USING EMET TO DISABLE EMETUSING EMET TO DISABLE EMET

Presented byAbdulellah Alsaheel, ConsultantRaghav Pande, Research Scientist
COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Abdulellah Alsaheel• Consultant at Mandiant (A FireEye Company) Saudi Arabia, Riyadh office.
• Acted as a software developer.
• The National Company of Telecommunication and Information Security – NCTIS.
• Research focus• Software Security Assessments.
• Exploit Development.
• Malware Reverse Engineering.

2

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Raghav Pande• Researcher at FireEye, Bangalore office.
• Focus• Software Development.
• System Security.
• Automation.
• Detection Research.

3

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

WHAT IF I TOLD YOU

4COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Outlines• EMET Introduction• Previous Techniques for EMET Disabling• Techniques for EMET Evasion• Evading Hooks and Anti-Detours• Application of Evasion Research• New Technique to Disable EMET Using EMET
• Demonstration• Importance of Custom Exploit Prevention Solutions
• Q/A

5

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EMET Introduction• Microsoft’s Enhanced Mitigation Experience Toolkit (EMET)• Tool that adds security mitigations to user mode programs.
• Runs inside programs as a Dynamic Link Library (DLL).
• Uses userland inline hooking to implement mitigations.
• Makes various changes to protected programs.

6

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Detoured vs. Detouring

7

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EMET Protections• EMET 1.x, released in October 27, 2009

• Structured Exception Handling Overwrite Protection (SEHOP).
• Dynamic Data Execution Prevention (DEP).
• NULL page allocation.
• Heap spray allocation.
• EMET 2.x, released in September 02, 2010

• Mandatory Address Space Layout Randomization (ASLR).
• Export Address Table Access Filtering (EAF).
8COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EMET Protections• EMET 3.x, released in May 25, 2012

• Imported mitigations from ROPGuard to protect against Return OrientedProgramming (ROP).
• Memory Protection Checks.
• Caller Check.
• Stack Pivot.
• Simulate Execution Flow.

• Bottom-up ASLR.
• Load Library Checks.
9COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EMET Protections• EMET 4.x, released in April 18, 2013

• Deep Hooks.
• Anti-detours.
• Banned functions.
• Certificate Trust (configurable certificate pinning).
• EMET 5.x, released in July 31, 2014

• Attack Surface Reduction (ASR).
• EAF+.
10

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Previous Techniques For EMET Disabling• EMET 4.1 disable switch:• Exported global variable located at offset 0x0007E220 in emet.dll, inwritable data section. (offensive-security)• EMET 2.1 disable switch:• Exported global variable located at offset 0x0000C410 in emet.dll, also inwritable data section.

11

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Previous Techniques For EMET Disabling• EAF protection can be disabled by clearing hardware breakpoints:• CONTEXT structure with zero out its debugging registers values.
typedef struct _CONTEXT {DWORD
ContextFlags;
DWORD
Dr0;
DWORD
Dr1;
DWORD
Dr2;
DWORD
Dr3;
..
} CONTEXT;• NtSetContextThread or NtContinue can be used to set the CONTEXT tothe current thread. (Piotr Bania)
12COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Previous Techniques For EMET Disabling• EMET 5.0 disable switch:• Global variable placed on the heap within a large structure (i.e.
CONFIG_STRUCT) with the size of 0x560 bytes.
• Pointer to CONFIG_STRUCT located at offset 0x0AA84C in emet.dll• Zero out CONFIG_STRUCT+0x558 turns off most of EMET protections.
• To disable EAF and EAF+ there is unhooked pointer to
NtSetContextThread stored at CONFIG_STRUCT+0x518. (offensivesecurity)

13

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Previous Techniques For EMET Disabling• EMET 5.1 disable switch:• Global variable at offset 0x000F2A30 in emet.dll holds encoded pointervalue to some structure (i.e. EMETd).
• EMETd structure has a pointer field to CONFIG_STRUCT structure that
holds the global switch at the offset CONFIG_STRUCT+0x558.
• Since the global switch is in read-only memory page, an unhooked pointerto ntdll!NtProtectVirtualMemory stored at CONFIG_STRUCT+0x1b8 canbe used to to mark it as a writable memory page.
• Same as EMET 5.0, to disable EAF and EAF+ there is unhooked pointerto NtSetContextThread stored at CONFIG_STRUCT+0x518. (offensivesecurity)
14

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Techniques for EMET Evasion• Most used protections• Stack Pivot.
• Caller Check.
• SimExecFlow.
• EAF.

15

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Most Used Protections• Stack Pivot• Stack Switching (not new)• Custom Class (not new, observed in CVE-2015-3113)

16

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Stack Pivot• Stack Switching

17

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Custom Class• Custom Class

18

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Most Used Protections• Caller Check• Using CALL gadget (with proper destination).
• Return into shellcode.

19

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Caller Check• Using CALL Gadget• Detection Logic• Check if return address is preceded by a call.
• Check if that call is destined towards hooked API.

20

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Caller Check• Return Into Shellcode• State of Memory

21

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Most Used Protections• SimExecFlow• Double call gadget• ~20 Ret

22

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

SimExecFlow• Double Call Gadget

23

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

SimExecFlow• ~20 Return Instructions

24

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Most Used Protections• EAF• Modifying PEB• Using IAT instead of EAT25

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EAF• Modifying PEB

26

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EAF• Using IAT instead of EAT• Common targets• Msvcrt.dll• User32.dll

27

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Targeted Evasion• Easy to deploy• Hook Evasion using ROP• Product specific• Failure chances are high28

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EMET Evasion• Assumptions• ROP execution• Address of any of the following API is available• ZwProtectVirtualMemory• VirtualProtectEx• VirtualProtect• ZwAllocateVirtualMemory• VirtualAllocEx• VirtualAlloc• WriteProcessMemory• LoadLibraryA
29

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EMET Evasion• Find API address• Check if function prologue is reachable• Calculate saved prologue address from API address• JMP to saved prologue

30

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EMET Evasion

31

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

EMET Evasion• Chain required

32

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Application of Evasion Research• Exploit Detection Products• Shared Protections• Few Extra per each one• Some Modded over each other• Evasion of one protection affects others• Design flaws are unusually common

33

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Application of Evasion Research• Main Highlights• Return Address validation.
• Exception validation.
• Attack surface reduction.

34

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Application of Evasion Research• Evasion• Not so common• However Attackers are catching up• CVE-2015-2545 evading EMET
• Angler Exploit kit Evading EMET

35

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET

• At EMET.dll+0x65813 there is a function responsible for unloading EMET.

• Reachable from DllMain().

• Jumping there results in subsequent calls, which:• Remove EMET’s installed hooks.
• Zero out the debugging registers (Disabling EAF & EAF+ mitigations).

36

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET
• Prototype of DllMain :• BOOL WINAPI DllMain(_In_ HINSTANCE hinstDLL,_In_ DWORD

fdwReason,_In_ LPVOID

lpvReserved);
hinstDLL: A handle to the DLL module.
fdwReason: x00 if DLL_PROCESS_DETACH, 0x01 if DLL_PROCESS_ATTACH or 0x02 if DLL_THREAD_ATTACH.
lpvReserved: NULL if FreeLibrary has been called or the DLL load failed.

• DllMain(GetModuleHandleA("EMET.dll") , DLL_PROCESS_DETACH , NULL);• Note: GetModuleHandleA is not hooked by EMET.
37

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET

• At EMET.dll+0x27298 there is a function that removes EMET hooks.

38

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET
• struct Detoured_API {BOOL isActive;// isActive field shows the hooking status, Active: 0x1PVOID DetouredAPIConfig;// pointer to Detoured_API_Config structure

PVOID nextDetouredAPI;// pointer to the next Detoured_API structure};• struct Detoured_API_Config {PVOID DetouredWindowsAPI;// pointer to the detoured Windows API

PVOID EMETDetouringFunction;// pointer to where EMET protection implemented

PVOID DetouredFunctionPrologue; // pointer to the Windows API prologue…
};

39

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET

• Patch_Functions walks the Hook_Config linked list of structures.
• struct Hook_Config {PVOID nextHookConfig;// pointer to the next Hook_Config

BOOL isActive;// isActive field shows the hooking status, Active: 0x1

PVOID ptrEffectiveFunction; // pointer to EMETDetouringFunction or non-detoured API
PVOID DetouredWindowsAPI;// pointer to the detoured Windows API

PVOID EMETDetouringFunction;// pointer to where EMET protection implemented…
};

40

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET

• Patch_Functions memcpy:

41

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET

• Before calling Patch_Functions:• After calling Patch_Functions:42

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET
EAF & EAF+ protections• At EMET.dll+0x609D0 there is a function that zeroes out and reinitializes CONTEXT structure.
• Zero out CONTEXT structure code.

43

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET
EAF & EAF+ protections• Then it calls NtSetContextThread to disable EAF & EAF+ mitigations.

44

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMETROP Implementation• We built our ROP gadgets on top of an existing exploit for old vulnerability CVE-2011-2371.
• ROP gadgets considerations:• MZ signature is at EMET.dll base address.
• Offset to PE signature (i.e. PE_HEADER) is at EMET_BASE_ADDRESS + 0x3C.
• AddressOfEntryPoint offset is at EMET_BASE_ADDRESS + PE_HEADER + 0x28.
• DllMain() is at EMET_BASE_ADDRESS + AddressOfEntryPoint.
• Call the DllMain() with the parameters (EMET.dll base address, 0, 0).

45

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMETROP Implementation

46

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMET

• Pros:• Easy and reliable.
• Write once, and disable EMET everywhere.
• EMET (4.1, 5.1, 5.2, 5.2.0.1).
• EAF & EAF+ protections do not require a special treatment.

47

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

New Technique to Disable EMETEMET 5.5 Fix• Additional checks on the DllMain().
• Unloading code still exist at offset 0x00063ADE in emet.dll.
• Detoured_API structures and Hook_Config still exist.
• Hook_Config.EMETDetouringFunction retrieves hook address and size,
instead of the API original prologue address and size.
• memcpy.
48

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Importance of custom exploit prevention solutions• Security Through Obscurity• Not too effective, but we should not rule it out• Gives defensive measures more time
• Unknown Detection System• More advantageous• More effective telemetry• Using Multi Layered Defenses• Some products miss, some products catch.
49

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

Acknowledgments• Michael Sikorski• Dan Caselden• Corbin Souffrant• Genwei Jiang• Matthew Graeber

50

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.

THANK YOU

COPYRIGHT © 2016, FIREEYE, INC. ALL RIGHTS RESERVED.