Azure Sphere Internals - Overview

Wed, 12 Aug 2020 00:00:00 +0000

GitHub Repository: https://github.com/msuiche/ruby-square

Introduction 🔗

In May, Microsoft announced a bounty for their new IoT platform called Azure Sphere. The interesting part about it is that it’s created with security in mind, which is a much needed initiative, so we decided to take a look.

While we didn’t find any issues worth reporting, we thought it would be a waste not to share what we’ve learned. Hopefully, this will be useful for others wanting to research the platform or those considering to use it for their projects.

SMBaloo - Building a RCE exploit for Windows ARM64 (SMBGhost Edition)

Wed, 01 Jul 2020 00:00:00 +0000

SMBaloo 🔗

A CVE-2020-0796 (aka “SMBGhost”) exploit for Windows ARM64.

Because vulnerabilities and exploits don’t need to always have scary names and logos.

Acknowledgments 🔗

@hugeh0ge for his great blogpost and @chompie1337 for her excellent POC! On top of answering my questions on Twitter, their materials were really good and helped me immensely to understand the vulnerability and the exploitation part. Really HUGE kudos to both of them!
ZecOps & Michael Maltsev (@m417z) for their write-ups.
Special thanks to Stephen Ridley (@s7ephen) for being the ultimate ARM64 enabler and a great Aniki.
Barnaby (RIP), I also gave a refresh to your APC injection technique. I hope you like it, we miss you.. Alex says hi.
Thanks to Satoshi Tanda (@standa_t) and Petr Beneš (@PetrBenes) for helping me troubleshooting my original debugging set-up :)
A big thanks to Sean Dillon (@zerosum0x0) for his prior work on SMB exploitation and our brainstorming sessions :)
Laurent Gaffie (@PythonResponder) for his prior work on SMB.
The NSA for developing (or buying) (and leaking? Cheers to TheShadowBrokers) ETERNALBLUE and DOUBLEPULSAR, that exploit is soon gonna be 10 years old… it almost feels like nothing new got released since then.
Microsoft Platform Security Assurance & Vulnerability Research for finding CVE-2020-0796.
Nicolas Economou (@NicoEconomou) and Alex Ionescu (@aionescu) for their publications on HAL stuff.
Nikita Karetnikov (@karetnikovn) for the ARM ninjutsu.
Souhail Hammou (@Dark_Puzzle) for making fun of APC ETW.
And the OPCDE community for the continuous support! Join us on Discord or go on our website if the link is dead :)

Introduction 🔗

Do not use this for anything else other than educational purposes, this was only tested on the only ARM64 machine (Windows 10 18362 ARM 64-bit (AArch64)) that I had a direct access to. I have been happy enough that it was running consistently against it. Make sure that KB4551762 is not installed if you do some tests. I’m gonna try to make this write-up as readable as possible even if you have limited experience with exploit development, if you have any questions - do not hesitate just to come on Discord to ask them on the OPCDE Discord server.

Software on Matt Suiche

Azure Sphere Internals - Overview

Introduction 🔗

SMBaloo - Building a RCE exploit for Windows ARM64 (SMBGhost Edition)

SMBaloo 🔗

Acknowledgments 🔗

Introduction 🔗