Eternal blue Vulnerability

This is the presentation prepared my Post Grad students, Macquarie University.

1. ETERNAL BLUE Romance Kandel Suresh Lamichhane Dhiraj gajurel Pratikar uprety

2. ETERNAL BLUE

3. Variations Eternal Romance Eternal Champion Eternal Rocks Eternal Synergy

4. Impact Wannacry Not Petya Bad Rabbit Olympic Destroyer Baltimore Ransomware

5. SMB Server Message Block 1983 - Invented by Barry Feigenbaum (IBM) Used by windows as file sharing protocol Extensible protocol e.g. psexec Vulnerability was in SMBv1 serv.sys driver

6. SMBv1 Internals

7. Context

8. The Bugs

9. Bug A

10. Extended Attributes Metadata attached to files Name/ Value key pair OS/2 v1.2 Joint Microsoft/IBM OS EA concept introduced and had HPFS Windows NT OS for server and workstation NTFS No much extended attributes. They have alternate data streams WSL EA for permissions and case sensitivity

11. FEALIST structure SMB_FEA_LIST { ULONG SizeOfListInBytes ; UCHAR FEAList []; }

12. Exploitation Set the size for SizeOfListInBytes as 0x10000. craft 607 SMB_FEA structures appended one after another such that: 605 empty packets occupying 5 bytes. 606 th packet occupying (0xf383 + 5) bytes and 607 th packet of size (0xa8 + 5) bytes While converting OS2 Fea to NT format there is a wrong casting error for total count of bytes. From ULONG to USHORT. SrvOs2FeaListSizeToNT function This bug instead of shrinking the SizeOfListInBytes to correct size enlarges it causing Out of Bound write. If the response is status 0xC000000D, then it signifies the overwrite is successful.

13. Bug B

14. SMB TRANSACTION Transaction messages of interest SMB_COM_TRANSACTION (or Trans) SMB_COM_TRANSACTION2 (or Trans2) SMB_COM_NT_TRANSACT (or NT Trans) Each sub-command has a corresponding sub-command _SECONDARY used when data is too big for single packet.

15. Exploitation Difference in amount of maximum data between Trans2 and NT Trans. Parsing is according to last transaction type. No validation which for which function started the transaction. Possible to send Nt Trans followed by Trans2_SECONDARY leads to bug A by treating DWORD as WORD since both different transaction data are parsed incorrectly.

16. Bug C

17. Session Setup Allocation Error Two ways to login to SMB NT Security & Extended Security 13 words vs 12 words Certain flag values can confuse it Reads SMB_DATA_BLOCK size at wrong offset Can reserve large memory Free on demand ○ Close client socket

18. Exploitation heap is sprayed but this time with  srvnet!SRVBUFFER  objects using the SMBv2 protocol Send primary grooms with the FEAList in it except the last one. Send naked SMB as grooms for new pools allocation. Send session setup allocation buffer Send a session setup hole buffer Close allocation connection. Send secondary grooms Send the final FEALIST exploit fragments such that it is calculated to fit in the hole but overflows to adjacent groom.

19. Final Exploit SRVBUFFER contains MDL and srvnet!SRVNET_CONNECTION object. Both pointers are overwritten so that they point to fixed addresses in the HAL region. Because of the corrupted MDL pointer, the next packet payload will get written to the HAL region which contains shell code. HAL region is marked as readable, writable and executable.

20. Mitigation Install the MS17-010 security update MS17-010 only changed the type from short to lo ng SrvOs2FeaListSizeToNt(): SmbPut Ushort (& FeaList -> cbList , PTR_DIFF_ SHORT ( fea , FeaList )); Became SrvOs2FeaListSizeToNt(): SmbPut ULong (& FeaList -> cbList , PTR_DIFF_ LONG ( fea , FeaList ));

21. References https://www.virusbulletin.com/uploads/pdf/magazine/2018/201806-EternalBlue.pdf https://www.microsoft.com/security/blog/2017/06/16/analysis-of-the-shadow-brokers-release-and-mitigation-with-windows-10-virtualization-based-security/ https://research.checkpoint.com/eternalblue-everything-know/#bugb