#HITB2018AMS
The Common Language Runtime (CLR), the virtual machine component of Microsoft’s .NET Framework, manages the execution of .NET programs, which runs the code and provides services that make the development process easier. Microsoft also integrated CLR for its products, E.g SQL Server, Office etc. We have studied CLR since last month. And we found these features could lead to several attack surface.
In this talk, we first introduce managed execution environment and managed code under .NET Framework and discuss the security weaknesses of this code execution method . After that, we show a exploit for SQL Server through CLR and our automated tools for this exploitation. We will introduce a backdoor with administrator privilege based on CLR hijacking arbitrary .NET Applications.
In addition, we extend our CLR security study to Microsoft Office used VSTO. The result shows that we could convert a document‐level customizations into a program‐level customizations and execute arbitrary code quietly.
===
Yu Hong (redrain) is a Senior Security Researcher from 360CERT of Qihoo Company. With more than 7 years of experience in security research and web application penetration testing,he has discovered and reported several vulnerabilities and received acknowledgement for his contributions from various
companies including Apple, Atlassian, Baidu, Tencent, Alibaba and more. Yu has gave presentations on HITB, HITCON, RUXCON, xKungfoo etc. And he is also the member of Hall of Fame in Atlassian.
---
Shikang Xing(merjerson) is a Security Researcher from 360CERT of Qihoo Company. With more than 3 years of security research.He focus on software security and malware analysis. He also found lots of vulnerabilities for several companies.