Rooting The CLR - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textricborelsi.com

2009-05-27T18:28:10Z

Reverting to last version not containing links to www.textricborelsi.com

Deleted user at 14:57, 22 May 2009

2009-05-22T14:57:47Z

KirstenS: /* Rooting the CLR presentation - London DotNet User Group 22nd March */

2009-04-18T15:44:42Z

‎Rooting the CLR presentation - London DotNet User Group 22nd March

Dinis.cruz at 07:15, 29 June 2006

2006-06-29T07:15:13Z

New page

[draft page, there is still tons of information to add here]

== Rooting the CLR presentation - London DotNet User Group 22nd March ==

'''Mp3 of presentation''':
* [http://69.10.155.160/mp3/Owasp%20-%20Rooting%20the%20CLR.mp3 Rooting the CLR presentation] as delivered to the London Dot Net User Group on the 22nd March

'''Description''':

In this presentation Dinis Cruz will show how the .Net Framework can be modified in real-time using Rootkit-like techniques. This is possible due to the fundamental security design flaw within the .Net framework where the entire Framework (i.e. all dlls) are loaded into the .Net process. This creates a scenario where there is nothing stopping a malicious Full Trust .Net assembly or unmanaged code executed in that process to 'patch' the CLR itself.
Demos include:

* CLR patch that allows calls to private methods to succeed
* CLR patch that allows corrupted Strong Named assemblies to be executed (i.e. ILDASM a signed .Net assembly, change it, ILASM it back into .exe format, and execute it without any exception been thrown)
* Load core .Net framework dlls that come from directories under my control (for example c:\fusion.dll)
* MSIL Patch on all Deny and Demand methods so that they always return without any exception being thrown, which disables most CAS protections in the running assembly (the only caveat with this demo is that the 'MSIL patch' must be applied before those methods are JITED)
* Extra demo: Unpathed ILDASM / ILASM buffer overflow

[[Category:OWASP .NET Project]]

← Older revision		Revision as of 18:28, 27 May 2009
Line 1:		Line 1:
−	~~http://www.textricborelsi.com~~
	[draft page, there is still tons of information to add here]		[draft page, there is still tons of information to add here]

← Older revision		Revision as of 14:57, 22 May 2009
Line 1:		Line 1:
		+	http://www.textricborelsi.com
	[draft page, there is still tons of information to add here]		[draft page, there is still tons of information to add here]

← Older revision		Revision as of 15:44, 18 April 2009
Line 4:		Line 4:

	'''Mp3 of presentation''':		'''Mp3 of presentation''':
−	* [http://69.10.155.160/mp3/Owasp%20-%20Rooting%20the%20CLR.mp3 Rooting the CLR presentation] as delivered to the London Dot Net User Group on the 22nd March	+	* [http://69.10.155.160/mp3/Owasp%20-%20Rooting%20the%20CLR.mp3 Rooting the CLR presentation] as delivered to the London Dot Net User Group on the 22nd March [[Category:FIXME\|link not working]]