$hell on Earth: From Browser to System Compromise by Matt Molinyawe, Abdul-Aziz Hariri, and Jasiel Spelman.
From the paper:
The winning submissions to Pwn2Own 2016 provided unprecedented insight into the state-of-the-art techniques in software exploitation. Every successful submission provided remote code execution as the super user (SYSTEM/root) via the browser or a default browser plug-in. In most cases, these privileges were attained through the exploitation of the Microsoft Windows® or Apple OS X® kernel. Kernel exploitation, using the browser as an initial vector, was a rare sight in previous contests.
This white paper will detail the eight winning browser-to-super-user exploitation chains demonstrated at this year’s contest. Topics such as modern browser exploitation, the complexity of kernel use-after-free vulnerability exploitation, the simplicity of exploiting logic errors, and directory traversals in the kernel are also covered. This paper analyzes all attack vectors, root causes, exploitation techniques, and remediation for vulnerabilities.
Reducing attack surfaces with application sandboxing is a step in the right direction. However, the attack surface remains expansive and sandboxes only serve as minor obstacles on the way to complete compromise. Kernel exploitation is clearly a problem, which has not disappeared and is possibly on the rise. If you’re like us, you can’t get enough of it—it’s shell on earth.
Unless you are still reading Harry Potter and the cursed child, the $hell on Earth whitepaper will be your best read for the weekend.
Enjoy!