NetWare kernel stack overflow exploitation

Presented at REcon 2008, June 13, 2008, 4:30 p.m. (60 minutes).

Although a lot of research has been done into exploiting remote buffer overflows in kernel mode on modern systems like Windows, Linux and BSD, there are really few publications about exploitation on other platforms which are still common in enterprise networks. The main approach in kernel mode exploitation is to inject a payload in user mode. While this method allows to reuse shellcodes and payloads it may not be the best solution when the system is kernel centric. The purpose of this presentation is to describe common and less common kernel-land exploitation techniques applied to the NetWare Operating system. As such, the focus will be on the explanation of a full kernel mode stager and of two different kernel mode stages, a shellcode and an adduser payload.


Presenters:

  • Nicolas Pouvesle
    Nicolas Pouvesle is a security researcher at Tenable Network Security where he works on vulnerability analysis and reverse engineering. While at Tenable, Nicolas has partially implemented and reversed many protocols such as SMB, Oracle, WMI, Skype . He also wrote several of the internal tools used by the Tenable research team to improve vulnerability analysis.

Links:

Similar Presentations: