《Asia-24-VictorV-Unveiling-the-Cracks-in-Virtualization-Mastering-the-Host-System.pdf》由会员分享，可在线阅读，更多相关《Asia-24-VictorV-Unveiling-the-Cracks-in-Virtualization-Mastering-the-Host-System.pdf（35页珍藏版）》请在三个皮匠报告上搜索。

1、Unveiling the Cracks in Virtualization,Mastering the Host SystemVMware Workstation EscapeSpeaker:VictorV#BHASIA BlackHatEventsVMware Workstation Escape TianfuCup2018/2021/2023Zer0Con 2022HITB 2020Hyper-V EscapeCVE-2019-0887In 2021Bugs in SQLServer,RDP,QEMU,DNS,DHCP,Samba,ESXiTop 3 of MSRC 2023 Q3/Q4

2、 LeaderboardAbout Me:VictorV(vv474172261)#BHASIA BlackHatEvents目录CONTENTSVirtualization Basic InfoHistoric Bugs In UHCIExploit for TianfuCup 2023Summary#BHASIA BlackHatEventsVirtualization Basic InfoPART ONE#BHASIA BlackHatEventsVirtualization Basic InfoVMware Worksation Architecture#BHASIA BlackHat

3、EventsVirtualization Basic InfoVirtual Process Address and Guest Physical AddressGuest Virtual Address(GVA)Guest Physical Address(GPA)Host process Virtual Address(HVA)In Guest,use GVA access its physical memoryIn Host vmx,use HVA of GPA access Guest memory#BHASIA BlackHatEventsVirtualization Basic I

4、nfoVirtual Device and Guest Driver InteractionVMX processGuest SystemIO PortInsb/Inb/outb/outsbIO MemoryMap to GVA,Directly read and write#BHASIA BlackHatEventsIO port handler functionsIO Memory handler functionsVirtualization Basic InfoVM Escape and RCE exploit#BHASIA BlackHatEventssend dataCrack t

5、he structure,and leak datareceive infosend dataControl RIP,run ROPI/ORead/WriteRead/WriteUSB 1.xUHCIUSB 2.0EHCIUSB 3.xXHCIUSB 4.0FutureVirtualization Basic InfoUSB ControllerCVE-2021-22041CVE-2019-5519CVE-2019-5518CVE-2023-20870 CVE-2022-31705 CVE-2024-22252CVE-2021-22040CVE-2020-4004CVE-2020-3968CV

6、E-2017-4904#BHASIA BlackHatEventsVirtualization Basic InfoVirtual USB Controller Device Info#BHASIA BlackHatEventsVirtualization Basic InfoUHCI ControllerEjected XHCI#BHASIA BlackHatEventsVirtualization Basic InfoUHCI Controller#BHASIA BlackHatEvents0Virtualization Basic InfoUHCI Controlleru32*TD=dm

7、aAlloc(0 x10,&TD_GPA);buffer=dmaAlloc(0 x10,&buffer_GPA);frame_list0=TD_GPA|1;TD0=1;/endTD1=1 23;/activeTD2=(2 8)|(0 15)|(7 Ch=8 in Bluetooth handler#BHASIA BlackHatEventsFound by Thach Nguyen Hoang of STAR Labs,Wei and me also found it.CVE-2024-22255 Uninitialize Leakstruct urb+0h reference;+4h buf

8、fer size;+8h count size;+Ch size can read to vm;default 0.+18h endpoint;.+78h buffer start;+80h cur_buff;char bufferxxxU8(buffer,0)=0 x21;U8(buffer,1)=9;/CASEU16(buffer,6)=buffer size -8;#BHASIA BlackHatEventsFound by Wei and meCVE-2024-22253 UAFFound by me,used at TianfuCup 2023#BHASIA BlackHatEven

9、tsExploit for TianfuCup 2023PART THREE#BHASIA BlackHatEventsOld Exploit primitives-Straight outta VMware#BHASIA BlackHatEventsOld Exploit primitives-Straight outta VMwareMove to mksSandbox.exe#BHASIA BlackHatEventsOld Exploit primitives-Breakout Script of the WestworldMove to mksSandbox.exe#BHASIA B

10、lackHatEventsOld Exploit primitives-Breakout Script of the WestworldMove to mksSandbox.execant be heap#BHASIA BlackHatEventsMove into vectorExploit primitives-UHCI Endpoint#BHASIA BlackHatEventsExploit primitives-Leak address by Urb bugstruct urb.+70h vmx related process address+78h buffer start;+80

11、h cur_buff;char bufferxxx;size is determined by input sizeGet a urb heap addressGet VMX related address#BHASIA BlackHatEventsExploit primitives-R/W Everywhere by Endpoint primitive and urb#BHASIA BlackHatEventsExploit primitives-R/W Everywhere by Endpoint primitive and urb#BHASIA BlackHatEventsExplo

12、it Demo#BHASIA BlackHatEventsSummaryPART FOUR#BHASIA BlackHatEventsBugBug Research Tips TOCTOU,data of HVA can complete UAF,Notice reset operation,similar bug:cve-2020-4004ExpExploit Tips Urb to leak data Endpoint to write arbitrary anywhereDefenseDefense Escape Attack Remove unnecessary virtual dev

13、ices:Usb,Sound,CDrom Disable SVGA 3D Keep your software newestBlack Hat Sound Bytes#BHASIA BlackHatEventshttps:/census- Day Initiative Taking Control of VMware Through the Universal Host Control Interface:Part 2https:/ Host Controller Interface(UHCI)Design Guide参考#BHASIA BlackHatEventsTHANKSQ&A#BHASIA BlackHatEvents