| The DeviceIoControl mechanism is the key communication mechanism of user mode and kernel mode in Windows system. In this thesis, Kernel driver vulnerabilities of this mechanism is focused, including the detection and the exploitation of these vulnerabilities. To detect the DeviceIoControl vulnerabilities, fuzzing testing is the main technology in recent public researches, which is a black-box testing in essence and lack of the dynamic information of kernel drivers, leading to a blindness in testing. Besides, the analysis and summary of vulnerability pattern is insufficient. The exploitation of kernel vulnerabilities is different from the user mode, as the particularity of kernel mode. With the appearance of the latest exploitation mitigation technology, higher challenge is proposed in the research of exploitation techonology. In this thesis, these problems is researched, the major contents include:1. Analyse the public kernel DeviceIoControl vulnerabilities, sum the WTVTA (Write Tainted Value to Tainted Address) vulnerability pattern up, introduce the traditional static taint analysis technology into kernel drivers, define the tainted input and the propagation path in kernel drivers, propose a new static detection algorithm based on WTVTA pattern. By detecting the MS11-062vulnerability, validate the effectiveness of the new algorithm.2. Design and realize a new testing frame for kernel drivers, propose a new heuristic static algorithm to search all testing interfaces. The testing program is deployed in a virtual machine, thus the monitoring is achieved via communication between the console and the testing program. During the testing, dynamic information of kernel drivers is collected and guide the generation of the following testing cases. Kernel drivers of4famous antivirus software is chosen to apply a real testing and the result proves that the coverage of testing interfaces, the effectiveness of testing cases and the efficiency are better than traditional testing technologies. Four undiscovered vulnerabilities are found in this testing.3. Sum the exploitation technologies of WTVTA vulnerability up, including the hijacking of control flow and the construction of kernel shellcode. Besides the latest exploitation mitigation technologies are researched to find out how they truncate the traditional exploitation path. At last, new exploitation technologies are proposed against the mitigation to achieve a privilege escalation. |
