1. InfoconDB
  2. Black Hat
  3. Black Hat USA 2021
  4. Crashing Your Way to Medium-IL: Exploiting the PDB Parser for Privilege Escalation

Crashing Your Way to Medium-IL: Exploiting the PDB Parser for Privilege Escalation

Presented at Black Hat USA 2021, Aug. 5, 2021, 10:20 a.m. (40 minutes)

If you have ever done Windows debugging or crash dump analysis, you must be familiar with PDB files. These files store debugging information (or 'symbols') about a program, and are parsed by debuggers such as WinDBG and Visual Studio. Researching the parser for those files, implemented by DbgHelp.dll, I discovered several memory corruption vulnerabilities.

One attack surface for triggering these vulnerabilities is serving malformed PDBs through a remote symbol server to a debugger. I reported the issue to Microsoft MSRC, and they decided it doesn't meet the bar for security servicing because the attack surface is too complex. This led me to discover another attack surface, allowing me to use the exact same parsing bug for escalating privileges locally (fixed as CVE-2021-24090). I created a full exploit demonstrating a low-IL process gaining medium-IL privileges.

In this talk, I will describe the vulnerability discovery process and then go into detail about how the bug can be exploited. The exploit bypasses several OS-level mitigations such as ASLR, Heap hardening and CFG.


Presenters:

  • Gal De Leon - Principal Security Researcher, Palo Alto Networks
    Gal De Leon is a principal security researcher at Palo Alto Networks Anti-Exploit team. His main focus is vulnerabilities, exploits, and mitigations. He discovered dozens of vulnerabilities in Windows OS, Office, and Adobe Reader, both by reverse engineering and fuzzing. He was recognized as Microsoft MSRC most valuable security researcher for 2018, 2019 and 2020.

Links: