Advancing BYOVD to A New Era - Lateral Movement on Microsoft Layer Kernel Virtualized Mitigation

No ratings

Presented at SecTor 2023 by

BYOVD (Bring-Your-Own-Vulnerable-Driver) has become a popular trend in recent years for attacking major security protection solutions. Wild exploits the Windows kernel by abusing vulnerable third-party drivers. For instance, the new ransomware group Cuba in late 2022 used this technique to disable antivirus detection for ransom. To prevent this type of attack on the kernel, Microsoft has implemented multiple protections in the kernel since Windows RS2 (1703), such as KASLR, KCFG, SMEP, KCET, and Hyper-V which enforce Core Isolation technology HVCI for Windows 11 to ensure that these Kernel Pwn techniques would not be exploited by RCE.However, it is not entirely secure to rely on all these kernel protections. This session discusses the new trend of weaponizing Kernel Pwn techniques originally used for RCE into LPE in the wild. It even makes "driverless BYOVD attacks" a new weaponization idea to escape the now dominant Vulnerable Driver Blocklist solution that no longer effectively defends against BYOVD attacks. Upon research, it was found that even with the latest full update of Windows 11 with 11th generation Intel CPU, the machine is still at high risk of being targeted by the ROP chain for Kernel Code Execution. For this reason, a full investigation and recon framework of Kernel Protection has been put together that can help both the blue team and the attacker to understand the protection risks that the machine is now under to allow the attacker to compromise Kernel Pwn.This talk covers the Intel paging model, the process context switch between the NT kernel and Intel CPU, and vulnerable driver arbitrary writing techniques that can be abused to run shellcode in the kernel. In the end, strategies are shared on how to properly enable these protections to ensure that enterprises are protected from this new form of kernel attack that could shut down their security solutions.