Exploit generation automation with WinDBG (Hacktivity 2017)

Exploit generation automation with WinDBG (Hacktivity 2017)

• 1.
  Exploit generation automation withWinDBG Csaba Fitzl
• 2.
  whoami blue teamer security researcher,blogger husband, father hiker
• 3.
  Exploit writing challenges Timeconsuming Heavily manual intensive process Discovering memory layout Finding bad characters While (exploit doesn’t work == True): Start process, attach debugger, crash, Modify exploit
• 4.
  Exploit writing methodology- BoF Find EIP overwrite location Examine memory layout, registries Somehow jump to shellcode Generate shellcode Put all together
• 5.
  The task A toolwhich can automate the entire exploit writing process From crash PoC to working Exploit If possible n0 manual interaction
• 6.
  The tool Written inPython Uses the “pykd” library to interact with WinDBG
• 7.
  What can itdo? Currently works for classic BoFs Can bypass ASLR Works for network and file based exploits Will create a successful exploit from a simple crash Automates the entire process (even finding bad characters!) No need to manually start the process / WinDBG
• 8.
  The logic Find EIPoverwrite location / offset Find registers pointing to the buffers Find bad characters Find a way to jump to the shellcode (JMP, CALL, etc…) Generate shellcode Put it all together
• 9.
  demo time
• 10.
  How to useit? Some pre-work needs to be done Exploit is a Class Has to be populated with initial info (crash)
• 11.
  What has tobe changed? def exploit(self): """ This function runs the actual exploit """ sleep(1) sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect(('127.0.0.1',80)) message = "GET " + ''.join(self.buffer) + " HTTP/ 1.1rnrn" sock.send(message) sock.close()
• 12.
  ? twitter: @theevilbit tool: https://github.com/theevilbit/exploit_generator