Forrest Orr

Red Teamer, low level coding extremist and malware researcher. Windows exploit writer and bug hunter

[Forrest Orr @_ForrestOrr]

I'm proud to release my first Google Chrome RCE derived from the most fascinating and mind bending exploit I have yet analyzed: CVE-2019-13720 Wizard Opium. This is a beautiful bug which I have crafted into an exploit bypassing ASLR, CFG and CET on Win10 https://t.co/RhMJ2nmVd4

[Forrest Orr @_ForrestOrr]

@5mukx Isnt PatchGuard an essential thing to mention in an article like this? Do you plan to make a part 2 for this?

[Forrest Orr @_ForrestOrr]

@diversenok_zero @m417z That hidden extended ProcessBasicInformation did the trick.

[Forrest Orr @_ForrestOrr]

Does anyone know what mechanisms can be used to detect suspended (non-UWP) and frozen UWP app processes, and how to programmatically wake them up in a safe and persistent way where they don't just immediately freeze again?

[Forrest Orr @_ForrestOrr]

@m417z @diversenok_zero NtPowerInformation worked for me. Of course, the UWP app goes back to being frozen the second the power handle is closed to it ie. when your own process dies. Still, a very nice trick.

[Forrest Orr @_ForrestOrr]

@vxunderground 15 not 19 ;)

[Forrest Orr @_ForrestOrr]

@sixtyvividtails I am talking here about a specific technique to obtain such a handle to a specific System process as a non admin user, normally this is globally impossible. What I wonder though is if this meets Microsoft criteria for a security boundary/elevation bug

[Forrest Orr @_ForrestOrr]

Is the ability of a non admin user to obtain a full query handle to a System integrity process and unravel its ASLR considered a security boundary? I know a PROCESS_QUERY_INFORMATION handle on a PPL is considered a breach of a security boundary even if the owner is local admin. But what about this scenario as a non admin -> System?

[Forrest Orr @_ForrestOrr]

A standard user is unable to obtain any process handle even with PROCESS_QUERY_LIMITED_INFO to any System integrity process regardless of which session it is in. It’s also unable to QI limited any process in another session regardless of integrity level. The process DACL in question locks all access (even query limited) to anyone but SYSTEM.

[Forrest Orr @_ForrestOrr]

@trickster012 @sixtyvividtails @zodiacon @GabrielLandau These events do not trigger for process suspend or resume despite existing in EtwTi. They seem to be place holders.

[Forrest Orr @_ForrestOrr]

I’m surprised to have recently learned that there does not seem to be a trivial way to receive notifications of suspended process launches in Windows via kernel proc notif callback, kernel ETW or EtwTi. Any ideas on how to do this? @zodiacon

[Forrest Orr @_ForrestOrr]

@sixtyvividtails @zodiacon @GabrielLandau Checking the ring3 call stack from a ring0 kernel process creation callback seems like the only reliable way to do this that I can think of. Timing when the main thread is resumed woild be messy

[Forrest Orr @_ForrestOrr]

@sixtyvividtails @zodiacon Brilliant insight thank you. So how is an application like Elastic populating its “created_suspended” bool field for its yara rules then? This field is criteria in various process hollowing rules from what I recall

[Forrest Orr @_ForrestOrr]

@frodosobon @zodiacon If you NtQueryInformationThread the state of the single/main thread from a create process notification routine in the kernel, it will always return state 0 (initialized). Not running, waiting, suspended etc regardless of CREATE_SUSPENDED

[Forrest Orr @_ForrestOrr]

@peterwintrsmith @shubakki I think the biggest weakness in Moneta though is false positives. A major feature that has always been needed is a JSON whitelist file where an operator or enterprise can design a profile of known false positives.

[Forrest Orr @_ForrestOrr]

Over the years I’ve been flattered to see that my tool Moneta has picked up a following in the Infosec world and I am considering reviving the project. If you are a user of Moneta, what would you improve? Which features would you add? https://t.co/XmhwhUh4jH

[Forrest Orr @_ForrestOrr]

@peterwintrsmith @shubakki I’m very glad to hear this, I’ve been shocked lately to see people using Moneta on YouTube videos about reverse engineering and forensics (since when does our little underground community have this big mainstream presence)?

[Forrest Orr @_ForrestOrr]

@shubakki @peterwintrsmith Great idea with NtContinue.

[Forrest Orr @_ForrestOrr]

@peterwintrsmith 2 and 3 are an interesting touch on Gargoyle/SleepMask techniques. The issue is that all I have are the original alloc permissions and the current ones. Malware tends to always alloc RW initially then change it, so it is of limited value to a sleeper shellcode detection

[Forrest Orr @_ForrestOrr]

@peterwintrsmith @ilove2pwn_ This change is already present, as I take it you’re referring to the ability to clone a process and nuke its working set to make its new image memory contents like unmodified?

[Forrest Orr @_ForrestOrr]

@peterwintrsmith You’re referring to addresses that have been whitelisted by CFG? For example a hollowed part of a .text section where malware wrote itself and then marked its entry point as whitelisted for CFG before launching a new thread there? Or something else?