Sign in to confirm you’re not a bot
This helps protect our community. Learn more

Why so Spurious? Achieving Local Privilege Escalation on Operating Systems

Black Hat
240K subscribers
<__slot-el>
<__slot-el>
1K views 5 years ago
There exists a "feature" in the x86 architecture that, due to improper programming by many operating system vendors, can be exploited to achieve local privilege escalation. At the time of discovery, this issue was present on the latest-and-greatest versions of Microsoft Windows, Apple's macOS, and certain distributions of Linux. This issue, very likely, impacts other operating systems on the x86 architecture. By Nemanja Mulasmajic + Nicolas Peterson Full abstract and materials: https://www.blackhat.com/us-18/briefi... ...more
...more

INTERRUPTS AND THE IDT

8:43

THE STACK WHEN AN INTERRUPT OCCURS

9:39

THE INT 1 HANDLER KIDEBUGTRAPORFAULT

12:55

MOV/POP SS

14:28

Discovered it while building VM detection mechanisms What if a VMEXIT occurs during a blocking period?

16:33

SO, WHAT HAPPENS? 2 The INT 3 executes in the context of

19:52

Opcode Instruction

27:28

QUICK RECAP

27:46

INITIAL WEAPONIZING

29:21

MORE CHALLENGE... • CPU does the driver loading

34:07

THE SYSCALL HANDLER KISYSTEMCALL64

36:38

SYSCALL FUNCTIONS SIMILAR TO INT 3 2

37:44

MICROSOFT'S FIX

46:20

LESSONS LEARNED

47:40
Why so Spurious? Achieving Local Privilege Escalation on Operating Systems
25Likes
1,059Views
2020Jan 14
There exists a "feature" in the x86 architecture that, due to improper programming by many operating system vendors, can be exploited to achieve local privilege escalation. At the time of discovery, this issue was present on the latest-and-greatest versions of Microsoft Windows, Apple's macOS, and certain distributions of Linux. This issue, very likely, impacts other operating systems on the x86 architecture. By Nemanja Mulasmajic + Nicolas Peterson Full abstract and materials: https://www.blackhat.com/us-18/briefi...

Follow along using the transcript.

Black Hat

240K subscribers