Уровень 0 · материалов: 4
В кластер входят документы о методах обхода системных защит и эксплуатации уязвимостей памяти на уровне ядра или низкоуровневого ПО.
Общие признаки: обход DEP и ASLR, использование ROP-цепочек, поиск уязвимостей памяти, низкоуровневый доступ к системе
Группа выше: Уязвимости программного обеспечения и их эксплуатация
Смысл: The main idea is to demonstrate how manual reverse engineering and static analysis are necessary to find deep-seated memory vulnerabilities that automated fuzzers miss, and how to bypass modern Windows protections (DEP/ASLR) using ROP chains.
A technical deep-dive into discovering a buffer overflow in banking ActiveX components and bypassing DEP/ASLR using ROP and Heap Spraying.
Смысл: The main idea is to analyze the PS4's security layers—from the WebKit browser to the FreeBSD-based kernel—to demonstrate how ROP chains and system call analysis can be used to probe for vulnerabilities and bypass protections like DEP and ASLR.
A technical deep dive into PS4 security exploring WebKit exploits, ROP chain construction to bypass DEP/ASLR, and the analysis of the FreeBSD-based kernel and its sandboxing mechanism.
Смысл: The text explores how to achieve low-level hardware access on Windows by utilizing vulnerabilities in third-party signed drivers. The author demonstrates that 'proxy drivers' provided by hardware manufacturers allow users (or malware) to bypass OS security rings, enabling direct access to physical memory, I/O ports, and BIOS firmware.
The author demonstrates how to use signed third-party hardware drivers to gain unauthorized low-level access to physical memory and BIOS on Windows systems.
Смысл: The text explains the function of Intel's SMEP technology in Windows 8 and demonstrates how attackers can bypass this protection on both x86 and x64 architectures to execute arbitrary code in the kernel.
The article explains how Intel SMEP prevents kernel-mode execution of user-mode code and demonstrates bypasses using GDI palettes on x86 and ROP chains on x64.