8 ms·
Escaping VirtualBox 6.1: Part 1
- m00dy 6y agoIs this new Phrack or what ? :)
- SftwreEngnr 6y agoFuck off with the emoticons noob
- vmcall 6y agoWe don't strive to be the new Phrack, we just needed our own platform where we would ensure high-quality submissions without any ads :)
- hhh 6y agoYou guys always have the best content (and design!)
- vmcall 6y agoThanks a lot, we put a lot of effort in to it so I am glad you like it
- daguava 6y agoI absolutely adore this website, please keep up the great work. When I first ran into it a few months ago I had to binge-read every article, it was too fascinating to stop.
- z3phyr 6y agoThis is making me interested in security again!!!
- ThisIsTheWay 6y agoI'm a complete noob when it comes to CTF, but escaping a VM to control the host is total witchcraft to me. Darknet Diaries just had a great podcast on the Pwn2Own CTF hosted by CanSecWest cyber-security conference, which includes a competition to escape a virtualized machine. Highly recommended, it's a great listen. https://darknetdiaries.com/episode/82/ https://darknetdiaries.com/episode/82/
- tyingq 6y agoThe details are witchcrafty to me, but the base idea that virtual devices passed to the guest can have unintended access to host memory (or files, etc) seems straightforward. Edit: Curious, are there common guest escapes that exploit something other than virtual devices?
- mav3rick 6y agoCore hypervisor code may have a bug that can be triggered via the kvm API.
- fulafel 6y agoThe guest-host API is just attack surface like any other (file formats, network protocols, kernel syscall api, browser sandbox etc) and typically the privileged side is implemented in memory-unsafe languages. As bugs in memory-unsafe PL code have high probability to be exploitable, giving control to the attacker, the game is set.
- hyper_reality 6y agoThis is impressive work. First it shows how the top CTFs can showcase the state of the art in terms of exploitation. It's hard for anyone to argue that the CTF scene does not reflect the "real world" when it is producing solid work like unpublished virtual machine escapes. And even better, the work is shared in high quality writeups. Secondly, this plus other vulnerabilities found in VirtualBox emphasises that off-the-shelf hypervisors cannot be considered to create a security boundary. Every serious nationstate possess weaponised exploits to break out of VirtualBox, VMware etc. KVM and Xen have a smaller attack surface and are known to have a better isolation model, but I'm sure there are still plenty of exploits given enough resources. Perhaps this is obvious to some, but some people really do think that VirtualBox VMs act like a sandbox, which is only true if your adversary is rather unsophisticated. For a writeup from the same CTF, but focussing on networking and cryptography instead involving an exploit in a Chinese anti-censorship proxy tunnel, please see https://blog.cryptohack.org/cracking-chinese-proxy-realworldctf https://blog.cryptohack.org/cracking-chinese-proxy-realworld...
- lima 6y ago> KVM and Xen have a smaller attack surface and are known to have a better isolation model, but I'm sure there are still plenty of exploits given enough resources. KVM - the low-level kernel-level hypervisor - has a tiny attack surface and has been audited exhaustively. It's unlikely to have critical bugs in it. When people talk about "KVM vulnerabilities", they're usually talking about vulnerabilities in QEMU, which implements the actual device emulation. QEMU has all of the attack surface, deals with low-level data shuffling, and is written in C. Even worse, most stock QEMU-KVM deployments simply run qemu as root with no extra sandboxing or MAC like SELinux/sVirt. It's very likely that a bunch of 0days exist for those environments. This is why many cloud providers use KVM-the-kernel-module, but an in-house replacement for QEMU. Fortunately, there's a growing ecosystem of QEMU replacements written in Rust: - https://github.com/cloud-hypervisor/cloud-hypervisor https://github.com/cloud-hypervisor/cloud-hypervisor - https://github.com/firecracker-microvm/firecracker https://github.com/firecracker-microvm/firecracker - https://chromium.googlesource.com/chromiumos/platform/crosvm/ https://chromium.googlesource.com/chromiumos/platform/crosvm... (the Chrome OS VM runtime which Firecracker was forked from) Google's gVisor - the sandbox that App Engine and Cloud Run uses - uses KVM as well: https://gvisor.dev/docs/ https://gvisor.dev/docs/ With an emulation layer written in a language like Rust, the trust boundary is much better. As for VirtualBox in particular - that one should not be considered a trust boundary. Nobody is seriously using it in production, and it's regularly featured in CTF competitions as a fun exploitation target.
- ExcavateGrandMa 6y agoOooooooffff :D
- nneonneo 6y agoHey, I played in that CTF! Although, I ended up spending most of my time pwning QEMU instead. There was an easier challenge, aptly named Easy Escape, in which the organizers added a vulnerable memory-mapped device to QEMU. The device had the ability to read and write certain memory, so the exploit ended up being an attack where you triggered a memory operation which accessed the device's own memory - essentially causing the device's MMIO handler to recurse. That in turn set up a use-after-free situation which could be exploited for the win. I love Real World CTF. In 2018 I participated in the finals round held in Zhengzhou, and there was a problem that involved Java and the RMI protocol. We ended up exploiting two zero-days in Java, reported them to Oracle and got a CVE: CVE-2019-2684. That was very exciting to me - to discover and exploit a bug in real software in less than 48 hours :) Kudos to the VirtualBox hackers for doing that on such a high-profile bit of software - amazing work!
- freedomben 6y agoAre these CTFs recorded and/or streamed? It just occurred to me that would be really fun to watch.
- saagarjha 6y agoCTFs are not usually streamed, as that would give a leg up to other teams watching it :P Not sure if anyone records their work for later viewing, though.
- marcelm72 6y agoYou might like LiveOverflow 's video about playing the Google CTF finals hackceler8: https://www.youtube.com/watch?v=DGuRI_SPZYg https://www.youtube.com/watch?v=DGuRI_SPZYg
- J-Kuhn 6y agoJust a question: Do the organizers know about the security vulnerability? Where do they get the vulnerabilities from?
- 6y ago
- Eugr 6y agoLooks like there a typo in the exploit() function? They have this variable declaration in the beginning: static const short port_base = 0x434; However they use "port" variable when making calls: __outbyte(port+3, 0);
- secondcoming 6y agoMaybe it's an in-joke, but this website is too dark to read
- vmcall 6y agoCan you tell me what device you are on?
- secondcoming 6y agoIpad4, it happens on both safari and chrome
- unnouinceput 6y agoDid you tried NoScript? It's very white for me, but in my case NoScript and uBlock Origins are my default for surfing web.
- cjbprime 6y agoIf it's a vuln in the latest available version, was it reported to the vendor before the blog post?
- 2Gkashmiri 6y agoDoes anyone know how to prevent a guest os to detect its running in a VM ? I tried online but got no satisfactory results. Anyone?
- metreo 6y agodropping in on this as an outsider but this looks like juat a(nother) windows vulnerability
- sunjester 6y ago"so the impact is very limited"
- musicale 6y agoMost of the VM escapes I've seen exploit virtual devices rather than the hypervisor itself. Presumably it might be a good idea to do a better job isolating the virtual devices. Might be nice to use a memory safe language/runtime also.