Here it is, Stage 3, the last stage of HENkaku.
This was by far the toughest to crack, so, let's dive in!
This was by far the toughest to crack, so, let's dive in!
HENkaku - Stage 3
In Stage 2, we analyzed how HENkaku exploits two distinct kernel bugs to achieve code execution: a memory leak bug (in the sceIoDevctl function) to defeat KASLR and a use-after-free (in the sceNetIoctl function) to break into the kernel and do ROP.
However, since the execution flow switches over to a ROP chain planted into the kernel, we still couldn't figure out what was happening next.
Like I mentioned in the previous write-up's ending note, dumping the kernel (more specifically, the SceSysmem module) was now necessary. Team molecule did not provide any additional vulnerability that we could use for this purpose, so, it was up to the participants to figure it out themselves.
I had already found a potential memory leak vulnerability while playing around with Stage 2 but, unfortunately, due to it's nature (out-of-bounds read) it wasn't enough to reach the SceSysmem module.
Frustrated, I began looking for other plausible entry-points. It took me several attempts and required analyzing several key components of the Vita's system:
- Network:
The SceNet module was the origin of the use-after-free and I had already an OOB read there, so, what else could be in there?
- Filesystem:
The SceDriverUser module exposes a decent amount of unique system calls for the filesystem. Some of them crash. Can I leak memory here?
- Audio:
Developers don't pay much attention to security when it comes to implement media handling. Some specific audio handling features are taken care by the kernel itself. Can I compromise it?
- Graphics:
Just like with audio, graphics are a common source of flaws. The Vita has plenty of libraries with unique system calls for this (SceGpuEs4User, SceGxm, ScePaf). Will this help?
- Application:
User applications are managed by modules that heavily communicate with the kernel (SceAppUtil and SceDriverUser via SceAppMgr calls). Perhaps this can be taken down?
Eventually, one of those gave me what I wanted and I was able to dump the entire Vita's kernel memory. After locating the SceSysmem module among the dumped binaries I became able to solve the rest of the challenge.
On a side note, I did attempt blind ROP at first by relocating a few gadgets and taking wild guesses, but team molecule made sure it wouldn't be that easy. The gadgets' placement makes it very difficult to predict what each one will do.
Anyway, here is the result:
So, random comments and mistakes aside, this gives us a clear view of what the kernel ROP chain is doing:
If you recall, the kernel loader was an encrypted chunk of 0x100 bytes that was appended to the bottom of the ROP chain we copy into a kernel stack using sceIoDevctl:
- // NULLs for padding at the bottom of the chain
0x00(x_stack + 0x00008D7C) = 0x00000000;
0x00(x_stack + 0x00008D80) = 0x00000000;
0x00(x_stack + 0x00008D84) = 0x00000000;
// Code starts here
0x00(x_stack + 0x00008D88) = ...;
The kernel ROP decrypts this chunk using AES-256-ECB and the key is a piece of code from SceSysmem itself.
This is what the kernel loader looks like (note that base offset is set to 0x00000000):
In sum, the loader allocates two memory blocks, one for data and another for code. Then it fetches the HENkaku's payload from user memory (using copy_from_user) and decrypts it in place using a static key (stored inside the kernel loader binary data). Finally, it copies the decrypted payload into an executable memory block, set's PC and SP and jumps to it.
Now we have HENkaku running on our system!
As proof, here are the SHA-1 hashes of the two crucial keys for the entire process:
Kernel loader key (AES-256-ECB): f1a8e9415bf3551377a36a1a5b25ba64f2d96494
Kernel payload key (AES-128-ECB): eacac4a780065c8c106349e412696aabd1b1b8d1
And that's it! This concludes the final stage of the HENkaku's KOTH challenge.
I don't plan on dwelving much into how I leaked the kernel's memory and I don't plan on releasing the keys themselves out of respect for other groups attempting to complete the challenge and for the developers themselves.
I believe the goal of this challenge was not to simply crown the first person to crack HENkaku, but to get the whole community engaged and bringing new ideas to the table.
By not releasing the decrypted binaries or the method I used to leak memory, others still have the chance to solve the challenge themselves.
I may publish a few more posts detailing some interesting features of the HENkaku's payload, but I will leave the full source code reveal to the developers themselves.
Until next time!
First
ReplyDeleteCongratz!
ReplyDeleteWow congratz!!!
ReplyDeletewow congrats nice nice
ReplyDeleteWow amazing!!!
ReplyDeletecongratulations....
ReplyDeleteAmazing job 😨
ReplyDeleteAmazing job 😨
ReplyDeleteImpressive work, was indeed the hardest part of the reversing.
ReplyDeleteLooking forward to read your next updates.
Kudos!
And here are the True Heroes, Congratulations.
ReplyDeleteI never imagined that someone would reach it this far.
Greatings.
Howdy. Trying to follow through this from a starting point of running some custom userland code, I'm not seeing:
ReplyDelete1) What the purpose of calling sceIoOpen("molecule0:") is. Seems like there's an important missing piece here, and what about the state of r1 and r2 for this call?
2) Any data being leaked from sceIoDevctl calls. Although it's returning a mysterious error code, nothing is modified in the output buffer.
Could you fill in any relevant blanks? TIA!
It was an interesting read, keep up the good work!
ReplyDeleteThanks for the informative and helpful post, obviously in your blog everything is good..
ReplyDelete성인웹툰
Its an amazing website, really enjoy your articles.
ReplyDeleteYoure so right. Im there with you. Your weblog is definitely worth a read if anyone comes throughout it
ReplyDelete
ReplyDeleteIm lucky I did because now Ive received a whole new view of this
That is a good tip especially to those new to the blogosphere. Brief but very accurate info…
ReplyDeleteMany thanks for sharing this one. A must read article!
ReplyDeleteGreat Post for Beginner to understand.
ReplyDeleteYou make so many great points here that I read your article a couple of times.
ReplyDeleteI appreciate your skills and style in elaborating on the topic.
ReplyDeleteThank you for sharing this fascinating information. Best of luck.
ReplyDelete
ReplyDeleteYour creative writing abilities inspired me to get my own blog now Thank you.
I like the helpful information that provide in articles. Keep doing it.
ReplyDeleteThis blog is very informative the stuff you provide I really enjoyed reading
ReplyDelete
ReplyDeleteYou really amazed me with your writing talent
ReplyDeleteI truly like your way of blogging. I bookmarked it to my bookmark website list.
Extremely useful info particularly the final section 🙂 I take care of such info a lot.
ReplyDeleteI was looking for this certain info for a long time. Thanks and best of luck.
ReplyDeleteMy brother recommended I might like this web site. He was entirely right.
ReplyDeleteThis post truly made my day. Thanks!
ReplyDeleteYou can not imagine just how much time I had spent for this info!
ReplyDeleteI have read some just right stuff here.
ReplyDeleteI surprise how so much attempt you put to create this kind of wonderful informative site.
ReplyDeleteYour site is so cool. I am impressed by the details that you? Ive on this website.
ReplyDeleteWill without a doubt come and visit this blog all the more frequently.
ReplyDeleteIts an amazing website, really enjoy your articles. Helpful and interesting too.
ReplyDeleteIts wonderful as your other articles : D, regards for posting .
ReplyDelete
ReplyDeleteThanks again for a great article!
This is very well written and your points are well-expressed.
ReplyDeleteValuable information. Quality content is good.
ReplyDeleteThis blog carries amazing and genuinely data.
ReplyDeleteExcellent stuff! Thanks for sharing this one!
ReplyDeleteThank you for your post, I look for such article along time, today I find it finally.
ReplyDeleteThis is so much hilarious blog, Anyways thanks for posting ideas.
ReplyDeleteVery informative and well-written post! Greatjob for your hardwork man!
ReplyDeleteI am appreciative of the fact that you have shared this knowledge with us.
ReplyDeleteDefinitely a good blog is very good. Thank you for sharing.
ReplyDelete
ReplyDeleteThis is the perfect website for anyone who really wants to understand this topic.
ReplyDeleteThis is the perfect
ReplyDeleteThanks for some other wonderful article
ReplyDeleteYou're so smart
ReplyDeleteHi there, I want to subscribe for this website to get hottest updates, so
where can i do it please assist.
يسعدنا في شركة speedway أن نقدم أفضل دينا نقل عفش شمال الرياض أسعار الشركات المنافسة لنا كما نمتلك اكبرفريق من النجارين و فنيين والسائقين سارع في التواصل مع شركة عفش شمال الرياض لتحصل على خصمك الفوري على خدماتنا.
ReplyDeleteدينا نقل عفش شمال الرياض
شركة صيانة افران الغاز بتبوك هي شركة متخصصة في جميع خدمات التنظيف وصيانة وإصلاح أفران الغاز بفريقها المحترف حيث تكون مؤكدة على الجودة والسلامة باستخدام قطع غيار أصلية وأحدث التقنيات.
ReplyDeleteشركة صيانة افران الغاز بتبوك
ReplyDeleteGreat web site! It looks really expert! Maintain the helpful job!