Abstract

With the release of windows 7, Microsoft has done a lot of impressive research to enhance windows 7 operating system's security mechanisms in the goal to protect against the well known exploitation vectors on the windows platform. Windows 7 inherited the traditional memory protection mechanisms, such as GS, SafeSEH, DEP and ASLR (IE8 default opens DEP and ASLR in windows 7). This improvement was a big challenge for exploit developers, at least for sometime. In this presentation I want to reveal several ways how to bypass windows memory protection mechanisms, such as bypass DEP and ASLR in windows 7 through IE8 by some disclose vulnerabilities and I will use 4 case studies to demonstrate how to successfully bypass several protection mechanisms in windows.

This topic will also demonstrate the exploitation technique for the Mozilla Firefox on the Windows 7 x86/x64 system with recent Adobe Flash 0day. And discuss about Microsoft EMET and further exploitation research direction.