mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
HackSys Team
150 lines
4.8 KiB
C
150 lines
4.8 KiB
C
/*++
|
|
|
|
## ## ######## ## ## ########
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
######### ###### ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ######## ### ########
|
|
|
|
HackSys Extreme Vulnerable Driver
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq[at]hacksys[dot]io
|
|
Website: https://hacksys.io/
|
|
|
|
Copyright (C) 2021-2023 HackSys Inc. All rights reserved.
|
|
Copyright (C) 2015-2020 Payatu Software Labs LLP. All rights reserved.
|
|
|
|
This program is free software: you can redistribute it and/or modify it under the terms of
|
|
the GNU General Public License as published by the Free Software Foundation, either version
|
|
3 of the License, or (at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
|
|
without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
See the GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License along with this program.
|
|
If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT,
|
|
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
|
|
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
See the file 'LICENSE' for complete copying permission.
|
|
|
|
Module Name:
|
|
BufferOverflowStackGS.c
|
|
|
|
Abstract:
|
|
This module implements the functions to demonstrate
|
|
the use of Stack Guard/Stack Canary to protect from
|
|
stack based buffer overflow vulnerability.
|
|
|
|
--*/
|
|
|
|
#include "BufferOverflowStackGS.h"
|
|
|
|
#ifdef ALLOC_PRAGMA
|
|
#pragma alloc_text(PAGE, TriggerBufferOverflowStackGS)
|
|
#pragma alloc_text(PAGE, BufferOverflowStackGSIoctlHandler)
|
|
#endif // ALLOC_PRAGMA
|
|
|
|
|
|
/// <summary>
|
|
/// Trigger the buffer overflow in Stack protected by GS Cookie
|
|
/// </summary>
|
|
/// <param name="UserBuffer">The pointer to user mode buffer</param>
|
|
/// <param name="Size">Size of the user mode buffer</param>
|
|
/// <returns>NTSTATUS</returns>
|
|
NTSTATUS
|
|
TriggerBufferOverflowStackGS(
|
|
_In_ PVOID UserBuffer,
|
|
_In_ SIZE_T Size
|
|
)
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
UCHAR KernelBuffer[BUFFER_SIZE] = { 0 };
|
|
|
|
PAGED_CODE();
|
|
|
|
__try
|
|
{
|
|
//
|
|
// Verify if the buffer resides in user mode
|
|
//
|
|
|
|
ProbeForRead(UserBuffer, sizeof(KernelBuffer), (ULONG)__alignof(UCHAR));
|
|
|
|
DbgPrint("[+] UserBuffer: 0x%p\n", UserBuffer);
|
|
DbgPrint("[+] UserBuffer Size: 0x%zX\n", Size);
|
|
DbgPrint("[+] KernelBuffer: 0x%p\n", &KernelBuffer);
|
|
DbgPrint("[+] KernelBuffer Size: 0x%zX\n", sizeof(KernelBuffer));
|
|
|
|
#ifdef SECURE
|
|
//
|
|
// Secure Note: This is secure because the developer is passing a size
|
|
// equal to size of KernelBuffer to RtlCopyMemory()/memcpy(). Hence,
|
|
// there will be no overflow
|
|
//
|
|
|
|
RtlCopyMemory((PVOID)KernelBuffer, UserBuffer, sizeof(KernelBuffer));
|
|
#else
|
|
DbgPrint("[+] Triggering Buffer Overflow in Stack (GS)\n");
|
|
|
|
//
|
|
// Vulnerability Note: This is a vanilla Stack based Overflow vulnerability
|
|
// because the developer is passing the user supplied size directly to
|
|
// RtlCopyMemory()/memcpy() without validating if the size is greater or
|
|
// equal to the size of KernelBuffer
|
|
//
|
|
|
|
RtlCopyMemory((PVOID)KernelBuffer, UserBuffer, Size);
|
|
#endif
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
Status = GetExceptionCode();
|
|
DbgPrint("[-] Exception Code: 0x%X\n", Status);
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
/// <summary>
|
|
/// Buffer Overflow Stack GS Ioctl Handler
|
|
/// </summary>
|
|
/// <param name="Irp">The pointer to IRP</param>
|
|
/// <param name="IrpSp">The pointer to IO_STACK_LOCATION structure</param>
|
|
/// <returns>NTSTATUS</returns>
|
|
NTSTATUS
|
|
BufferOverflowStackGSIoctlHandler(
|
|
_In_ PIRP Irp,
|
|
_In_ PIO_STACK_LOCATION IrpSp
|
|
)
|
|
{
|
|
SIZE_T Size = 0;
|
|
PVOID UserBuffer = NULL;
|
|
NTSTATUS Status = STATUS_UNSUCCESSFUL;
|
|
|
|
UNREFERENCED_PARAMETER(Irp);
|
|
PAGED_CODE();
|
|
|
|
UserBuffer = IrpSp->Parameters.DeviceIoControl.Type3InputBuffer;
|
|
Size = IrpSp->Parameters.DeviceIoControl.InputBufferLength;
|
|
|
|
if (UserBuffer)
|
|
{
|
|
Status = TriggerBufferOverflowStackGS(UserBuffer, Size);
|
|
}
|
|
|
|
return Status;
|
|
}
|