Top Banner
Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum
45

Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Jul 23, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Windows Memory Forensics and Direct Kernel Object Manipulation

Jesse Kornblum

Page 2: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

2

Outline •  Introduction •  The Kernel •  Direct Kernel Object Manipulation •  Standard DKOM •  Devious DKOM •  Better Magic •  Relations Between Kernel Objects •  Questions

Page 3: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Introduction •  Computer Forensics Research Guru

–  md5deep, hashdeep, fuzzy hashing (ssdeep), foremost, etc –  AFOSI, DoJ, ManTech

•  Kyrus Technology

3

Page 4: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Introduction •  Direct Kernel Object Manipulation (DKOM) •  Powerful technique for p0wning a computer

–  or crashing it •  Memory forensics should be able help us

–  but can be subverted too •  But we shall prevail

4

Page 5: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

The Kernel •  The kernel must maintain lots of data

–  Processes –  Threads –  File handles –  Network connections –  Interrupts –  Really everything on the system

•  All stored in kernel data structures

5

Page 6: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

How it’s Supposed to Work •  Structures are modified by API functions •  Several different levels of API functions

–  CreateProcess –  NtCreateProcess –  ZwCreateProcess –  And many more!

•  These functions provide –  Sanity checking –  Memory allocation –  Data initialization

6

Page 7: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Direct Kernel Object Manipulation •  Modify data structures without using API functions

•  Must be done by code running in ring zero –  Also called kernel mode –  But not userland programs

•  Can be done by drivers –  This is why drivers can cause crashes

•  Code injected into the kernel process

7

Page 8: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

The Kernel •  Lots of lists •  Linked lists •  Each item points to the next item in the list

8

Page 9: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

The Kernel •  Doubly linked lists •  Each item points to the next and previous items in the list

9

Page 10: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

How it’s Supposed to Work

10

Page 11: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

How it’s Supposed to Work

11

List Head

Page 12: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

DKOM Example •  Unlink a process to hide it •  Adjust forward and back links to skip an item

12

Page 13: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Standard DKOM

13

List Head

Page 14: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Detecting Standard DKOM •  High-low analysis

–  Follow process links, record all processes –  Brute force search for processes

•  Compare the results •  Any process that shows up in one list but not the other is suspicious

α β γ δ ε ζ η θ κ λ π σ φ ψ α β γ δ ε ζ η θ κ λ σ φ ψ

14

Page 15: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Devious DKOM •  How do you do a brute force search? •  Most modern tools looks for a magic value •  Magic values may not be required •  Some can be replaced with arbitrary values

–  System still runs

15

Page 16: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Process Structures •  Execute Process

structure –  EPROCESS

•  Consists of several substructures

•  Lives in pool memory •  Starts with a

POOL_HEADER –  You don’t need to

know what this is –  Contains values set

by kernel –  But not referenced

while running

16

Image courtesy Flickr user leozaza and licensed under the Creative Commons

Page 17: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Devious DKOM •  On Windows XP the POOL_HEADER starts with

50 72 6f e3 (“Proã” in ASCII)

•  Can be replaced with, for example 00 00 00 00

17

Page 18: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Devious DKOM Demo

18

•  Using Volatility Framework –  https://www.volatilesystems.com/default/volatility

•  Not picking on Volatility –  All existing tools use magic values –  Best free memory forensics tool

•  Demo…

Page 19: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Detecting Devious DKOM •  Two approaches

–  Get better magic –  Detect using something else

19

Page 20: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Better Magic •  Better Magic Through Fuzzing™

•  Fuzzing means inputting random data and seeing what happens

•  Use automated tools to only report the interesting inputs

20

Image courtesy Flickr user LaMenta3 and licensed under the Creative Commons

Page 21: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Better Magic •  Method by Brendan Dolan-Gavitt et al. •  Fuzzing to find magic values

–  Fire up virtual machine and start a process –  Pause VM –  Change EPROCESS values at random –  Resume VM –  Record if change made the process or machine crash –  Repeat

•  Do mathy stuff to generate rules for which values cannot be changed without a crash

•  Full citation at the end, http://www.cc.gatech.edu/~brendan/ccs09_siggen.pdf

21

Page 22: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Better Magic •  Examples from EPROCESS

•  Pcb.ReadyListHead –  List Head of threads ready to execute –  val & 0x80000000 == 0x80000000 AND val % 0x8 == 0

•  Peb –  Address of Process Environment Block –  val == 0 OR –  (val & 0x7ffd0000 == 0x7ffd0000 AND val % 0x1000 == 0)

22

Page 23: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Problems with Better Magic •  These rules are for 32-bit Windows XP Service Pack 2 only •  Fuzzing must be repeated for each configuration •  Rules will be different for each configuration

–  Especially 64-bit systems

23

Page 24: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Detecting Devious DKOM •  Two approaches

–  Get better magic –  Detect using something else

24

Page 25: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Kernel Objects •  Use inherent organization of the kernel •  The kernel is massive

–  Lots of structures to choose from •  Particularly focus on the connections between these objects

25

Page 26: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Processes •  A process is a container

–  Holds threads, handles, DLLs, and many other structures •  Let’s talk about threads

–  Threads are paths of execution –  Have a stack –  Work off common code base –  Can interact with other threads

•  Every process starts with one thread –  Can start more threads

•  Could have a process with no threads, but it wouldn’t do anything

26

Page 27: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Threads

27

Process Code Data

Thre

ad

Page 28: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Threads

28

Process Code Data

Thre

ad

Thre

ad

Page 29: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Threads

29

Code Data

Thre

ad

Code Data

Thre

ad

Code Data

Thre

ad

Code Data

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Page 30: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

The Kernel •  The Kernel is just another process on the system

–  Starts first –  Gets to talk to the hardware –  Schedules threads

•  Tells hardware to transfer execution to a thread for a given time •  When finished, hardware interrupts the thread

–  Allow it to store its data gracefully •  Return control to kernel

30

Page 31: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

The Kernel

31

Image Copyright © 1999 Twentieth Century Fox

Page 32: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Why Manage Thread Scheduling? •  Some threads are higher priority

–  Video playback •  Some are lower priority

–  Prefetching content –  Indexing service

•  Threads can also be interrupted by hardware –  Key press –  Network packet received

•  Thread currently executing may not handle the event

32

Page 33: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

The Kernel

33

Kernel

Hardware

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Page 34: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

The Kernel

34

Hardware

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Thre

ad

Page 35: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Windows Scheduler •  Structure used by Windows to schedule threads •  Organized by priority •  One doubly linked list for each priority level

Priority Thread Lists

35

Thread

Thread

Thread Thread

Thread

Thread Thread Thread

Thread

31

15

7

0

Page 36: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Windows Scheduler •  Lists of threads •  Each points to an ETHREAD •  Each ETHREAD points to its EPROCESS

36

Thread

Page 37: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Windows Scheduler

37

Page 38: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

The Rootkit Paradox •  Rootkits want to run •  Rootkits don’t want to be seen

•  But to have the former, they must violate the latter

•  Full paper http://tinyurl.com/rootkitparadox

38

Page 39: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

But wait, there’s more! •  File handles also point to processes •  Kernel maintains list of handles

39

List Head

Page 40: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

But wait, there’s more! •  Processes point to threads •  Network connections point to processes •  And on and on and on…

•  For an attacker to hide, they have to update everything •  We just have to validate everything

–  Any inconsistency means we win

40

Page 41: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

But wait, there’s more!

41

Page 42: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Coming Soon •  Unfortunately, no tools use either better magic or kernel objects

–  Yet

42

Page 43: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Outline •  Introduction •  The Kernel •  Direct Kernel Object Manipulation •  Standard DKOM •  Devious DKOM •  Better Magic •  Relations Between Kernel Objects •  Questions

43

Page 44: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

References •  Brendan Dolan-Gavitt, Abhinav Srivasta, Patrick Traynor, and

Jonathon Giffin, Robust Signatures for Kernel Data Structures. Proceedings of the ACM Conference on Computer and Communications Security (CCS), November 2009, http://www.cc.gatech.edu/~brendan/ccs09_siggen.pdf

•  Jesse Kornblum, Exploiting the Rootkit Paradox with Windows Memory Analysis, International Journal of Digital Evidence, Fall 2006, http://tinyurl.com/rootkitparadox

44

Page 45: Windows Memory Forensics and Direct Kernel Object Manipulation · Windows Memory Forensics and Direct Kernel Object Manipulation Jesse Kornblum . 2 Outline • Introduction • The

Questions?

Jesse Kornblum [email protected]

45


Related Documents
SQL SERVER Anti-Forensics - Black Hat · • Anti-Forensics techniques help to make forensics investigations difficult • Anti-Forensics can be a never ending game • Forensics

SQL SERVER Anti-Forensics - Black Hat · • Anti-Forensics...

Category: Documents
COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device forensics 4 Other 5 References Computer forensics Main article: computer forensics ... 1.19 Computer Forensics Solution

COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device....

Category: Documents
Windows's Kindnesses - Commoner to D-K(d)OM (Direct Kernel Object Manipulation)

Windows's Kindnesses - Commoner to D-K(d)OM (Direct Kernel.....

Category: Technology
Image Manipulation on Facebook for Forensics Evidencevision.unipv.it/CV/materiale2015-16/fifthchoice/92800047.pdf · 2016. 1. 6. · Image Manipulation on Facebook for Forensics Evidence

Image Manipulation on Facebook for Forensics...

Category: Documents
Computer forensics - Jordan University of Science and ...tawalbeh/aabfs/presentations/computer_forensics.pdf · 29.08.2006 Computer forensics 2 Computer forensics Definitions: Forensics

Computer forensics - Jordan University of Science and...

Category: Documents
Exploitation en espace noyau sous Linux 2 · 1 Le processus vu du noyau manipulation d’une tˆache manipulation de l’espace d’adressage 2 Contextes et kernel control path kernel

Exploitation en espace noyau sous Linux 2 · 1 Le processus...

Category: Documents
Is Mobile Device Forensics Really Forensics?

Is Mobile Device Forensics Really Forensics?

Category: Documents
Windows 8 Forensics & Anti Forensics

Windows 8 Forensics & Anti Forensics

Category: Technology
72 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND … · 72 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 9, NO. 1, JANUARY 2014 Data-Centric OS Kernel Malware Characterization

72 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND … · 72...

Category: Documents
Image manipulation detection - New York University …isis.poly.edu/~forensics/pubs/ImgManipulationJEI.pdfImage manipulation detection Sevinç Bayram ... lations in any portion of

Image manipulation detection - New York University...

Category: Documents
Netfilter Basics ( iptables ) - CVALEcvale.org/files/iptables/iptables.pdf · TJM 06-14-2005 What is Netfilter? Kernel package Packet filtering & manipulation (mangling) Consists

Netfilter Basics ( iptables ) -...

Category: Documents
Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Comp ter Forensics It’s NotComputer Forensics: It’s …....

Category: Documents