上海品茶

三个皮匠报告
上海品茶
最新
合集
英文
会议
图表
入驻
付费
new
报告
报告 合集 图表

Asia-24-VictorV-Unveiling-the-Cracks-in-Virtualization-Mastering-the-Host-System.pdf

编号：161396 PDF 35页 2.08MB 下载积分：VIP专享
下载报告请您先登录！

Asia-24-VictorV-Unveiling-the-Cracks-in-Virtualization-Mastering-the-Host-System.pdf

1、Unveiling the Cracks in Virtualization,Mastering the Host SystemVMware Workstation EscapeSpeaker:VictorV#BHASIA BlackHatEventsVMware Workstation Escape TianfuCup2018/2021/2023Zer0Con 2022HITB 2020Hyper-V EscapeCVE-2019-0887In 2021Bugs in SQLServer,RDP,QEMU,DNS,DHCP,Samba,ESXiTop 3 of MSRC 2023 Q3/Q4

2、 LeaderboardAbout Me:VictorV(vv474172261)#BHASIA BlackHatEvents目录CONTENTSVirtualization Basic InfoHistoric Bugs In UHCIExploit for TianfuCup 2023Summary#BHASIA BlackHatEventsVirtualization Basic InfoPART ONE#BHASIA BlackHatEventsVirtualization Basic InfoVMware Worksation Architecture#BHASIA BlackHat

3、EventsVirtualization Basic InfoVirtual Process Address and Guest Physical AddressGuest Virtual Address(GVA)Guest Physical Address(GPA)Host process Virtual Address(HVA)In Guest,use GVA access its physical memoryIn Host vmx,use HVA of GPA access Guest memory#BHASIA BlackHatEventsVirtualization Basic I

4、nfoVirtual Device and Guest Driver InteractionVMX processGuest SystemIO PortInsb/Inb/outb/outsbIO MemoryMap to GVA,Directly read and write#BHASIA BlackHatEventsIO port handler functionsIO Memory handler functionsVirtualization Basic InfoVM Escape and RCE exploit#BHASIA BlackHatEventssend dataCrack t

5、he structure,and leak datareceive infosend dataControl RIP,run ROPI/ORead/WriteRead/WriteUSB 1.xUHCIUSB 2.0EHCIUSB 3.xXHCIUSB 4.0FutureVirtualization Basic InfoUSB ControllerCVE-2021-22041CVE-2019-5519CVE-2019-5518CVE-2023-20870 CVE-2022-31705 CVE-2024-22252CVE-2021-22040CVE-2020-4004CVE-2020-3968CV

6、E-2017-4904#BHASIA BlackHatEventsVirtualization Basic InfoVirtual USB Controller Device Info#BHASIA BlackHatEventsVirtualization Basic InfoUHCI ControllerEjected XHCI#BHASIA BlackHatEventsVirtualization Basic InfoUHCI Controller#BHASIA BlackHatEvents0Virtualization Basic InfoUHCI Controlleru32*TD=dm

7、aAlloc(0 x10,&TD_GPA);buffer=dmaAlloc(0 x10,&buffer_GPA);frame_list0=TD_GPA|1;TD0=1;/endTD1=1 23;/activeTD2=(2 8)|(0 15)|(7 Ch=8 in Bluetooth handler#BHASIA BlackHatEventsFound by Thach Nguyen Hoang of STAR Labs,Wei and me also found it.CVE-2024-22255 Uninitialize Leakstruct urb+0h reference;+4h buf

8、fer size;+8h count size;+Ch size can read to vm;default 0.+18h endpoint;.+78h buffer start;+80h cur_buff;char bufferxxxU8(buffer,0)=0 x21;U8(buffer,1)=9;/CASEU16(buffer,6)=buffer size -8;#BHASIA BlackHatEventsFound by Wei and meCVE-2024-22253 UAFFound by me,used at TianfuCup 2023#BHASIA BlackHatEven

9、tsExploit for TianfuCup 2023PART THREE#BHASIA BlackHatEventsOld Exploit primitives-Straight outta VMware#BHASIA BlackHatEventsOld Exploit primitives-Straight outta VMwareMove to mksSandbox.exe#BHASIA BlackHatEventsOld Exploit primitives-Breakout Script of the WestworldMove to mksSandbox.exe#BHASIA B

10、lackHatEventsOld Exploit primitives-Breakout Script of the WestworldMove to mksSandbox.execant be heap#BHASIA BlackHatEventsMove into vectorExploit primitives-UHCI Endpoint#BHASIA BlackHatEventsExploit primitives-Leak address by Urb bugstruct urb.+70h vmx related process address+78h buffer start;+80

11、h cur_buff;char bufferxxx;size is determined by input sizeGet a urb heap addressGet VMX related address#BHASIA BlackHatEventsExploit primitives-R/W Everywhere by Endpoint primitive and urb#BHASIA BlackHatEventsExploit primitives-R/W Everywhere by Endpoint primitive and urb#BHASIA BlackHatEventsExplo

12、it Demo#BHASIA BlackHatEventsSummaryPART FOUR#BHASIA BlackHatEventsBugBug Research Tips TOCTOU,data of HVA can complete UAF,Notice reset operation,similar bug:cve-2020-4004ExpExploit Tips Urb to leak data Endpoint to write arbitrary anywhereDefenseDefense Escape Attack Remove unnecessary virtual dev

13、ices:Usb,Sound,CDrom Disable SVGA 3D Keep your software newestBlack Hat Sound Bytes#BHASIA BlackHatEventshttps:/census- Day Initiative Taking Control of VMware Through the Universal Host Control Interface:Part 2https:/ Host Controller Interface(UHCI)Design Guide参考#BHASIA BlackHatEventsTHANKSQ&A#BHASIA BlackHatEvents

友情提示

1、下载报告失败解决办法
2、PDF文件下载后，可能会被浏览器默认打开，此种情况可以点击浏览器菜单，保存网页到桌面，就可以正常下载了。
3、本站不支持迅雷下载，请使用电脑自带的IE浏览器，或者360浏览器、谷歌浏览器下载即可。
4、本站报告下载后的文档和图纸-无水印,预览文档经过压缩，下载后原文更清晰。

本文（Asia-24-VictorV-Unveiling-the-Cracks-in-Virtualization-Mastering-the-Host-System.pdf）为本站 （张5G） 主动上传，三个皮匠报告文库仅提供信息存储空间，仅对用户上传内容的表现方式做保护处理，对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私，请立即通知三个皮匠报告文库（点击联系客服），我们立即给予删除！

温馨提示：如果因为网速或其他原因下载失败请重新下载，重复下载不扣分。
客服
商务合作
小程序
服务号
会员动态
会员动态 会员动态：

183**14... 升级为标准VIP wei**n_...  升级为至尊VIP 

微**...  升级为高级VIP  wei**n_... 升级为至尊VIP

Be**en  升级为至尊VIP  微**... 升级为高级VIP

186**86... 升级为高级VIP Ji**n方... 升级为至尊VIP 

 188**48... 升级为标准VIP  wei**n_... 升级为高级VIP 

iam**in...  升级为至尊VIP  wei**n_...  升级为标准VIP

 135**70... 升级为至尊VIP 199**28...  升级为高级VIP

 wei**n_... 升级为至尊VIP  wei**n_... 升级为标准VIP

wei**n_... 升级为至尊VIP   火星**r...  升级为至尊VIP

139**13... 升级为至尊VIP 186**69... 升级为高级VIP

157**87...  升级为至尊VIP  鸿**...  升级为至尊VIP

wei**n_...  升级为标准VIP   137**18... 升级为至尊VIP

 wei**n_... 升级为至尊VIP wei**n_...  升级为标准VIP

  139**24... 升级为标准VIP  158**25...  升级为标准VIP

 wei**n_... 升级为高级VIP 188**60... 升级为高级VIP

Fly**g ... 升级为至尊VIP wei**n_...  升级为标准VIP

 186**52... 升级为至尊VIP  布** 升级为至尊VIP 

186**69... 升级为高级VIP  wei**n_... 升级为标准VIP

  139**98... 升级为至尊VIP 152**90...   升级为标准VIP

138**98...  升级为标准VIP  181**96... 升级为标准VIP

185**10...  升级为标准VIP wei**n_...  升级为至尊VIP

高兴  升级为至尊VIP  wei**n_... 升级为高级VIP

 wei**n_... 升级为高级VIP  阿**...  升级为标准VIP

wei**n_... 升级为高级VIP  lin**fe...  升级为高级VIP

wei**n_... 升级为标准VIP  wei**n_... 升级为高级VIP

 wei**n_...  升级为标准VIP wei**n_... 升级为高级VIP

wei**n_... 升级为高级VIP  wei**n_... 升级为至尊VIP 

wei**n_...  升级为高级VIP wei**n_... 升级为高级VIP

180**21... 升级为标准VIP  183**36... 升级为标准VIP

wei**n_... 升级为标准VIP  wei**n_...   升级为标准VIP

xie**.g...  升级为至尊VIP 王** 升级为标准VIP 

 172**75... 升级为标准VIP wei**n_... 升级为标准VIP  

 wei**n_...  升级为标准VIP  wei**n_... 升级为高级VIP

 135**82... 升级为至尊VIP  130**18... 升级为至尊VIP

wei**n_... 升级为标准VIP wei**n_...  升级为至尊VIP

wei**n_...   升级为高级VIP 130**88...  升级为标准VIP 

张川  升级为标准VIP  wei**n_... 升级为高级VIP

 叶** 升级为标准VIP wei**n_... 升级为高级VIP 

138**78...  升级为标准VIP  wu**i  升级为高级VIP

 wei**n_...  升级为高级VIP wei**n_...  升级为标准VIP

wei**n_... 升级为高级VIP  185**35...  升级为至尊VIP

wei**n_...  升级为标准VIP 186**30...  升级为至尊VIP

  156**61... 升级为高级VIP 130**32...  升级为高级VIP

136**02...  升级为标准VIP wei**n_...  升级为标准VIP

 133**46... 升级为至尊VIP  wei**n_...  升级为高级VIP

 180**01... 升级为高级VIP  130**31...  升级为至尊VIP

wei**n_... 升级为至尊VIP    微**... 升级为至尊VIP

wei**n_... 升级为高级VIP  wei**n_... 升级为标准VIP  

刘磊   升级为至尊VIP  wei**n_...  升级为高级VIP

班长 升级为至尊VIP   wei**n_... 升级为标准VIP