Talk - Writing My First Exploit

Transcript

1. Writing My First Exploit
2. Exploit? “...is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended or unanticipated behavior...” Wikipedia
3. What? Counter-Strike: Global Offensive • Source code leak from 2013 for reference. ◦ github.com/ValveSoftware/source-... • Lots of existing exploit examples. ◦ github.com/search?q=dwLocalPlaye...
4. “Steel-thread” Implementation • “Out of Box” win32 APIs to exploit the client side process. ◦ read/write with kernel32.dll ◦ input with with user32.dll • “Benign” exploit impact. ◦ client side jump abuse aka “bunny hop”
5. Video
6. How
7. How?
8. How func RunHop(client *Client) { for { if gomem.IsKeyDown(VK_SPACE) { flags, _ := client.Process.ReadByte(...) if (flags & CSGO_FL_ONGROUND) > 0 { client.Process.WriteByte(...) } } time.Sleep(100 * time.Nanosecond) } }
9. Binary Compatibility Address E.g. 0x59bc2690 Memory E.g. 00001000 ReadByte
10. Binary Compatibility 1.0 1.0 1.1 1.2 1.1 1.2 csgo.exe gohack.exe Broken Broken
11. Binary Compatibility 1.0 1.X w/ auto update 1.1 1.2 csgo.exe gohack.exe
12. How func Instrument() (*gohack.Client, error) { ... offsets, err := gohack.GetOffsets() ... process, err := gomem.GetOpenProcessFromName("csgo.exe") ... client, err := gohack.GetClientFrom(process, offsets) ... return client, err }
13. Testing
14. Testing Value’s CS:GO • 30GB Package • Steam DRM + VAC Anti-cheat • GUI + Internet • A popular game My CS:GO • 42KB Binary • 14 LOC • Headless + Offline • Loads a DLL and hangs
15. Testing func TestStubProcess(t *testing.T) { withProcess("test\\dll\\csgo.exe", func() { _, err := Instrument() got := err.Error() want := "Failed to get player offset" if got != want { t.Errorf("%q; want %q", got, want) } }) }
16. Testing
17. github.com/jamesmoriarty/gohack
18. ???
20. Testing func TestProcessReadUInt32(t *testing.T) { ... valuePtr := (uintptr)(unsafe.Pointer(&value)) ... process, err := GetOpenProcessFromName(name) ... assertValue, err := process.ReadUInt32(valuePtr) ... }
21. github.com/jamesmoriarty/gomem
22. jamesmoriarty.xyz/software/
23. Video