Quote:

By connecting to a malicious SMB server, a vulnerable Windows client system may crash (BSOD) in mrxsmb20.sys

Blocking outbound SMB connections – TCP ports 139 and 445 along with UDP ports 137 and 138 – from the local network to the wide area network…..said US CERT

Reminder: Mrxsmb20.sys driver handles SMB 2.0 and SMB 3.0 traffic.

Windows OS design objective: In Windows 8, the SMB 3.0 protocol is supported. The Mrxsmb10.sys driver handles legacy SMB traffic, and the Mrxsmb20.sys driver handles SMB 2.0 and SMB 3.0 traffic.

Phenomenon: We have confirmed that without apply the patch on May those Windows 10 , Windows 8.1 client systems as well as the server equivalents of these platforms, Windows Server 2016 and Windows Server 2012 R2 are all encountered SMB vulnerability. In the sense that it is vulnerable.

Current Situation 1: If you are windows OS home user (all windows OS platform), be aware and confirm apply below hot-fix to your home workstation.

https://technet.microsoft.com/en-us/library/security/ms17-012.aspx

Current Situation 2:If you are IT guy maintained whole bunch of MS windows server. You are the technical expert and believed that the hotfix you apply already. But I would like to bring your attention of on server SMB registry.

What’s the reason to point out the SMB registry. It is a quick way to isolate the problem once you suspect that you file server may encounter malicious attack. As a matter of fact, registry check is one of the fast path know what is happen in malware movement.

Regarding to the subject matter, our objective is going to discuss how to rescue yourself this month due to SMB flaw, right? I written an techincal article yesterday mainly highlight the SMB flaw. For more details, please find below url for reference.

Does SMB mess up the world? But he is sick always! …Wanacrypt0r, SMB worm,…etc

Any information update will keep posted. Thank you for your kind attention.

Preface:

Ransomware (#wanacrypt0r #wannacry #ransomware #wcry) outbreak since last Friday 12th May 2017 till this week. Believed that no room discuss here since you are easy to get the information update on internet. However SMB is our discussion topic today. As we know SMB ver 1 is the culprits of Wanacrypt. The side effect looks only affected outdated windows OS (2003,XP,Me and Vista) or recently end of support product (Windows 2008 instead of 2008 R2)! In the meantime, do you have issue to worry like myself on SMB version 2 and version 3?

SMB critical flaw historical background:

Vulnerability in Microsoft Windows SMB2 -_Smb2ValidateProviderCallback()  flaw found 2009.

On August 11, 2015 Microsoft released  SMB Server fix on SMB (MS15-083 – Microsoft Windows SMB Memory Corruption Vulnerability). An authenticated remote code execution vulnerability exists in Windows that is caused when Server Message Block (SMB) improperly handles certain logging activities, resulting in memory corruption. A successful exploit could corrupt memory in such a way as to allow the attacker to execute arbitrary code. A successful exploit could result in a complete system compromise.

SMB architecture

The structure of the header is as follows:

SMB_Header
   {
   UCHAR  Protocol[4];
   UCHAR  Command;
   SMB_ERROR Status;
   UCHAR  Flags;
   USHORT Flags2;
   USHORT PIDHigh;
   UCHAR  SecurityFeatures[8];
   USHORT Reserved;
   USHORT TID;
   USHORT PIDLow;
   USHORT UID;
   USHORT MID;
   }

Why SMB always encounter vulnerabilities? Why old version of SMB need to stay on windows OS?

NSA surveillance  tool kit named EternalBlue exploits a vulnerability on SMB. From my personal point of view, not surprise! Since no operation systems are prefect, right! But the earliest time SMB encountered flaw was back time to 2009. A flaw was found on Microsoft SRV.SYS Driver. The symptom exploit that a Remote Code Execution vulnerability in Microsoft SMB Servers (WriteAndX Invalid DataOffset).

Remark: Srv.sys is a Windows driver. A driver is a small software program that allows your computer to communicate with hardware or connected devices. This means that a driver has direct access to the internals of the operating system, hardware etc (see below picture for reference). Microsoft suggest that Srv.sys should be set to start on demand since it is only communicate with old fashion client such as windows XP.

Command: sc config srv start=demand

Regarding to security vendor Rapid 7 findings on 2009, Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table exploits an out of bounds function table dereference in the SMB.

Looks irritating, we are not going to post all the flaws. But I am interested that is there something get wrong from fundamental design causes such non stop vulnerability. As far as I know, all SMB family are easy to causes vulnerable. Even though SMB3! An official announcement by Microsoft highlight that transferring files by using SMB2 or SMB3 causes memory leak on a windows computer (see below url for reference). And then Microsoft issued a hotfix held on 2017.

https://support.microsoft.com/en-us/help/2928360/transferring-files-by-using-smb2-or-smb3-causes-memory-leak-on-a-windows-computer

Our Observation:

Take the latest reference as an example. See how the weakness of SMB. Yes, it is not a SMB2 or 3.  Since SMB2 and SMB3 obtain their own design weakness on memory validation (see above description). OK, Let’s go. We start the journey.

Equation Group’s (NSA) wake up all the IT guys, attacker can easy initiate a Ring 0 attack relies on SMB. They  took below action:

1. Determine x86 or x64
2. Confirm and locate the IDT(Interrupt Descriptor Table) from the KPCR( (Kernel) Processor Control Region).
3. Viewing Physical Memory Addresses in OllyDbg, Traverse backward from memory address. That means from end return to 1st interrupt handler to find ntoskrnl.exe base address.

• If the beginning of the file does not begin with “MZ” or “ZM”, it is not an DOS or Windows executable image. Otherwise you may have one of the following types of executable formats: plain DOS, NE (Windows 16-bit), LE (16-bit VXD), PE32, or PE32+ (PE64).
• Determine if you have a plain DOS executable by looking at the e_lfanew value. A plain DOS executable will have an out-of-range e_lfanew pointing outside of the limits of the file, a zero, or if the offset happens to be in range, the signature at its offset won’t match any signatures below.
• Try to match the signature of the “in-range” offset pointed to by e_lfanew with the following WORD or DWORD values:

  "PE" followed by two zero bytes if the image is a PE32 or PE32+ (PE64) and is further determined by the "magic" in the NT Optional Header
  "NE" indicates the image is a 16-bit Windows executable
  "LE" indicates the image is a 16-bit Virtual Device Driver (VXD)
  

5. Reads ntoskrnl.exe’s exports directory, and uses hashes to find ExAllocPool/ExFreePool/ZwQuerySystemInformation functions.

Remark: If you would like to call ZwQuerySystemInformation, a parameter need attach with the command. You must input buffer as size of SYSTEM_PROCESS_INFORMATION. And then checking the return value and return requied size. If the return is not success, you must make the second call with input buffer of requied size (i.e.size return from the first call).

6. Calls ZwQuerySystemInformation with the SystemQueryModuleInformation argument, which loads a list of all drivers. It uses this to locate Srv.sys, an SMB driver.

7. Switches the SrvTransactionNotImplemented() function pointer located at SrvTransaction2DispatchTable[14] to its own hook function.

Remark: Npp buffer + 0x100 directly written before the leak out of the function table

Above scenario happen SMB or SMB v1 only.  But when we know SMB2 and SMB3 also found vulnerability on memory side.  My research is on the way, my friend I will keep you posted if there is anything updating.

Preface:

As we known, computer process direct work with Kernel (Ring 0) is quite dangerous. More realistic to say is that Real mode, also called real address mode, is an operating mode of all x86-compatible CPUs. Real mode provides no support for memory protection, multitasking, or code privilege levels. Windows 95 executes drivers and process switching in ring 0, while applications, including API DLL such as kernel32.dll and krnl386.exe are executed in ring 3.

We found trick on Windows 10. For instance,  you are allow to run 16 bit application on 32 bit (Window 10) operating system. But not allow to run 16 bit application on 64 bit (Windows 10) OS.

Why? A processor limitation of 64 bit OS to execute (non-protected mode) 16-bit code. The 64-bit versions of Windows include 32-bit protected mode runtime libraries, but do not include any 16-bit protected mode runtime libraries. But how’s the mystery allow execute a Dos command prompt on 64-bit (Windows 10)OS? The Dos emulator make the magic.

The kernel of windows 10 is located at top of memory. The 64 bit OS of memory support 3.5GB RAM above, hacker have difficulties to find out the kernel process finger print in memory. Apart from that, the 64 bit operating system Kernel executable not direct reachable! Since it can’t communicate with kernel directly. Therefore a common criteria consensus 64 bits OS is malware proof.

Have you heard the weakness of superman? Kryptonite are able to reduce his power?

The origin story of Superman relates that he was born on the planet Krypton. Kryptonite is a radioactive mineral from Krypton. It was produced during explosion of Krypton. Kryptonite are able to reduce superman power. A similar scenario of 64 bit OS system. Since Kernel executable not reachable. However PAGE TABLE is loaded below 4GB. So it is possible to do the follow concept to unlock windows 10.

Viewing and Editing Registers in WinDbg

Solution: Self-ref entry technique

Reference: In 32 bits, this entry is usually located in the PAGE DIRECTORY, even with PAE enabled.
In 64 bits, this entry is located in the PML4

• CPU CR3 register point to physical address (PA) of PML4
• PML4(entry) point to PA of PDPT
• PDPT(entry) point to PA of PD
• PD(entry) point to PA of PT
• PT contains Page Table Entries

As a result a re-used entry in the four paging levels, which means that this is used by the CPU as PML4 entry, PDPT entry, Page Directory entry and Page Table entry at the same time.

Busy this week, allow for me to complete the remaining part next week, Sorry!