Becks.io#5 Get start to Old Driver in Windows Kernel

Slide 1

Slide 1 text

NotSurprised @ Becks.io [email protected]

Slide 2

Slide 2 text

https://speakerdeck.com/notsurprised /becks-dot-io-number-5-get-start-to-old-driver-in-windows-kernel

Slide 3

Slide 3 text

Intro • UCCU Hacker • AIS3 2016 trainee • SITCON 2019 speaker • MOPCON 2019 speaker • ITRI Engineer (serve my country) • 5-years Bachelor & Master of NSYSU Email : [email protected] > NotSurprised

Slide 4

Slide 4 text

> • Windows Driver Background • Driver Compiling & Dev. & Dbg • Vul-Driver & PoE

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

> • Some malwares use device drivers to escalate privileges – VirtualBox CVE-2014-2477 • Device Drivers already present in some Red Team toolkits – Mimikatz uses a driver (mimidrv.sys) to facilitate injection

Slide 7

Slide 7 text

> • Windows Driver Model (WDM) • Windows OS driver catalogues : – bus driver (e.g. USB, PCI) – function driver (e.g. USB Adaptor) – filter driver (e.g. Anti-Virus)

Slide 8

Slide 8 text

> & • After Windows 7, Filter compiling was migrate into VS, and refracture WDF, Minifilter from WDM • Minifilter is more easier to compile that traditional Filter, dynamic install/attach/unload also the new feature for minifilter

Slide 9

Slide 9 text

> • VXD (Virtual X Driver) – Windows 95、Windows 98 • KDM (Kernel Driver Model) – Windows NT • WDM (Windows Driver Model) – Windows 2000 ~ Windows 8.1 – DDK (Driver Developer Kit) • WDF (Windows Driver Frameworks) – Windows 7 ~ Windows 10 – WDK (Windows Driver Kit)

Slide 10

Slide 10 text

> • WDM • KMDF • WDDM • NDIS (miniport, filter, protocol) • WFP • Native 802.11 • WDI • FileSystem (MiniFilter) • PortCls • KS

Slide 11

Slide 11 text

> Windows ~= Microkernel + LibOS ~= Monolithic Like source: Wikipedia

Slide 12

Slide 12 text

> Applicaton Windows Servicce UserMode PnP Manager Setupapi.dll WMI Service WDM WMI Routine PnP Manager Power Manager I/O Manager function filter HAL ．．．．．． .inf .cat registry I/O system Driver Kernel Mode User Mode

Slide 13

Slide 13 text

> • Example, CreateFileA(); ProcessXXX.exe.CreateFileA() Kernel32.dll.CreateFileA() KERNELBASE.dll.CreateFileA() KERNELBASE.dll.CreateFileW() KERNELBASE.dll.CreateFileInternal() Ntdll.dll.NtCreateFile() Ntoskrnl.exe.KiFastSystemCall.NtCreateFile() Ntoskrnl.exe.KiSystemService.NtCreateFile() DriverXXX.sys.PreOperationCallback()

Slide 14

Slide 14 text

> • In Windows OS kernel-mode is stack-like architecture, this kind Layered driver Architecture also been called Driver Stack. source : MSDN source: MSDN

Slide 15

Slide 15 text

> Envuroment Subsystem/ Dlls I/O System Kernel Mode User Mode I/O Manager IRP header IRP stack location File Object Device Object Driver Object Start I/O Routine ISR DPC Routine Driver Entry & Dispatch Routine Unload Routine Create Read Write …

Slide 16

Slide 16 text

> Envuroment Subsystem/ Dlls I/O System Kernel Mode User Mode I/O Manager IRP File System Manager Volumn Manager IRP source: The Windows 2000 Device Driver Book

Slide 17

Slide 17 text

> Envuroment Subsystem/ Dlls I/O System Kernel Mode User Mode I/O Manager KMDF Manager I/O target KMDF DriverA KMDF DriverB KMDF DriverC KMDF0 / wdf01000.sys

Slide 18

Slide 18 text

> Kernel Mode User Mode Reflector(Filter) Kernel Mode Driver Kernel Mode Driver Windows Kernel Driver Manager Applications Win32 API UMDF Driver UMDF Framework UMDF Runtime Reflector(Filter) Kernel Mode Driver UMDF Driver UMDF Framework UMDF Runtime UMDF Host Process UMDF Host Process Local Device Stack Local Device Stack WUDFx02000.dll UMDFCtrlDev

Slide 19

Slide 19 text

> IRP FiDO FiDO FiDO FDO FiDO FiDO PDO Upper Filter Driver C Upper Filter Driver B Upper Filter Driver A Lower Filter Driver B Lower Filter Driver A Function Driver Bus Driver source: Windows Internals

Slide 20

Slide 20 text

> • IRP(I/O Request Packets) work flow in Windows OS： source : MSDN Calculate drivers number and allocate IRP, then dispatcher to • WDF • function driver

Slide 21

Slide 21 text

> Enviroment Subsystem/ Dlls I/O System Kernel Mode User Mode I/O Manager Filter Manager File System Manager File System Manager IRP IRP IRP MiniFilterDriverA MiniFilterDriverB MiniFilterDriverC 1. 2. 3. 4. 5. 6. 7.

Slide 22

Slide 22 text

> • Extension Register • Kernel Dispatcher • CommunicationUK • Degree (Altitude) • Events • Handlers

Slide 23

Slide 23 text

> Envuroment Subsystem/ Dlls I/O System Kernel Mode User Mode I/O Manager Filter Manager File System Manager File System Manager IRP IRP IRP MiniFilterDriverA MiniFilterDriverB MiniFilterDriverC 7. 6. 5. 4. 3. 2. 1.

Slide 24

Slide 24 text

> • IRP (I/O Request Package) is a data structure in Windows kernel, it has been designed to store input/output data • IRP is a complicate data structurer, there’s 2 major attributes: MajorFunction & MinorFunction, which stand for IRP’s major type and type’s detail description • Same MajorFunction will present different behaviors with different MinorFunctions

Slide 25

Slide 25 text

Slide 26

Slide 26 text

> • IRP_MJ_DIRECTORY_CONTROL • IRP_MJ_READ • IRP_MJ_WRITE • IRP_MJ_QUERY_INFORMATION • IRP_MJ_SET_INFORMATION • IRP_MJ_CREATE • IRP_MJ_CLEANUP • IRP_MJ_CLOSE • IRP_MJ_DEVICE_CONTROL • IRP_MJ_LOCK_CONTROL • IRP_MJ_SET_VOLUME_INFORMATION • IRP_MJ_QUERY_SECURITY • IRP_MJ_SET_EA • ……. FILE_CREATED FILE_DOES_NOT_EXIST FILE_EXISTS FILE_OPENED FILE_OVERWRITTEN (overwrite) FILE_SUPERSEDED (replace) FILE_ALLOCATION_INFORMATION FILE_BASIC_INFORMATION (insert、time、privilege) FILE_DISPOSITION_INFORMATION (delete) FILE_END_OF_FILE_INFORMATION FILE_LINK_INFORMATION FILE_POSITION_INFORMATION FILE_RENAME_INFORMATION (rename) FILE_VALID_DATA_LENGTH_INFORMATION

Slide 27

Slide 27 text

> Oringinal IRP Filter Framework IRP source: MSDN source: MSDN

Slide 28

Slide 28 text

> Write Buffer Prevent ransomware, we can use these information to compare entropy & sdhash

Slide 29

Slide 29 text

> Use these information to determine file should be backup or not (size, position, format) source: MSDN

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

• After Microsoft publish minifilter framework, there also come up with WDM to WDF, Windows 7 to Windows 10. Microsoft migrate those develop framework into Visual Studio. Notice that there still lots version conflict problems • WDK installer can be downloaded from official website, SDK should be select to install during Visual Studio installing progress • Visual Studio 2017 & 2019 default not install SDK, need to select the checkbox • ARM/ARM64 > 、、

Slide 32

Slide 32 text

> SDK should fit WDK, but VS, SDK first

Slide 33

Slide 33 text

Slide 34

Slide 34 text

> 、、

Slide 35

Slide 35 text

> 、、 • Dev. Env. Consistency

Slide 36

Slide 36 text

> • Change target platform from [build setting] to [project -> driver settings]

Slide 37

Slide 37 text

> • Change target platform from [build setting] to [project -> driver settings]

Slide 38

Slide 38 text

> https://code.msdn.microsoft.com/windowsapps/Windows-Driver-Kit-WDK-81-cf35e953#content

Slide 39

Slide 39 text

> There’s no printf() in kernel >.0

Slide 40

Slide 40 text

Slide 41

Slide 41 text

Slide 42

Slide 42 text

> • cmd.exe (system administrator ) > bcdedit /set TESTSIGNING ON Enable by command

Slide 43

Slide 43 text

Slide 44

Slide 44 text

• 終於把檔案安裝進 System32\drivers 中 >

Slide 45

Slide 45 text

> • driver.inf 安裝完成後的 driver 註冊表項

Slide 46

Slide 46 text

> • 亦可使用 WinObj 檢查安裝成果。

Slide 47

Slide 47 text

> Sample code problem.

Slide 48

Slide 48 text

> In Virtual Machine

Slide 49

Slide 49 text

> SERVICE_BOOT_START (0) SERVICE_SYSTEM_START (1) SERVICE_AUTO_START (2) SERVICE_DEMAND_START (3) SERVICE_DISABLED (4)

Slide 50

Slide 50 text

> • SERVICE_BOOT_START (0) (DevieceDriverOnly) • SERVICE_SYSTEM_START (1) (DevieceDriverOnly) • SERVICE_AUTO_START (2) • SERVICE_DEMAND_START (3) • SERVICE_DISABLED (4)

Slide 51

Slide 51 text

> Do not test driver on your host.

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

> • UTF16 encode : 魯 a = 9B 6F 00 61 • ASCII encode : 9B 6F 00 61 = › o a String Type Description char *str = {"kd string"} ANSI string wchar_t *wstr = {L"kd string"} Unicode string size_t len = strlen(str) ANSI string len size_t wlen Unicode string len printf("%s %ws %d %d", str, wstr, len, wlen) print format OutputDebugString("%s", wstr) print format

Slide 54

Slide 54 text

> C WDK unsigned long ULONG unsigned char UCHAR unsigned int UINT void VOID unsigned long * PULONG unsigned char * PUCHAR unsigned int* PUINT void * PVOID

Slide 55

Slide 55 text

> HANDLE Event UNICODE_STRING ObjectName Length MaximumLength Buffer 4 byte 2 byte 2 byte 4 byte HANDLE Event UNICODE_STRING ObjectName Length MaximumLength Padding Buffer 8 byte 2 byte 2 byte 4 byte 8 byte

Slide 56

Slide 56 text

> • On Microsoft Windows 2000 and later versions of the operating system, "\??" is equivalent to "\DosDevices". • For example, the object name of the "C:\WINDOWS\example.txt" file is "\DosDevices\C:\WINDOWS\example.txt". Path Type Description \\abc\xyz MSDN C:\abc\xyz MSDN \\.\C:\abc\xyz MSDN \\?\C:\abc\xyz MSDN \\?\UNC\abc\xyz MSDN \??\UNC\abc\xyz MSDN ?\UNC\abc\xyz Undocumented in WindowsServer 2012 2016

Slide 57

Slide 57 text

Slide 58

Slide 58 text

Driver Entry create port > Push Block into port WDK SAMPLE : minispy.sys

Slide 59

Slide 59 text

> Add data into Block Buffer

Slide 60

Slide 60 text

> Call function to Kernel add IRP data into buffer

Slide 61

Slide 61 text

> • User module User-mode extract data from communication port, according data structure in UK.h to split the data buffer

Slide 62

Slide 62 text

> Filter Manager Read Write Rename Delete User mode Kernel mode I/O Manager Minispy(Kernel) File System Driver Physical Device Minispy(User) Storage Driver Stack MinispyUK.h

Slide 63

Slide 63 text

> • Use Driver to change IRP content. • If need error message, deny it. Fake I/O

Slide 64

Slide 64 text

> WDK SAMPLE : ObCallback.sys Register to sniffer Process create event Sniffer launch Process command

Slide 65

Slide 65 text

> WDK SAMPLE : usbview.sys Enumerate USB Device

Slide 66

Slide 66 text

> • csrss.exe -> NtCreateFile -> IRP_MJ_READ (Kbdclass) • WDK Sample: kbfiltr.sys

Slide 67

Slide 67 text

No content

Slide 68

Slide 68 text

Slide 69

Slide 69 text

Slide 70

Slide 70 text

Slide 71

Slide 71 text

Slide 72

Slide 72 text

Slide 73

Slide 73 text

> • Copy .pdb and add srv*c:\MyServerSymbols*https://msdl.microsoft.com/download/symbols to WinDBG symbol path.

Slide 74

Slide 74 text

> • !analyze -v

Slide 75

Slide 75 text

> • Windbg (Host) + VM (OS & Driver) + serial port

Slide 76

Slide 76 text

> • bcdedit /debug on • bcdedit /dbgsettings serial debugport:{PortNumber} baudrate:{Number} • bcdedit /dbgsettings

Slide 77

Slide 77 text

> • .sympath srv*c:\Symbols*http://msdl.microsoft.com/download/symbols;

Slide 78

Slide 78 text

Slide 79

Slide 79 text

Slide 80

Slide 80 text

Slide 81

Slide 81 text

Slide 82

Slide 82 text

No content

Slide 83

Slide 83 text

• Windows drivers – Signed – WHQL signed – EV signing cert (A Must for Win10 signing process) > source: この勇者が俺TUEEEくせに慎重すぎる

Slide 84

Slide 84 text

> • LoJax • Slingshot • MSI+ASUS+GIGABYTE+ASROCK

Slide 85

Slide 85 text

> LoJax • First UEFI malware found in the wild • Implant tool includes RwDrv.sys driver from RWEverything • Loads driver to gain direct access to SPI controller in PCH • Uses direct SPI controller access to rewrite UEFI firmware

Slide 86

Slide 86 text

> Slingshot • APT campaign brought along its own malicious driver • Active from 2012 through at least 2018 • Exploited other drivers with read/write MSR to bypass Driver Signing Enforcement to install kernel rootkit

Slide 87

Slide 87 text

> • ASRock Drivers – CVE Name: • CVE-2018-10709, CVE-2018-10710, CVE-2018-10711, CVE-2018-10712 • ASUS Drivers – CVE Name: • CVE-2018-18537, CVE-2018-18536, CVE-2018-18535 • GIGABYTE Drivers – CVE Name: • CVE-2018-19320, CVE-2018-19322, CVE-2018-19323, CVE-2018-19321 • ......

Slide 88

Slide 88 text

> ASROCK + ASUS + GIGABYTE • Arbitrary ring0 virtual memory read/write • Port mapped I/O access • MSR Register access • Arbitrary physical memory read/write • CR register access • ......

Slide 89

Slide 89 text

> • Most drivers specify only the FILE_DEVICE_SECURE_OPEN characteristic. This ensures that the same security settings are applied to any open request into the device's namespace.

Slide 90

Slide 90 text

source: apple daily

Slide 91

Slide 91 text

Slide 92

Slide 92 text

> Maybe FILE_DEVICE_SECURE_OPEN has been defined as 0?

Slide 93

Slide 93 text

> source: 焼きたて!! ジャぱん

Slide 94

Slide 94 text

Slide 95

Slide 95 text

Slide 96

Slide 96 text

> Windows Internal 7th Windows 7 Device Driver source: Tom and Jerry

Slide 97

Slide 97 text

> • MinimumRequiredLength – The minimum buffer size, in bytes, that the driver needs to process the I/O request.

Slide 98

Slide 98 text

> • Model specific registers (MSR) exist in CPUs. Contrary to the name, some MSRs are actually part of the official x86 or x64 architecture and not "model specific" • The transition to kernel-mode is done via an MSR – syscall -> read MSR -> call MSR pointer (Ring-0) -> kernel function handles the syscall logic • Default on modern systems we only care about MSR_LSTAR (0xc0000082) • Can inspect via rdmsr command in windbg

Slide 99

Slide 99 text

> • You can probably see where this is going • Exposed wrmsr (__writemsr) instruction gives us a pointer to overwrite primitive – Function pointer is called when any syscall is issued – Called from Ring-0 source: Fireeye

Slide 100

Slide 100 text

> source: Fireeye

Slide 101

Slide 101 text

> source: Fireeye

Slide 102

Slide 102 text

> • Win8+ Supervisor Mode Execution Prevention (SMEP) - BSODs if CPU detects execution of a user-mode VA while in Ring-0 • As a response to Spectre and Meltdown Microsoft added Kernel Page Table Isolation (KPTI), KPTI maintains a separate set of page tables for user- and kernel-mode EZ MODE ~Win8 SMEP Win8+ Spectre+Meltdown KPTI source: Fireeye

Slide 103

Slide 103 text

No content

Slide 104

Slide 104 text

> • HyperV & PatchGuard catches MSR and CR3/CR4 modifications • Adding some sort of cookie check post-CR3 restoration could raise the bar – Require attackers to also have arbitrary kernel reads • More driver install notifications – Hardware drivers have confirmation prompts on install – but not software drivers? • Windows Driver Samples should import their security advises on MSDN

Slide 105

Slide 105 text

> • Device Driver Debauchery and MSR Madness – Ryan Warns & Tim Harrison - FireEye • Get off the kernel if you can’t drive – Jesse Michael - DEFCON 27 • Reverse Engineering and Bug Hunting On KMDF Drivers – Enrique Nissim - IOActive • Windows Drivers Attack Surface – Ilja Van Sprundel • Windows Internals 6,7, MSDN – Microsoft • Practical Malware Analysis – Michael Sikorski & Andrew Honig

Slide 106

Slide 106 text

No content

Slide 107

Slide 107 text

No content

Slide 108

Slide 108 text

> • 在 Win64，PatchGuard x64 一言不合就藍屏 Process/3rdAPI (wxWidgets.lib) Windows API System Service Dispatcher (KiSystemService) NtCreateFile SSDT User Mode Kernel Mode ntdll.dll NtClose P.S. 如何破解PatchGuard有一整串討論跟實作喔~

Slide 109

Slide 109 text

因為是載入 Driver，所以所調用的 Kernel API 時 Table 所指的記憶體位置並不確定因此，直接用 Kernel 函數名稱取址並非其運行時 Table 所指的記憶體位置 Hook 函數時需要另外使用 MmGetSystemRoutineAddress( ) 函數確切取得運行時記憶體位置 > • In Win32 System Service Dispatcher (KiSystemService) NtCreateFile SSDT User Mode Kernel Mode ntdll.dll NewCreateFile

Slide 110

Slide 110 text

> • 根據函數名稱找到 SSDT 位址 • cli 關閉中斷(interrupt) • 關閉處理器寫入保護 (0fffefffh取代CR0保護) • 改寫函數指標(pointer) • 復原處理器寫入保護 • sti 開啟中斷

Slide 111

Slide 111 text

No content

Slide 112

Slide 112 text

> • Hold the shift while click reboot button. SHIFT One Time Solution source: Netflix

Slide 113

Slide 113 text

> One Time Solution

Slide 114

Slide 114 text

> • cmd.exe (system administrator ) > bcdedit /set TESTSIGNING ON Enable by command Inndy大神: 也可以在 Kernel 找到確切驗證位址後關掉

Slide 115

Slide 115 text

> • I assume you build your own dirver already, if you try to use sign function within VS project, that’s another issue. • You should already have .cat, .sys & .inf (with sign function in VS, you will get your own usable .cer if you set it right.)

Slide 116

Slide 116 text

> • MakeCert -r -pe -ss TEST -n "CN=TEST.org" test.cer > • CertMgr /add minispy.cer /s /r localMachine root • CertMgr /add minispy.cer /s /r localMachine trustedpublisher

Slide 117

Slide 117 text

> • SignTool sign /v /s TestCertStoreName /n TestCertName /t http://timestamp.verisign.com/scripts/timstamp.dll DriverFileName.sys