruction 371 Remote Payloads 385 Summary 406 Endnote 407 Chapter 8. Putting It All Together: A Linux Case Study 408 Introduction 408 SCTP FWD Chunk Heap Memory Corruption 409 Remote Exploitation: An Overall Analysis 416 Getting the Arbitrary Memory Overwrite Primitive 417 Installing the Shellcode 426 Executing the Shellcode 433 Summary 437 Related Reading 438 Endnote 438 Part IV. Final Words 440 Chapter 9. Kernel Evolution: Future Forms of Attack and Defense 442 Introduction 442 Kernel Attacks 443 Kernel Defense 448 Beyond Kernel Bugs: Virtualization 455 Summary 457 Index 460 1616928654,9781616928650 IGI Global (September 30, 2010) "A very interesting book that not only exposes readers to kernel exploitation techniques, but also deeply motivates the study of operating systems internals, moving such study far beyond simple curiosity."--Golden G. Richard III, Ph. D., Professor of Computer Science, University of New Orleans and CTO, Digital Forensics Solutions, LLC The number of security countermeasures against user-land exploitation is on the rise. Because of this, kernel exploitation is becoming much more popular among exploit writers and attackers. Playing with the heart of the operating system can be a dangerous game : This book covers the theoretical techniques and approaches needed to develop reliable and effective kernel level exploits and applies them to different operating systems (UNIX derivatives, Mac OS X, and Windows). Kernel exploits require both art and science to achieve. Every OS has its quirks and so every exploit must be molded to fully exploit its target. This book discusses the most popular OS families-UNIX derivatives, Mac OS X, and Windows-and how to gain complete control over them. Concepts and tactices are presented categorically so that even when a specifically detailed exploit has been patched, the foundational information that you have read will help you to write a newer, better attack or a more concrete design and defensive structure. Covers a range of operating system families - UNIX derivatives, Mac OS X, Windows Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks Covers a range of operating system families - UNIX derivatives, Mac OS X, Windows Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks A Guide to Kernel Exploitation: Attacking the Core discusses the theoretical techniques and approaches needed to develop reliable and effective kernel-level exploits, and applies them to different operating systems, namely, UNIX derivatives, Mac OS X, and Windows. Concepts and tactics are presented categorically so that even when a specifically detailed vulnerability has been patched, the foundational information provided will help hackers in writing a newer, better attack; or help pen testers, auditors, and the like develop a more concrete design and defensive structure.The book is organized into four parts. Part I introduces the kernel and sets out the theoretical basis on which to build the rest of the book. Part II focuses on different operating systems and describes exploits for them that target various bug classes. Part III on remote kernel exploitation analyzes the effects of the remote scenario and presents new techniques to target remote issues. It includes a step-by-step analysis of the development of a reliable, one-shot, remote exploit for a real vulnerabilitya bug affecting the SCTP subsystem found in the Linux kernel. Finally, Part IV wraps up the analysis on kernel exploitation and looks at what the future may hold. Covers a range of operating system families — UNIX derivatives, Mac OS X, Windows Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks

The number of security countermeasures against user-land exploitation is on the rise. Because of this, kernel exploitation is becoming much more popular among exploit writers and attackers. Playing with the heart of the operating system can be a dangerous game: This book covers the theoretical techniques and approaches needed to develop reliable and effective kernel-level exploits and applies them to different operating systems (Linux, Solaris, Mac OS X, and Windows). Kernel exploits require both art and science to achieve. Every OS has its quirks and so every exploit must be molded to fully exploit its target. This book discusses the most popular OS families—UNIX derivatives, Mac OS X, and Windows—and how to gain complete control over them. Concepts and tactics are presented categorically so that even when a specifically detailed exploit has been patched, the foundational information that you have read will help you to write a newer, better attack or a more concrete design and defensive structure.

• Covers a range of operating system families — UNIX derivatives, Mac OS X, Windows
• Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions
• Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks

"The number of security countermeasures against user-land exploitation is on the rise. Because of this, kernel exploitation is becoming much more popular among exploit writers and attackers. Playing with the heart of the operating system can be a dangerous game : this book covers the theoretical techniques and approaches needed to develop reliable and effective kernel level exploits and applies them to different operating systems (UNIX derivatives, Mac OS X, and Windows). Kernel exploits require both art and science to achieve. Every SO has to quirks and so every exploit must be molded to fully exploit this target. This book discusses the most popular OS families - UNIX derivatives, Mac OS X, and Windows - and how to gain complete control over them. Concepts and tactics are presented categorically so that even when a specifically detailed exploit has been patched, the foundational information that you have read will help you to write a newer, better attack or a more concrete design and defensive structure." (source : 4ème de couverture) The modern world is fraught with risk, from natural disasters and terrorist attacks, to financial crises and pandemics. Assessing and planning for these risks can be done with a conventional human-based approach but this often requires large amounts of time and resources. Surveillance Technologies and Early Warning Data Mining Applications for Risk Detection has never been more important, as the research this book presents an alternative to conventional surveillance and risk assessment. This book is a multidisciplinary excursion comprised of data mining, early warning systems, information technologies and risk management and explores the intersection of these components in problematic domains. It offers the ability to apply the most modern techniques to age old problems allowing for increased effectiveness in the response to future, eminent, and present risk. 'This book presents an alternative to conventional surveillance and risk assessment offering a multidisciplinary excursion comprised of data mining, early warning systems, information technologies and risk management and explores the intersection of these components in problematic domains'--Provided by publisher.