Integrating DMA attacks in exploitation frameworks

In this research paper we present a first step towards integrating direct memory attacks (DMA) into exploitation frameworks. We conducted a literature study on existing hardware interfaces and show that some (FireWire, eSATA, Pc Card, Thunderbolt, USB OTG and PCI) are susceptible to DMA attacks. We present a proof of concept which integrates FireWire attacks into Metasploit. The proof of concept demonstrates that we are able to inject basic payloads, like reverse TCP shell, via the FireWire interface. We enhanced the basic exploit with fork capabilities to prevent the system from ”hanging”. This allows an attacker to compromise a computer with a FireWire interface and retain control of the system via the network. We also discuss further improvements related to multi-stager payloads. Furthermore, we present a second proof of concept that shows the possibility of running interactive sessions over the DMA-channel itself.