[Music]
so okay so i will start with a
with this presentation regarding uh our
fuzzing carried in easterseg
we have been doing some research in the
windows media foundation platform in the
last year
and this presentation should be about
why is fuzzing still really important to
think to do
and why it can
lead to identifying some critical risk
findings so
some information regarding me
i'm currently working as a penetration
tester and a head of offensive security
department in the company called
estrosec
i have experience with the web
application infrastructure and cloud
penetration testing also doing great
teaming uh
engagements with my colleagues
and also social engineering
simulation attacks and also attack
simulation
uh regarding the research in the
in our team we are performing the web
application security research focusing
on the
commonly used web applications
and also the fuzzing projects which are
focusing on the operating system
components pdf readers browsers and also
the v8 javascript engine
i'm also a holder of some security
reality certificates such as the gcpn
and others
so moving to the fuzzing
i think pretty much all of you know
something about fuzzing so
i will just skip it to the point that uh
why is it still relevant and
how
you can approach the fuzzing in uh
in this year or in the last year
so uh
uh my current flow of fuzzing just
really simplify is
is it in a way that you have to create a
corpus so
uh in this case for example we are
we will be performing the fuzzing of the
some kind of
player that will try to play media file
formats so he needs to download as many
cases as possible however they need to
be
different or partially different so you
can reach the
code coverage or the
or all of the functions of the of the
program
uh
secondly
you will take the file from the corpus
and try to modify it in some way
to perform mutation
and
this file you will pass to the target
program you have to fuss or you would
like you would like to fast
and this program should be attached to
some kind of debugger so you can really
monitor the
uh
the behavior of the program so you will
see which kind of dlls are being loaded
which kind of functions are being
executed
and you can see if the file is creating
some kind of new behavior
this is the just the simplified uh
flow of the fuzzing
however as you can see on the right
picture
uh is it important to say that that
fuzzing the application as is it could
be really simple but not so effective
than fuzzing the application with a
harness
and if there is a question for example
what is a harness
i could i can simply answer it in a way
that
let's say that the program itself will
load
many
many others stuff like dlls from the
operating systems and it will slow down
the execution of the file creating a
harness you can simply just map a
function
to your memory and execute only the
some part of the code you are really
interested in so it will save a lot of
time and you can perform much more
faster execution
of the
mutated files than just fuzzing the
application as is
moving to the next slide
we have chosen the windows media player
as a target program in the windows media
foundation platform however it's really
important to say that
this program
is uh
really really specific in in many ways
uh it's default media player in many
windows starting from the windows 3 to
up to windows
[Music]
up to the latest windows also windows 10
and
it has a lot of features for example you
can you can burn cds you can reap the
cds you can create a really enhanced uh
playlist and stuff like that and also
without being without using the windows
media player you are probably using some
part of it
in case you are using the explorer
in the in the windows to explore the
directories and files
so you probably
do not know about it but
there are still components of the
windows media player
being used in the windows itself
it can play a big range of file formats
and it's also being distributed as a 32
and 64 bit
pre-installed on the windows
what is really important to say
when focusing on fuzzing this type of
program
you want to focus probably on a
file format and find
some specific
probably undocumented file format so
going through the list on the right side
of the file types supported by the
windows media player you can see that
windows media player supports a large
list of different file formats
such as
the windows media formats and also the
probably the most used ones
mp4 and
others
however there is a list of undocumented
file formats that are not supported but
playable uh using the windows media
player
and
also
it deletes to the
discovery of the
uh not uh the sub the probably support
of the latest media files types that are
supported for example by their browsers
so
in the next slides we will be talking
about the
uh
file format which we have been uh
performing the fuzzing on
and why is it uh undocumented
however to understand why it's important
to choose a
latest or the undocumented file format
you
probably need to know about the file
type itself so
perform quick research on the file
structure and the complexity
or there is another thing
which is possible to do and is to carry
out the
errors engineering to
reverse the platform or in this case the
windows media player and to find out the
functions and dlls that are being loaded
when you are trying to play a file
because each file
is
being
being loaded under different codec
and there is a possible to see the list
of the all of the possible file file
types
maybe the last thing which is not
mentioned here but it can be done
is creating a corpus of the
media file types
downloading from the internet or some
github repositories
and you could try to play any kind of uh
media file format
and to see the behavior in the debugger
itself without needed to reverse
engineer it
so we have looked more
to the
webma file format
why why this type of file form because
this type of file format was introduced
to the windows
as a
specific kind of library only a few
months ago
and it was
previously
launched by google chrome or the google
company
and uh later than that uh it was the dll
from the
used by the chrome was also introduced
in the operating system windows
and the later then was used by the
windows media player
so
this file format is the missing in the
list of the separated file types
it is using different types of codecs
vp8 vp9
um
aoen vorvis and opus
it's really important to understand the
what is a valid uh or the functioning
weapon file
and
to see that uh i really recommend you
when you will be trying to let's say
fuss some stuff in the
some kind of media player you would like
to attach a debugger and see
the behavior of the
of the program itself
when trying to play this type of file
because this type of file is
mainly
uh recommended to use in uh streaming
platforms or for the web applications
because of the size of the of the file
and the optimalization being used there
uh it's based on the
matroshka type of
file
so basically
it is it is using a well-known file
structure
or the mediafile type
structure
the questions here are which functions
are being used or which dlls are being
loaded
since it is not supported by default
uh
if if it can
increase the code coverage
in the windows media player file
and
we we can move on to the uh to the slide
when we are going to play the file or
run the file in the
in the in the fuzzing process
so um
another slide and we would like to move
on to the fuzzing part or how you can
fast this type of target
so uh preferably i would suggest uh to
build a
virtual machine only for fuzzing with
focus on performance so
we are fuzzing currently the windows
media platform so it should be windows
and it should be strictly modified to
only run
uh
this this type of application nothing
else
so you can for example kill the explorer
and other processes itself
secondly you you would like to prepare a
corpus
which will be
based on this
file type
in this case the webinar file with
different codecs
different resolutions different sizes
length
colors and stuff like that
preferably
we are talking about uh 1000 of file
files with a length about ranging from
one kilobyte to one megabyte
uh the the smaller the file the faster
the execution
so i would that keep that in mind that a
file really
uh differs on the performance
the next thing is the file mutation
setting
there is
there's the thing with the
with the file structure itself you have
to understand the the headers of the
file
so
i would suggest to only modify
part of the
content of the file which can be
modified so we are talking about the
about the body of the file
there are different ways you can you can
mutate the file content
for example you can uh swept the
bytes
or you can
increment the values you can delete some
parts of the file and stuff like that so
there are many different approaches
which could be carried on in the file
mutation setting
uh the next step would be
you want to execute the target program
with this modified input file to see the
behavior
running
in the debugger
and if everything works
we will just try to automate it in a way
that it will
attach the program into the debugger it
will load the file and
you will just see if it crashed or not
or hanged or freezed
and you would like to save the
input file if
something
for example brogues
so that's the
that's the fuzzing uh process
in
this specific case
uh in the next slide uh we are going to
talk about the crash triage so
when you uh
uh approach uh
some kind of different behavior than
expect it
you would like to uh
in in some way for example in a manual
or automated way to uh create the uh
triage the uh
default discussing the the crash so in
this case
uh in the first hours uh when you are
running the fuzzer itself uh
it will probably not create so many
crashes but
if it will does create a lot of crisis
crashes it uh there is a possibility
that something is broken because
we are talking about uh assessing a new
part of the
of the code or the our added is probably
not well uh
researched however it still does make
sense that we are talking about the
uh uh um really
supported and tested uh program so
you would not seen so many crashes in
the in the first hours of the fuzzing
but
if there are some crushes i would prefer
to use the manual crash triage to to see
if everything works uh
if everything works
um
to do the manual crash triage i would
suggest you to use the window back
preview or window back the default
windows debugger which is really great
for this type of applications or also
you can use the back id
or the exploitable
with hand with a windy back
so
on the right you can see that
there are folders with name such as
exploitable probably exploitable
probably not exploitable and unknown
these types of
directories are being
loaded with the with the crashes
in this case the exploitable is being
used the exportable dialog
to
analyze the crashes and
divide it into this type of directories
and
here is one crash
uh
here is the actual crash of the
uh how how does it how does it look in
the windows debugger platform when
trying to
play some
modified file in this case is mp4
as you can see it will crash on some
functions
and
there is there is a name
uh getsampletime which means that um
specifically this file uh
has modified the
metadata in in a way that uh it can
crash the whole program and also it can
not only crash the windows media player
but also the explorer when trying to
open directory with this file
so without
trying to play this file you can easily
crash the whole operating system which
is really really bad
and this type of this type of
files or fuzzing
uh
uh can be can be seen just by uh
creating uh
this type of files
running under the windows media
foundation platform so
uh this is really uh important to to see
that when you create this type of file
and you try to analyze where it crashes
it's really important to see the to find
the core issue because many times this
file
could crash also the browser because the
browser will try to load
the dll from the operating system or the
explorer which is trying to
load
some kind of image from from the file or
description regarding the file such as a
file type or length of the video
it will get to the point where it can
crash
so regarding this specific crash
there is another thing uh which i would
like to point out and
after
the
after we have been carrying the
um fuzzing
i have seen this tweet regard regarding
the
webm file type or the
newest
a windows component
this dll
which is in
by default in windows in the latest
windows
it is currently being used for example
by the chrome itself
and so there is the thing that
[Music]
another security researcher pointed out
that
he has been successfully
fuzzing this uh component just by
trying to load uh
this type of uh media files in the
chrome and crashing uh
and crashing the chrome but uh the core
issue was in the windows dll
and
he pointed he pointed out some um
uh informations like like this one the
stack trace from the windows debugger
and as you can see that there is a
there's a line that it's pointing out
the mastering metadata so
it's very similar to the our case but
it's really important to
not
to not stop uh at this point
so
you would like to go further and
to
to focus on that which applications or
or which programs are using this type of
dll because it's not only about the
browsers it's all about the stock
default applications that are creating a
new attack surface for
attacker to
possibly
execute a malicious code or
perform a privilege escalation so
that's why i am focusing mostly on the
operating system and the functions from
the operating system
and this particular uh
back or vulnerability can
create
a whole new problems in the operating
system not just only in the application
so
moving to the results
of our housing fuzzing process
we have been running the
fuzzer for six months
24 7 on multiple vms
we have been we have identified more
than 10 000 of crashes
most of them were not exploitable
because
they were just
licking some part of data or
being category get categorized as a read
access violations or nulled the
reference but 23 of them were unique
two of them were critical remote code
execution vulnerabilities
and they made it to the page tuesday
with the following
cv identifiers
it's really important to say one thing
that uh
the most important vulnerability the
first one the critical one
uh was found uh
in the
in the in the first weeks of the of the
fuzzing process so uh it still does make
sense to really
not maybe
do the optimalization of the fuzzing
platform but it's really important to
start as soon as possible when you
discover a new
for example dll that is being loaded or
used by windows
um
moving to the to the bounty and stuff
with the
microsoft communication
so basically when you are reporting the
vulnerability to the microsoft uh
researcher center or platform
uh there are many things you need to
[Music]
submit for example you have to
be aware that you are submitting
proof of concept or
uh
really
uh researched data about the
crash itself so
in this case we we have been talking
about the windows insider preview
because we have been fuzzing on the
latest operating system versions
and
these two bugs were pointed out as a
remote code executions because
we could modify
some part of data
in the memory and we had the writable
access to the memory
and in a case you will write an
exploit and it will finally functionally
fully functional exploit on the latest
version of operating system by passing
the security protections
the bounty will double
lessons learned from
this type of uh fuzzing process or
what you can possibly learn from this
you have to be fast otherwise
uh the the fuzzing will be or or the
issues uh generated by the fuzzings uh
could be
uh duplicates
it's from our experience that is really
important to start as soon as possible
and the later
performance optimization of the of the
code or the fuzzing process that you
have to start is the most important
thing here because
it's all about the the first initial
idea to to see
there is new function there is new dll
so
let's start
uh secondly it still does make sense to
us it's maybe not the best way to
to assess the all of the possible risks
or identifying the all vulnerabilities
in the code of the application
but
it's much faster than performing static
code analysis
and
there are many ways where you can find
the bug possibly sooner
because many people are performing
fuzzing on
using
really
big infrastructure for example google
google or microsoft is doing uh is
performing a really uh
big uh
fuzzing on their uh cloud environment
they are using this power to
to
test or access the open source projects
one of the most important things here is
to be creative and to create your own
tools and environment because when you
will be using
tools provided in the tutorials and uh
maybe
just publicly available info on the
internet uh there is uh
less chance to
maybe find new new vulnerabilities in
the software because it's all
it's all about being
really
you have to know what you are doing
and be able to maybe adapt to the
latest trends in the in the applications
and application security
uh
in the in the
when you are starting with the fuzzing
yes it still does make sense to use
the typical programs such as ifl
or bufas and and uh c scalar however
later you would like to switch to your
own tools to perform
a research on uh
uh the way how you can speed it up
and what can be performed maybe better
and you would like to know
each component in detail
there is also always a place for
optimization
so
starting from the software part you
would like to perform program patching
and create a harness for the
for the program itself in this case when
talking
about the windows media
foundation or the player you would like
to focus on the
different part of the functionality for
example we have been only focusing on
the playing of the file
but there is a option to
to transfer the file to create a
enhanced uh
playlist and other other things
so
you would like just to copy the the
function
uh wrote write a small script to perform
this execution only in the memory and
save a lot of time
and from the hardware point of view
i would suggest to
focus on the fastest ram
possible and also the ssds
and last but not least be patient it
takes a lot of time
to find
really impactful and critical
vulnerabilities
you have to be prepared to perform the
homework on the
on the maybe
not so
uh
important stuff as as it could be seen
in this case
uh regarding for example the web file
but it's still important to
learn
educate about the possibilities of the
of the in this case of the file types
and
later execute the the fuzzing with with
the results
so
thank you for the watching
and if you have any questions please
write it down