(Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the...

19
(Un) Fucking Forensics Ac#ve/Passive memory hacking/debugging K2 / Director @IOACTIVE hBps://github.com/K2

Transcript of (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the...

Page 1: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

(Un) Fucking Forensics Ac#ve/Passivememoryhacking/debugging

K2/Director@IOACTIVE

hBps://github.com/K2

Page 2: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

About me?

• Hackerforawhile

•  inVtero.net•  MemoryanalysisframeworkforWindows

•  Superfast/GBPSthroughput•  MemoryintegritycheckingofVM’s/CrashDumps/Memory

•  Typeawarememoryhackingtool

•  EhTrace•  Binarytracetool

•  Useshook/patch-lesstechniqueforin-processdebugging

•  Lotsofotherstuff

Page 3: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Outline / areas

• Howtoforensic,howtoFuckforensicsandhowtounfuckit.

•  Intx80AFtechniqueonheaderwipe/non-residentcode/trim()

•  Howtodealwiththat

• RoPbackground,howit’susedinaBacks•  GargoyleaBacks&howtoprotectagainstthem

• CloudLeech–twistonUlfFriskDMAaBacks/PCILeech

•  Demoofopensourcememoryintegritypla_ormforWindows!

Page 4: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Can you even forensic?

•  Ingeneral:Determinewhathappened.

Makea!melineofknownevents.

•  “Ar!facts”disk&memory(ocenincomplete/

fragmented)usedtobuild#meline.

•  Howgoodcanwedo?Howdoweknowifweredone?

Page 5: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Ar>fact sources

How

aAestable are they?

•  Timestampsfromallsourcestoderive!meline(eventlogs/syslog/firewall/filesystem#me,etc…)

•  Wevtu!l-WindowsEventsCommandLineU#lity.

Configuremorethan1189eventlogsources

•  SysMon(fromSysInternals/MarkRussinovich)/neat

config:

hBps://github.com/SwicOnSecurity/sysmon-config

•  Linux(osqueryhBps://github.com/facebook/osquery)

Page 6: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Handling memory

•  ForensicsmeetsReverseEngineering

•  Dump/disassembledeterminewhattheextentofcapabilitythea8ackerpossesses•  Iwanttoatleastclearthisguyout&findouthowmuchdamagehedid

•  Vola#lity/Rekallpythonforensicengines

•  StephenRidley’sREmemoryhackingtool:hBps://github.com/s7ephen/SandKit

•  Paper:Escapingthesandbox

•  GAMEHACKING!J

•  Let’slookatwhatpeopledotocheatsome#me?

Page 7: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

How to F’it?

•  Hidereallywell• Wipe/Destroylogging/leaveno

trace/Stenography/Encrypt

• Misdirect

•  Flood/Annoy/Makeanalysisso

costly$$$/Obfuscate/Spoof/

•  DirectABack•  DefCon15:BreakingForensicsSocware:WeaknessesinCri#cal

EvidenceCollec#onChrisPalmer,

AlexStamos

Page 8: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

An#-forensics:Furtheringdigitalforensicsciencethroughanewextended,

granulartaxonomy:

Page 9: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Foreshadowing: normalize you’re opera>ons

• Agreatwaytooperateundetectedistoensureyouarenotananomaly.

•  Usetheresourcesofyou’retargettoconductyou’reopera#ons.

•  “Configura#on”aBacks•  EnableIPV6tunneling&VPNaccess•  ABackerhastrustedCAcapability(addedtheirprivkeytotrustedlist)

•  Themore“normal”themethodwillbeveryhardtodigup

Page 10: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Int0x80’s AF counter

ABackagainstatool:

Rekall

• Preventdumpingforworking

Morewaystogetit;

• UseVAD(kernelsource)• UsePageTable(ABI)• UseinVtero.net• dump.py-VADDump(VAD)or

Dump(PageTable)

Page 11: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

RoP: More normal

•  RoPisanocendiscussedtopicusedmostlyforexploita#on

•  RoPusestheCPUstackseman#cstoexecuteasifitwereareallylargesetofreturn

statements.

•  Thisusesthecodethat’salreadyonthesystemmore“normalized”thanifyouhadtoinject

anexecutablepayloadthatdidnotoriginatefromthetarget

•  RoPisusedbyGargoyle(JoshLospinoso)asanexampleofapersistence

techniquethatevadesmemoryanalysissystems

•  Thereishope,wecandetectRoPaBacksthroughcallchainevalua#on

Page 12: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

RoP is not perfect

hBps://www.cs.columbia.edu/~angelos/Papers/theses/vpappas_thesis.pdf

Page 13: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Gargoyle persistence

•  Leveragesa#merandblocking

waitthatmovesitintothe“ac#ve

state”

•  Onceac#ve,stagespageprotec#on+X

•  Thenusesthispagetoinvokeit’sprimarypayload

•  Itthenmask’sthe+Xbitbackoff

andgoesinac#ve

Page 14: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Tools too defend against RoP aAack?

• Analysis:ROPEMU:AFrameworkfortheAnalysisofComplexCode-

ReuseABacks

•  DumpacomplexRoPexecu#ontraceintoanELF!!Wow!

• Detec#on:inVtero.netcanperformastackcheckingfunc#onagainst

thememorydump.

•  SimilartoolsformonitoringRoPatrun#me(EhTrace,RoPGuard,etc…)

•  FromtheinVterooutput,youreallydoNOTwanttoseetheGargoylegadget,

oranythingthatlookslikeastackpivot

Page 15: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Injec>on techniques

• Manyvariega#onstoachievethesamegoal;

•  10ProcessInjec#onTechniques(AshkanHosseini/Endgame)

•  LoadLibrary,Hallowing,Threadhijacking,WindowsHooks,Registry

keys,APC,SetWindowLong,Shims&IATshims

•  FlamewasasortofhallowingaBack

•  “hid”insideofntdll,remainedundetectedforyears

Page 16: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Enter DMA with PCILeech

•  UlfFriskDirect-Memory-ABack-the-Kernel:

•  PCILeechaBacksandu#lityforforensics(memory)collec#on

• Usesavarietyof(verycool)techniquestoexecutepayloads

• Oneofthesimplestisthe“unlock”func#onality

•  It’saninlinepatchhowever•  Hardtodetectw/omanualreversing

Page 17: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Integrity valida>on

•  Fullvalida#onatanypointin#memustbeabletobeconducted

•  Systemstateshould/mustbesta#c

•  CPUexecu#onwillallowaBackerstoplaygames/evaderead’s

•  RDMA

•  LiveMigra#on/Snapshowng

Page 18: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Tie it together

UnF’dMemoryForensics–Removetheguesswork

•  Leveragewiderangeofinforma#onsources

•  Haveacomprehensiveglobalviewofthedataset

•  AppropriatecountermeasuresformostaBackers(RoP)

•  Integritycheckingofmemory(inlinepatchprotec#on)

•  Symbolsandcontextforanalysisofpointers

•  Pointertrackingbecomesmoresignificantaswecanqualifytheiraddress/vector

Page 19: (Un) Fucking Forensics - DEF CON CON 25/DEF CON 25... · Un F’d Memory Forensics – Remove the guesswork • Leverage wide range of informa#on sources • Have a comprehensive

Demo’s & Thank you

• Checkoutthetools

Github.com/K2


How to secure the keyboard chain - DEF CON CON 23/DEF CON 23 presentations/DEF… · How to secure the keyboard chain DEF CON 23 Paul Amicelli - Baptiste David - CVO Esiea-Ouest c

How to secure the keyboard chain - DEF CON CON 23/DEF CON 23 presentations/DEF… · How to secure the keyboard chain DEF CON 23 Paul Amicelli - Baptiste David - CVO Esiea-Ouest c

802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Starting the Avalanche - DEF CON CON 25/DEF CON 25 presentations/DEF… · Starting the Avalanche: Application DoS ... DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer

Starting the Avalanche - DEF CON CON 25/DEF CON 25 presentations/DEF… · Starting the Avalanche: Application DoS ... DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer

HACKING HOTEL KEYS - DEF CON CON 24/DEF CON 24 presentations/DEF… · HACKING HOTEL KEYS Security Consultant ... Researcher. 9About 11 years pen-testing, Security Research, ... 912

HACKING HOTEL KEYS - DEF CON CON 24/DEF CON 24 presentations/DEF… · HACKING HOTEL KEYS Security Consultant ... Researcher. 9About 11 years pen-testing, Security Research, ... 912

Keren Elazari aka @K3r3n3 - DEF CON Media Server CON 22/DEF CON 22...Empowering Hackers to Create a Positive Impact, Keren Elazari, DEFCON, DEF CON, Hacker, Security Conference, Presentations,

Keren Elazari aka @K3r3n3 - DEF CON Media Server CON 22/DEF CON 22...Empowering Hackers to Create a Positive Impact, Keren Elazari, DEFCON, DEF CON, Hacker, Security Conference, Presentations,

Next Generation Data Forensics & Linux - DEF CON · Next Generation Data Forensics & Linux Thomas Rude, CISSP August 2002. Agenda ... VFAT, NTFS, ISO9660, UDF, UFS, etc. - Win32 can

Next Generation Data Forensics & Linux - DEF CON · Next Generation Data Forensics & Linux Thomas Rude, CISSP August 2002. Agenda ... VFAT, NTFS, ISO9660, UDF, UFS, etc. - Win32 can

Teaching Old Shellcode New Tricks - DEF CON CON 25/DEF CON 25 presentations/DE… · Teaching Old Shellcode New Tricks DEF CON 2017 @midnite_runr

Teaching Old Shellcode New Tricks - DEF CON CON 25/DEF CON 25 presentations/DE… · Teaching Old Shellcode New Tricks DEF CON 2017 @midnite_runr

DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DEF… · Don’t"believe"anything"I"Say • Also,"hold"those"around"you"accountable

DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DEF… · Don’t"believe"anything"I"Say • Also,"hold"those"around"you"accountable

DEF CON 25 Hacker Conference - DefCon Media Server CON 25/DEF CON 25 presentations/DEF… · functionality = self.checklist["Functionality"] ... Manually add ancillary data (pentest/other

DEF CON 25 Hacker Conference - DefCon Media Server CON 25/DEF CON 25 presentations/DEF… · functionality = self.checklist["Functionality"] ... Manually add ancillary data (pentest/other

Infrared - Def Con

Infrared - Def Con

Eric Sesterhenn 2018 CON 26/DEF CON 26 presentations/DEFCON-26... · DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

Eric Sesterhenn 2018 CON 26/DEF CON 26 presentations/DEFCON-26... · DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

DEF CON 23 Presentation CON 23/DEF CON 23... · DEF CON 23 Presentation Keywords: DEF CON Conference, DEF CON, DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer Security,

DEF CON 23 Presentation CON 23/DEF CON 23... · DEF CON 23 Presentation Keywords: DEF CON Conference, DEF CON, DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer Security,

Hacking MANET - Def Con

Hacking MANET - Def Con

Introduction to SDR & the Wireless Village - DEF CON CON 23/DEF CON 23 presentations/DEF… · Introduction to SDR & the Wireless Village ! Who the Frig...! satanklawz!! DaKahuna!

Introduction to SDR & the Wireless Village - DEF CON CON 23/DEF CON 23 presentations/DEF… · Introduction to SDR & the Wireless Village ! Who the Frig...! satanklawz!! DaKahuna!

DEF CON 23 Presentation

DEF CON 23 Presentation

Aaron Bayles DC101 @ DEF CON 22 - DEF CON® Hacking Conference · Aaron Bayles DC101 @ DEF CON 22 ... //media.blackhat.com/us ... Lockpicking, Hackers, Infosec, Hardware Hacking,

Aaron Bayles DC101 @ DEF CON 22 - DEF CON® Hacking Conference · Aaron Bayles DC101 @ DEF CON 22 ... //media.blackhat.com/us ... Lockpicking, Hackers, Infosec, Hardware Hacking,

SCADA - DEF CON

SCADA - DEF CON

DEF CON 26 HACKING CONFERENCE CON 26/DEF CON 26 receipt.pdf · Title: DEF CON 26 HACKING CONFERENCE Author: DEF CON 26 Subject: DEF CON 26 RECEIPT Keywords: DEF CON Conference, DEF

DEF CON 26 HACKING CONFERENCE CON 26/DEF CON 26 receipt.pdf · Title: DEF CON 26 HACKING CONFERENCE Author: DEF CON 26 Subject: DEF CON 26 RECEIPT Keywords: DEF CON Conference, DEF

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24...Katea Murray –murrayka@leidos.com 2016-08-05 Estell/Murray Eavesdropping on the Machines 28. Title: DEF CON 24

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24...Katea Murray –[email protected] 2016-08-05 Estell/Murray Eavesdropping on the Machines 28. Title: DEF CON 24

Kiosk Security - DEF CON

Kiosk Security - DEF CON