Using EMET to Disable EMET[html]
UPDATE (July 7): This post has been updated in advance of a Black
Hat 2016 presentation.
Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) is a
project that adds security mitigations to user mode programs beyond
those built in to the operating system. It runs inside “protected”
programs as a Dynamic Link Library (DLL), and makes various changes in
order to make exploitation more difficult.
EMET bypasses have been seen in research and past attacks [2, 3, 4,
5, 6, 7, 8]. Generally, Microsoft responds by changing or adding
mitigations to defeat any existing bypasses. EMET was designed to
raise the cost of exploit development and not as a “fool proof exploit
mitigation solution” [1]. Consequently, it is no surprise that
attackers who have read/write capabilities within the process space of
a protected program can href="http://labs.bromium.com/2014/02/24/bypassing-emet-4-1/">bypass
EMET by systematically defeating each mitigation [2].
If an attacker can bypass EMET with significantly less work, then it
defeats EMET’s purpose of increasing the cost of exploit development.
We present such a technique in the section New Technique to Disable
EMET. Microsoft has issued a patch to address this issue in href="http://www.microsoft.com/emet">EMET 5.5.
After discussing this new technique, we describe previously
documented techniques used to either bypass or disable EMET. Please
refer to the appendix if you’d like to know more about what kind of
protections are implemented by EMET.
New Technique to Disable EMET
EMET injects emet.dll or emet64.dll (depending upon the
architecture) into every protected process, which installs Windows API
hooks (exported functions by DLLs such as kernel32.dll, ntdll.dll, and
kernelbase.dll). These hooks provide EMET the ability to analyze any
code calls in critical APIs and determine if they are legitimate. If
code is deemed to be legitimate, EMET hooking code jumps back into the
requested API. Otherwise it triggers an exception.
However, there exists a portion of code within EMET that is
responsible for unloading EMET. The code systematically disables
EMET’s protections and returns the program to its previously
unprotected state. One simply needs to locate and call this function
to completely disable EMET. In EMET.dll v5.2.0.1, this function is
located at offset 0x65813. Jumping to this function results in
subsequent calls, which remove EMET’s installed hooks.
This feature exists because emet.dll contains code for cleanly
exiting from a process. Conveniently, it is reachable from DllMain.
Prototype of DllMain :
BOOL WINAPI DllMain(
