The DMZ

Anonymous

10:02 PM

right im calling it a day on this issue

Anonymous

im going in circles

Anonymous

in-fact i now have another problem entirely

Anonymous

lmfao

forest

hm?

Anonymous

still tryna get this nx bypass via heapcreate to work

Anonymous

10:03 PM

but now i also have the issue that my kernelbase address calculation isnt correct every time, in-fact, i just noticed it, probably had it all along

Anonymous

so im guessing that the pointer i used is behaving weird and i need to use a different one

forest

What was the pointer to?

Anonymous

Just a random function from the targeted module on the stack.

forest

Ah so you have to correct the pointer offset? I assume you're trying to get the base address of the module?

Anonymous

Yeah, that's right.

Anonymous

10:05 PM

But I am guessing this pointer isn't so reliable for some reason or other.

Anonymous

Because it seems that my base address is not always coming back correctly. SO there's something going on.

forest

Are you sure the offset is correct?

Anonymous

Yeah, I mean, it should be.

forest

And are you sure it's a pointer to a function and not like, something created by a malloc?

Anonymous

The problem is for this challenge

Anonymous

10:06 PM

im leaking a win32 api abse address

Anonymous

not one from the application.

forest

ah

Yeah totally foreign to me.

Anonymous

so the behavior is a little different.

Anonymous

im guessing i probably just need to choose a different pointer

Anonymous

but i got all day to figure it out tomorrow. i've been working on this for like 6 hours today well, and various other note taking but

forest

10:07 PM

This is one of the reasons grsecurity made RANDSTRUCT. :P

Anonymous

Man, grsecurity seems insanely secure.

Anonymous

has anyone found anything really damaging with it in the past? surely, right? i can't imagine many times though...

forest

Damaging like, a vulnerability in grsec code?

Or do you mean grsec being used to find bugs that otherwise went undetected??

Anonymous

Yeah a vulnerability in their code.

forest

Yeah there was once, a long time ago. PaXTeam actually offered to leave because of it, but no one took his place, so he stayed. A good thing too, because he's brilliant.

Anonymous

10:10 PM

Oh wow

forest

But other than that, no. Just the rare bug in the kernel that it failed to mitigate (e.g. DirtyCoW).

Anonymous

oh man#

Anonymous

i just checked open source security careers page

Anonymous

"security researcher linux kernel"

forest

oh?

Anonymous

10:12 PM

what a cool job...

Anonymous

i want to apply, but i also dont want to and i doubt i'd get it.

forest

Yeah. They're do impressive stuff.

Well once you get really good at kernel security, you can. :P

Anonymous

Yeah :D

Anonymous

"5+ years experience in exploit development and security research, with 3+ years focused on the Linux kernel" <- already don't qualify.

Anonymous

fucking cool place to work though

forest

10:13 PM

The thing that I always like is how proactive they are with mitigating entire classes of bugs.

Anonymous

yeah i see them all over the internet fixing shit constantly

forest

Their int overflow gcc plugin completely mitigates all forms of integer overflows.

Anonymous

and a range of shit

Anonymous

its ssuper impressive.

forest

And RAP mitigates ROP and other control flow hijacking attacks.

@Jis12yearsold. They're the origin of ASLR and NX.

PaXTeam is, I mean.

As well as SMEP and SMAP (indirectly, of course).

Anonymous

10:14 PM

maybe if i work hard enough one day i xan be there :)

forest

Certainly.

Anonymous

"and international applicants welcome."

Anonymous

i like this

Anonymous

so hard to finmd this...

forest

Seems like your dream job?

Get working on kernel security and you can do it in no time.

Anonymous

10:16 PM

well i also quite want to work at project zero

Anonymous

since i was likw 12 years old

forest

They're good but they're more bling than substance.

Not to say they're not awesome, of course.

But I think they're a little overrated. They don't improve security as fast as grsec.

Anonymous

a bit of bling is nice though :D at least for a while

forest

Oh for sure.

Anonymous

its more just like

Anonymous

10:17 PM

whats the word...

forest

Google does have a good track for caring about security.

Anonymous

just like a silly childhood goal that would be really uh...

Anonymous

just like... surreal

Anonymous

yeah thats it

Anonymous

surreal.

forest

10:18 PM

ah

Anonymous

I wouldn't likely work there forever. Would just mean a lot to me to actually achieve that even for just a short while.

Anonymous

I'll be honest, I don't think I'd work anywhere forever.

Anonymous

The one time in my life I enjoy change is between companies.

Anonymous

3 years is what I feel like is a really good moving point between companies.

Anonymous

Of course, that can change but thats how I feel about it so far

Anonymous

10:20 PM

tech changes so much it feels really...

Anonymous

like you're missing out if you don't move, you know?

Anonymous

thats how it feels to me anyways

forest

What you need is to find work that you enjoy, regardless of the company.

Anonymous

Oh 100%.

forest

Then everything you do will be about the work, not the company.

Anonymous

10:21 PM

This is it for sure. Exploit development both user-space and kernel-space. I guess you kinda' gotta' start at user-space to get to kernel-space so.

forest

Of course.

Anonymous

I like writing code and reading code but I don't like doing that all day.

Anonymous

I like hacking and breaking things

forest

Exploit dev isn't exclusively about code.

Anonymous

and i think thats why i like exploit dev so much

Anonymous

10:22 PM

but i also like building things.

Anonymous

because it combines them both

Anonymous

as well as a bunch of other shit

Anonymous

but those parts are pretty key. whether its reading c or asm. or writing an exploit and trying to bypass something. it combines the elements of hacking i like the most.

forest

You should also start learning RE. I recall Brad Spengler saying something about his view that you can't design effective exploit mitigations without knowing RE.

Anonymous

Yeah, I am trying to improve at that. I mean, I am getting much better at it. There is in-fact a whole module in my course on RE.

Anonymous

10:23 PM

It is probably the trickiest skill to pick up in this entire course, but I do enjoy that side a lot because it makes you think from the developers perspective.

Anonymous

And I always liked writing code so it kinda' brings me back to that.

forest

Learn osdev, RE, grok the Linux kernel, you'll be well on your way. :P

Anonymous

I have somewhat started osdev. I mean, I am quite busy at the moment trying to get through all of this but I just finished the cross compiler section the other day

Anonymous

I might do some more tonight, actually.

Anonymous

i gotta setup some tools then i think ill be onto actually doing something like hello world and stuff

forest

10:25 PM

Another thing you can do is write patches for the Linux kernel, which will help to some extent with osdev. Add a new syscall or write a simple device driver. Or even just fix a bug.

Anonymous

See, this is the main reason I need a new job.

Anonymous

Because, I don't do anything related to this at work.

Anonymous

So I am not learning in this area, right.

Anonymous

Not when I am at work. So it's a waste of time, in that regard.

Anonymous

It's time I could spend on these things.

Anonymous

10:26 PM

Its precisely thje reason I am trying to get a new job, but I need to finish this exam first to stand a better chance since its a really competitive market.

Anonymous

I never did have much patience...

Anonymous

I still don't. But I am working as hard as I can right now.

Anonymous

well thats not true since i think i can always work harder but i also dont want to have a totla breakdown so i need to limit myself a bit

forest

Do you have enough money to quit that job and spend all your time learning?

(What is your current job anyway?)

Anonymous

I do. But, if it then takes a while to find a job, I could be a little stuck.

Anonymous

10:28 PM

My girlfriend doesn't work right now and while she is absolutely fine with working, I'd rather not put pressure on her when I have a very well paid job.

Anonymous

I just need to be patient, basically. For now, anyways.

Anonymous

I'm a pen-tester.

Anonymous

Mostly web stuff. A bit of code review sometimes.

Anonymous

And some random projects I find fun here and there.

forest

ah

Anonymous

10:30 PM

Which is precisely how I picked out these apps to RE once I have some more time after I finish this cert. Since, it would be super nice to apply for exploit dev jobs with both this cert and a cve or two :d

forest

Oh, here's a useful thing you can do to get your feet wet with kernel exploitation:

Learn to hook the syscall table. It's pretty easy and useful both for exploitation and ghetto mitigation.

Anonymous

Oh thanks. I just found a bunch of blogs on this :D

forest

A lot of the blog posts are wrong, just fyi. If you mark the table as writable by using CR0.WP rather than adjusting the page tables, make sure to disable interrupts first (cli), and re-enable them after (sti).

Anonymous

Do you have any specific recommendations for resources for kernel exploitation?

Anonymous

Or key people with good info to read from just in general.

forest

10:34 PM

Hm, there was a great github that had a lot of kernel exploitation info.

I don't remember what it was. But look for people who do write-ups about Linux kernel exploitation (I think there was a great article on the keyctl() refcount overflow).

Anonymous

Alright, thanks :D

forest

But the first thing to do is learn kernel hacking (in the original sense of the word).

Then you can learn kernel hacking (in the common sense of the word).

Example of how you can use basic kernel knowledge for simple mitigations (in this case, a trivial kernel module to kill PI-futex based exploit): gitlab.tails.boum.org/tails/tails/-/issues/18188#note_165212

Anonymous

oh tails is a super cool project to contribute to

Anonymous

definitely changing lives for the better working on that

forest

Yeah it is, although it's based on Debian which isn't ideal for security.

Anonymous

10:37 PM

those are real heroes of the modern world.

Anonymous

not fucking kim k

forest

Bloated kernel, minimal userspace hardening. But for opsec it is amazing. And it's getting better.

Anonymous

or some other celebrity idiot...

Anonymous

anyone contributing to privacy projects needs a fucking medal#

Anonymous

and a big pat on the back..

forest

10:38 PM

Agreed. Tor in particular I find to be wonderful.

Anonymous

Yeah.

Anonymous

They are good people.

forest

If you want to work with Tails, the most important thing you can work on is to support rolling upgrades.

That way they don't have to remain vulnerable while waiting a month for the next release.

(As happened with that guy who got pwnt through Totem)

Oh also, kernelnewbies.org is a good Linux kernel resource.

Anonymous

OH AWESOME!

Anonymous

Just what I was looking for. Thank you.

Anonymous

10:42 PM

This makes me a bit sad though: "but it's very hard to get a full-time Linux kernel job without a degree."

forest

Depends on what kind of job it is.

Anonymous

I wonder how true that is. I am the most nonacademic person there is.

forest

Not necessarily very true.

Maybe if you're working for Qualcomm full time to write kernel drivers, I guess.

They might demand a degree in CS or some shit.

Anonymous

Yeah, I mean, I am more planning to try and help out with finding bugs rather than writing code :D

Anonymous

I like breaking things a lot and I am much better at that.

forest

10:44 PM

Oh btw, GregKH is considered a great kernel developer, but he's rather anti-security.

Anonymous

I got my C book now though, started working on it.

Anonymous

Wait...

Anonymous

Anti-security? what?

forest

Be very, very careful not to get sucked into the common cargo-cult security mindset of many Linux devs. Go on the kernel-hardening mailing list (I think openwall hosts it).

Anonymous

Is he an idiot?

forest

10:44 PM

Not an idiot, just not focused on security.

Anonymous

But anti-security and not focused on security are very different, no?

forest

@Jis12yearsold. Basically they don't have a good security mindset. They say the best fix is to upgrade, but many of their commits that are security-related aren't marked as such, so distro kernels don't backport fixes. They sort of... "hide" security fixes.

Anonymous

@forest Oh I see.

forest

@Jis12yearsold. Anti-security in that his security advice can be harmful.

Anonymous

Not actually, "no security please"

forest

10:45 PM

Not that he thinks that insecure is better.

Anonymous

Yeah, I see what you mean now.

Anonymous

Sorry, lol.

forest

It's like security-by-obscurity lite.

Many, many kernel commits that are security related are done silently.

Not hidden, but not advertised as security-related.

Anonymous

Right.

forest

As a result, distros like Debian think "huh, no security issues yet!" while they're building up vuln after vuln, and eventually all these limited primitives can be chained together to get a real good exploit.

While GregKH is saying "lol just upgrade to the latest bleeding edge kernel every 2 days".

Anonymous

10:47 PM

Yeah, I have noticed that myself just in pen-testing.

Anonymous

Especially when going for LPEs. On *Nix machines.

forest

yup

Anonymous

You end up finding a tonne of them even on seemingly very up-to-date machines.

forest

But the great thing about Linux is it gives you the power to customize everything, so you absolutely can be secure. They just make it hard to be secure if you need to backport sec fixes.

Anonymous

I actually remember one time I did a test.

Anonymous

10:48 PM

I couldn't get root.

Anonymous

And less than a week later an LPE was published

Anonymous

haha

forest

That's one of the great things about grsecurity in my opinion is that they actually know what commits are security-related, and backport them to their stable kernels.

@Jis12yearsold. lol nice

Anonymous

@forest I do wonder why more of their work isn't just in the linux kernel?

Anonymous

Or perhaps I'm uninformed and it is...

forest

10:49 PM

@Jis12yearsold. Kernel security is a huge topic. They can't really branch out without diluting their work. Although they do some limited work elsewhere, such as modifying Chromium with full (paid) RAP, which they probably sell for $10,000 a year lol.

But 99.5% of their work is on hardening Linux, and their progress is not slowing down.

Anonymous

Oh right, that makes sense I guess.

Anonymous

I briefly recall some spat between Linus and Spengler as well?

Anonymous

I think...?

forest

Oh yeah.

Spengler is not easy to get along with.

He alienates anyone who doesn't agree with him. The thing is though, he's usually in the right.

He even got a pwnie for lamest vendor response.

Anonymous

Yeah, I guess that is the one problem with being really intelligent...

forest

10:53 PM

PaXTeam/pipacs (the other half of the "grsec team") is similar.

Anonymous

If you're always right, people don't like it.

forest

Like, he hates Kees Cook with a passion.

Mostly because Kees "steals" his work (even though it's GPL, so it's not stealing).

Same is true with other brilliant guys like Daniel Micay (behind GrapheneOS).

Anonymous

Yeah, it is the one side affect that people forget about.

Anonymous

It is all well and good to be highly intelligent but it can piss others off.

Anonymous

That must be an annoying thing to deal with.

forest

10:55 PM

To be fair, I think spender is in the wrong when it comes to how he reacts.

Anonymous

Especially if you don't mean to come across like a cunt...

forest

But it's also true that he gets a lot of shit thrown at him.

Like Linus calling his patches shit just because they do things that kernel devs find verboten.

Anonymous

Well, he's clearly doing something right because grsecurity seems like a very, very successful business and there's always someone who needs something, right.

Anonymous

No matter how others feel about it...

Anonymous

SOmeone needs that security somewhere

forest

10:57 PM

He's doing something right because him and pipacs are easily the world experts in kernel exploit mitigation. It's sad that he doesn't see it as a public good that should be kept public.

Hell, I wouldn't be surprised if him and pipacs just shut it down (if they didn't become a real business) if enough people pissed him off, and just maintained grsec/PaX in house forever. But luckily since they started it as a full business, I think that's unlikely.

Anonymous

being able to call yourself or be called a world expert in something must be so...

Anonymous

well, a feeling that very few ever can feel.

Anonymous

fuckin' awesome basically. :D

forest

Yes. These people are on the forefront of mitigation technology.

They're the only ones with full forward and backward-edge CFI that works and is fast.

Transcript for