Hack the Hacker - Fuzzing Mimikatz on Windows with WinAFL & HeatMaps

Since I presented various fuzzing workshops in 2017 I wanted to find a nice example to demonstrate fuzzing with WinAFL if source code is available. So I needed a target where I have access to source code, which would be interesting to study for students and which still have simple bugs to find. That's how I came up with the idea to fuzz mimiaktz.

You can find the the original blogpost here: Link

Bypass application whitelisting with Nvidia's node.js

On my gaming PC I noticed something interesting - Nvidia installed a NodeJS server on my system. Since I did some application whitelisting research some time ago I used it to bypass application whitelisting. Please note: From a technical perspective I could not find a more critical vulnerability in it. However, from end-user perspective I think nobody wants to have a local NodeJS server running just because Nvidia programmers wanted to code in JavaScript. When I reported this to Nvidia they immediatly fixed it.

You can find the the original blogpost here: Link

Controlling Kerio Control - When your firewall turns against you

Kerio Control is a firewall solution for small businesses. In 2016 an ex-college (Raschin Tavakoli) told me he found some interesting behavior in it and we started to dig deeper into it on the weekend. We found all kind of vulnerabilities and ultimately a really cool exploit chain. It allows to get full code execution on the firewall over the internet via a memory corruption and a CSRF bypass if one of the end-users visits a malicious website.

You can find the the original blogpost here: Link

Bypassing McAfee Application Control (Application Whitelisting)

McAfee Application Control is a security solution which implements the protection mechanism "application whitelisting". It basically creates a whitelist of installed and allowed applications and prevents the execution of new (unwanted and possibly malicious) applications afterwards.

I researched bypass techniques already in 2013 for the Kiras project in Austria (smart meter security), but could publish my results just two years later.

My research decribes various ways to bypass McAfee Application Control and Microsoft AppLocker. Most of these techniques can also be used to bypass similar products like AppSense, Microsoft DeviceGuard and so on.

I must also mention that a lot more bypass techniques were found in the last years. Most of these techniques were especially found by Casey Smith (@subTee), Oddvar Moe (@Oddvarmoe) and Matt Graeber (@mattifestation). They did an excellent job! A good summary of all these techniques can be found here: LOLBAS

Slides of my talk

English recorded talk

German recorded talk

Bypassing Microsoft EMET

I wrote my bachelor thesis on bypassing Microsoft EMET (Enhanced Mitigation Experience Toolkit). EMET is a tool which can be used to further harden the operating system and applications against memory corruption attacks. Microsoft used it to test new protections. Later these techniques were directly integrated into Windows 10 (Exploit Guard).

At the beginning I had a very broad topic for my bachelor thesis which basically was to develop exploits for different operating systems to understand how memory corruption protections can be bypassed. I roughtly implemented 200 exploits for already known vulnerabilities (e.g.: Adobe Reader, Foxit Reader, different browsers, VLC, Java and a lot of poor software) for all major operating systems available at that time (from XP SP0 up to Windows 8.1; Red Hat, Debian, ...).

Since the topic started to get too big my supervisor asked me to focus on a more specific topic and since I found a nice EMET bypass at that time I wrote about it. I later presented the technique at 31C3, however, guys at Offensive Security also found the same bypass and published there results some weeks before I gave the talk.

Here you can find the recording of the talk(it includes references to all blog posts from other researchers): Talk