Embed Size (px)
DESCRIPTION
MS Windows - Kill Bill
Citation preview
MS Windows – KILL BILL
Prathan PhongthiproekACIS Professional CenterSenior Information Security ConsultantMarch 20 th, 2010
Instructor / Speaker Red Team : Penetration Tester (Team Leader) Security Consultant / Researcher CWH Underground Exploits and Vulnerabilities Disclosure
Milw0rm, Exploit-db, Security Focus, Secunia, Zeroday, etc
Who am I ?
Overview
Remote Attack MS Windows OS
The Message From Slave to God
MS Office Evil
Internet Explorer Pwn2Own
USB Autorun Attack
Local Buffer Overflow
Microsoft Windows is SUCK !!
Why MS Windows is SUCK ???
NetBIOS Null Sessions -> The Holy Grail of Windows Hacking
See Movie “Pirates of Silicon Valley”
Remote Microsoft Windows Vulnerabilities !!
Buffer Overrun In RPC Interface (MS03-026)
Buffer Overrun In RPCSS Service (MS03-039)
Vulnerability in LSASS service (MS04-011)
Vulnerability in Plug and Play (MS05-039)
Vulnerability in Server Service (MS06-040)
Vulnerability in Server Service Relative Path Corruption (MS08-067)
Vulnerability in SMBv2 Command Value (MS09-050)
Not Include DOS Exploit
MS Windows RPC Vulnerability MS08-067
“PoC’s work against Windows XP SP2, Windows XP SP3 and Windows 2003 Server SP2 machines”
MS Windows SMB2 Vulnerability MS09-050
“PoC’s work against Windows Vista SP1/2, Windows 2008 SP1/2 (Not R2) and Windows 7 (RC) machines”
MS Windows – Defensive
MS Windows – Defensive
Gaining Access without Exploit
Exploit MS Vista (MS09-050)
The Message From Slave to God
Get The Hell Outta Here !!Get The Hell Outta Here !!
MS Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack
An error exists within the #GP trap handler (nt!KiTrap0D)
An error exists within the Windows kernel not correctly resetting a pointer when freeing memory
Affect every release of the Windows NT kernel (Window 2000, XP, Server 2003, Vista, Server 2008, 7)
Non-Affect : Windows 7 (64-bit), Windows Server 2008 (64-bit, Itanium)
Patch release MS10-015 on Feb 09 2010
0-day for 1 month. W00t ! W00t !
KiTra0d – Local Ring0 Kernel Exploit
KiTra0d – Local Ring0 Kernel Exploit
Token - Web Cookies (Credentials When RDP, MAP Network Drive)
On Windows XP / 2003 – Windows Service run as SYSTEM account Compromise of a Service == Full System Compromise
On Windows Vista / 2008 - LocalService / NetworkService == System
Affect every release of the Windows NT kernel (Window 2000, XP, Server 2003, Vista, Server 2008, 7)
Patch release MS09-012 on April 14 2009
0-day for 1 year. W00t ! W00t !
Black hat Mind !! Combine Attack Layer 8 + KiTrap0d + Token Kidnapping
Token Kidnapping – Elevate Privilege
MS Office (Evil Macro)
MS Office is Evil !!
MS Office (Evil Macro)
MS Office (Evil Macro)
MS Office (Evil Macro)
Internet Explorer Pwn2Own
Internet Explorer Pwn2Own
Internet Explorer Pwn2Own
Internet Explorer Pwn2Own
Internet Explorer Pwn2Own
Internet Explorer Pwn2Own - ActiveX
USB Autorun Attack
Autoplay NOT Autorun
USB Autorun Attack
Turn Off Autoplay -> It’s still vulnerable from evil usb
USB Autorun Attack
USB Autorun Attack
USB Autorun Attack
\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
0xff
USB Autorun Attack
USB Autorun Attack
Local Buffer Overflow
Local Buffer Overflow
Local Buffer Overflow
See you at Citec-Con 3… Q&A
THANK YOU
