Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including this. Any links would be much appreciated.

Thanks.

  • 1
    Apparently Eternal Blue contained a bypass for ASLR, this is outside my area but there's a fairly extensive description in this pdf report published by Risk Sense: risksense.com/download/datasets/4353/… – iainpb Jun 14 '17 at 10:19
up vote 0 down vote accepted

From RiskSense P.19:

The ASLR bypass of the original EternalBlue exploit exploits the weakness that the HAL Heap (used by the Hardware Abstraction Layer) was static located at 0xffffffffffd00000 until Microsoft Windows 10 Redstone 2 (April 2017).

Such a region which a fixed offset is enough to bypass ASLR.

From the Risk Sense PDF (opens a PDF):

3.6.2 DEP Bypass
Starting sometime in Microsoft Windows 8/8.1 (Server 2012), the HAL Heap became non-executable. A virtual memory Page Table Entry (PTE) contains information about a memory location, such as base physical addresses, CPU ring mode, a dirty bit, and starting with the introduction of hardware-enforced DEP, a No eXecute (NX) bit at offset 63. If the NX bit is set and we attempt to move the instruction pointer to the page, a kernel panic will prevent the exploitation.

In general bypasses for ASLR rely on finding a known address. ASLR is generally a one time randomization on startup for kernel/system processes. So if you can find the address of point (structure, function, DLL, etc) then you can calculate the offsets to others that you care about.

I'm not a SME on ASLR, but that's the high level view.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.