Exploit Your Java Native Vulnerabilities on Win7/JRE7 in One

Minute

Or how to exploit a single java vulnerability

in three different ways

Today we are not talking about how to find 0day java native vulnerabilities, but

how to “cook” them

About me

• Architect, Trend Micro China Development Center

• Interested in vulnerabilities, sandbox technique, anti-APT solution

• Hardcore ACG otaku

Agenda

• Background

• The vulnerability

• Exploit method 1

• Exploit method 2

• Exploit method 3

• Conclusion

What is java native vulnerability?

• Vulnerability which exists in JRE native code (C/C++ code)

– Stack overflow

– Heap overflow

– Buffer overflow/underflow

– …

• Aka, java memory corruption vulnerability

Trends of Java native vulnerability

Exploit Java native vulnerability

• JRE 6

– No DEP, ASLR

– Find a schoolchild and teach him Heap Spray

• JRE 7

– Opt-in DEP, ASLR, windows 7, windows 8 …

– Hmmm, seems much harder ?

– Actually not so hard, we will show you how to in this presentation

Agenda

• Background

• The vulnerability

• Exploit method 1

• Exploit method 2

• Exploit method 3

• Conclusion

CVE-2013-1491

• Found by Joshua J. Drake (jduck)

• Used on Pwn2013, defeated JRE 7 + Windows8 (Accuvant Lab's White Paper)

• We also discovered the same issue in Feb 2013, via our java font fuzzer, and finished the exploits in April 2013

CFF Font Instructions

• Compact Font Format, or Type2 font

• You can write instructions (byte codes) to help building a character at runtime

private static native long

0A: call sub routine0B: return from sub routine0C 0A: add0C 0B: sub0C 0C: div0C 0D: load

stack

Related Data Structures

• TopDictInfo

– buildCharArray – dynamic allocated array

– reg_WeightVector – static array in the structure

The two vulnerable instructions• store [0, j, index, count]

• load [0, index, count]

No array boundary checks on store/load !

What can we do with it

• Read/Write arbitrary 16-bit range in the buildCharArray and regWeightVector

• By over writing the buildCharArray pointer, we can achieve arbitrary address read/write

Example

Initial State

T->topDictData…

buildCharArray

…reg_WeightVector

0x2000000

0x200087c

0x20007b4

0x2100000

Step1put(0, 0x0c0c0c0c)

T->topDictData…

buildCharArray

…reg_WeightVector

0x2000000

0x200087c

0x20007b4

0x2100000

0c0c0c0c

buildCharArray[0] = 0x0c0c0c0c;

Step2store(0, -18, 0, 1)

T->topDictData…

buildCharArray

…reg_WeightVector

0x2000000

0x200087c

0x20007b4 0x2100000

0c0c0c0c

reg_WeightVector[-18] = buildCharArray[0];

Step3put(0, 0x41414141)

T->topDictData…

buildCharArray

…reg_WeightVector

0x2000000

0x200087c

0x20007b4

0x0c0c0c0c

41414141

buildCharArray[0] = 0x41414141;

Agenda

• Background

• The vulnerability

• Exploit method 1

• Exploit method 2

• Exploit method 3

• Conclusion

Information Leak + ROP

Information Leak

• Read a function pointer from the structure

• Sub a pre-computed offset from the function pointer address, to get base address of t2k.dll

• Get other dll base (e.g. msvcrt) from IAT of t2k.dll

ROP

1. Write ROP gadgets into buildCharArray

2. Set jmp_buf->eip to the first ROP instruction

3. Set jmp_buf->esp to buildCharArray

4. Trig an internal error to call longjmp

struct TopDictInfo {tsiMemObject *mem; …

}

struct tsiMemObject {

…jmp_buf env;…

}

…

esp

…

…

eip

Agenda

• Background

• The vulnerability

• Exploit method 1

• Exploit method 2

• Exploit method 3

• Conclusion

Overwrite Array Length + Statement

Java Array in memory

Object Head length a[0] a[1] … a[n]

8 bytes 4 bytes

If we can overwrite the length field, then we can read/write out of the bound of this java array

Array Spray

Overwrite Array length

• Set buildCharArray to 0x23ad27d8 (this address may vary in different OS)

• Write “0x7fffffff” to 0x23ad27d8, which will be the new array length

Overwrite ACC in Statement Object

• Statement: call method on a target object

• AccessControlContext: check permission on privileged operations

Overwrite ACC in Statement Object• When a new statement is created, the acc is set to

the “snapshot” of current calling context

• If you created the statement in low privileged code, the acc will be a low privileged ACC

• We can replace the acc with a powerful ACC in memory

Object Head acc target … ……

Statement Object memory layout

Powerful ACC

Method 2 – Exploit Procedure

length

data

1. Allocate arrays

acc

statement2. Allocate statement

object right after the array

Memory Space

3. Overwrite array length

new length

4. Overwrite acc in statement

powerful acc

Demo

• Exploit CVE-2013-1491 using Array length overwriting + Statement

Method2 - Limitation

• You need to be able to overwrite memory of Java Object Heap

JVM

java object heapjava native heap

Java object

Java Array

Default heap of JRE native code

Agenda

• Background

• The vulnerability

• Exploit method 1

• Exploit method 2

• Exploit method 3

• Conclusion

JIT Spray

History of JIT Spray

• Dion Blazakis - interpreter exploitation: pointer inference and spraying

• Alexey Sintsov- Writing JIT shellcode for fun and profit

• TT Tsai - The Flash JIT Spraying is Back

History of JIT Spray

• Mostly focus on flash

• No practical POC & Guide on Java

Java JIT Compiler

Java compiler,

into byte code in class file

JIT compiler, into native code

Java JIT Compiler (.cont)

• View JIT generated code

– -XX:+UnlockDiagnosticVMOptions -XX:+PrintAssembly

• CompileThreshold

– Only when a function is called > CompileThreshold times, it will be JITed

– Default value: 1500 for client JVM

XOR in java JIT compiler

public int spray(int a) {

int b = a;

b ^= 0x90909090;

b ^= 0x90909090;

b ^= 0x90909090;

return b;

}

0x01c21507: cmp 0x4(%ecx),%eax

0x01c2150a: jne 0x01bbd100 ;

0x01c21510: mov %eax,0xffffc000(%esp)

0x01c21517: push %ebp

0x01c21518: sub $0x18,%esp

0x01c2151b: xor $0x90909090,%edx

0x01c21521: xor $0x90909090,%edx

0x01c21527: xor $0x90909090,%edx

…

0x01c21539: ret

XOR in java JIT compiler (.cont)

• The XOR statement is compiled to an instruction of six bytes

– 81 F2 90 90 90 3C xor edx, 0x3C909090

• We can replace the 3 NOP bytes with our shellcode

Set EIP in the middle$0: 81 F2 90 90 90 3C : xor edx, 0x3C909090

$6: 81 F2 90 90 90 3C : xor edx, 0x3C909090

$12: 81 F2 90 90 90 3C : xor edx, 0x3C909090

$0: 81 F2

$2: 90 nop

$3: 90 nop

$4: 90 nop

$5: 3C 81 cmp al, 81

$7: F2 repne

$8: 90 nop

$9: 90 nop

$10: 90 nop

$11: 3C 81 cmp al, 81

EIP

EIP

Find a reliable EIP to jump to

• 0x02cd70b7

– Fairly reliable on the tested systems:

– windows xp sp3, windows 7 home edition, windows 7 enterprise edition, windows 8 home edition

Spray multiple functions at runtime

• ClassLoader.loadClass

JIT00002.classJIT00001.class …

Exploit.class

Performance

• First version: 20 ~ 40s to spray 2400 functions

– Because we have to call a function 1500 times before it can be JITed

• Use pre warm up: 7 ~ 9s

Shellcode

• Two-Staged

– Stage0: Sprayed by JIT functions, will search for Stage1 shellcode and execute it (egg-hunt)

– Stage1: Defined in java string, do the real work

Demo

• Exploit CVE-2013-1491 using JIT Spray

Add JIT Spray to your POC in one minute

• Demo

– Add JIT Spray to CVE-2013-0809 POC

– We will public all related code after the presentation

Optional Demo

• JRE 7 native 0day + Win8 + Java JIT Spray

Java JIT Spray - Limitation

• Currently only works on 32bits platform

• You need to be able to control EIP precisely

Agenda

• Background

• The vulnerability

• Exploit method 1

• Exploit method 2

• Exploit method 3

• Conclusion

Conclusion

• We introduced 3 different methods to exploit a java native vulnerability and bypass DEP/ASLR

• You need to choose the one that fit your vulnerability

Conclusion

• Choose JIT Spray if 32bits & you can control the EIP

• Choose Array + Statement if you can overwrite a java array on java object heap

• Choose Information Leak + ROP if you are Vupen

"Heapsprays are for the 99%"

“And so are JIT sprays."

Thank you!

Q & A