Главная
Study mode:
on
1
Intro
2
Security in Elevation Policy
3
Default Applications
4
COM Elevation Policy
5
NET Deployment Service (DFSVC)
6
MSCORLIB Type Library
7
Exploiting The Vulnerability
8
IEUserBroker Interface
9
Shell Document View Broker
10
IE Recovery Store
11
Built-in Implementations
12
Attacking Out Of Process Storage
13
Supported Interfaces
14
Complex Interface
15
Installing an ActiveX Control
16
Prompt Bypass
17
Calling Sequence
18
Executing Our Own Code
Description:
Explore advanced techniques for discovering and exploiting Internet Explorer 11 sandbox escapes in this 40-minute Black Hat conference talk. Delve into the methodology used to uncover four sandbox vulnerabilities during Microsoft's bug bounty program for IE11 on Windows 8.1. Learn how to investigate the IE11 sandbox, execute custom code, and analyze potential attack surfaces. Gain insights into the Enhanced Protected Mode (EPM) sandbox and its implementation of Windows 8's App Container mechanism. Examine security flaws present since Vista and IE7, and receive sample source code to test these issues firsthand. Understand the intricacies of elevation policies, COM interfaces, NET Deployment Services, and various broker mechanisms within the IE11 ecosystem. Discover techniques for bypassing prompts, executing arbitrary code, and exploiting out-of-process storage vulnerabilities. Requires Windows 8.1 RTM, Visual Studio 2013, and IDA Pro for hands-on participation.

Digging for IE11 Sandbox Escapes Part 2

Black Hat
Add to list