#HITB2018AMS D2T2 - Over The Edge: Pwning The Windows Kernel

### Overview In this presentation at HITB 2018 Amsterdam, Ran Chen from Tencent Security Xuanwu Lab discusses methods for auditing, fuzzing, and exploiting the Windows kernel to escape the Microsoft Edge sandbox. The talk covers techniques for discovering vulnerabilities within the win32k subsystem and DirectX graphics kernel driver, as well as breaking sandbox boundaries using both win32k system call filtering bypasses and driver vulnerabilities.

### Key Topics - **Win32k Subsystem Analysis and Fuzzing**: Overview of win32k architecture, focusing on User and GDI objects, tracking object allocations (`HMAllocObject`, `AllocateObject`), and fuzzing object relationships and state changes. - **Unconventional Win32k Attack Surfaces**: Exploring deprecated/moved system calls in function tables (`gapfnMessageCall`, `apfnSimpleCall`), hooking user-mode callback mechanisms via the Process Environment Block (`PEB->KernelCallbackTable`), and auditing public GDI objects with owner PID 0. - **Edge Sandbox Mitigation & Bypasses**: Bypassing Edge's win32k system call filter by abusing Chakra JavaScript engine's out-of-process JIT server handle permissions, and transitioning to DirectX graphics drivers due to increased kernel mitigations like Type Isolation.

### Technical Details - **CVE-2017-8465 (Cursor Use-After-Free)**: Discovered in win32k's cursor linking mechanism (`UnlinkCursor`). Linking two cursors forms a doubly-linked list. By altering the head pointer and destroying the cursors in sequence, a dangling pointer in the first cursor is freed twice. The freed cursor memory is reclaimed using accelerator table objects, manipulating pointer references to achieve an arbitrary bit modification via `HMMarkObjectDestroy` and abusing palette primitives to gain full kernel object access. - **Chakra Out-of-Process JIT Handle Duplicate Issue**: In Edge builds with out-of-process JIT (introduced around Windows 10 Insider Build 15048), win32k filtering was not applied to the JIT server process. The Edge content process held a communication handle to the JIT server with duplicate handle permissions. An attacker could duplicate a full-access process handle from the JIT server, inject shellcode into the JIT process, and bypass win32k system call filtering completely. - **CVE-2017-8580 (Palette Use-After-Free)**: The `EngDeletePalette` function passed a shared lock count parameter that could free a palette object with a non-zero reference count. When creating a Device-Independent Bitmap (DIB), win32k creates a public palette with a shared count of 1. After querying the GDI shared handle table to locate and delete the palette, its memory was reclaimed with magnifier objects. Calling `GreSetDIBColorTable` copied data over the freed palette, achieving arbitrary read/write. - **CVE-2018-0977 (DirectX Driver Vulnerability)**: With Windows 10 RS4 introducing Type Isolation (separating metadata from GDI object headers and breaking traditional bitmap/palette exploitation primitives), focus shifted to the DirectX graphics driver. An untrusted command submitted to the driver triggered execution in a system process worker thread. By controlling `rdi` and `rax` registers without kernel CFG checks, the speaker used named pipes (`NPFS`) to spray and lay out kernel data, leveraged an unpatched kernel info leak for address calculations, and executed a ROP chain to achieve arbitrary read/write and elevation of privilege.

### Takeaways As win32k mitigations such as system call filtering and Type Isolation continue to mature, traditional GDI exploitation primitives are largely eliminated. Attackers and researchers must identify architectural flaws (such as IPC and handle management in multi-process architectures like Chakra JIT) or pivot to alternative attack surfaces like the DirectX kernel subsystem to achieve full system compromise.