mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
HackSys Team
150 lines
4.5 KiB
C
150 lines
4.5 KiB
C
/*++
|
|
|
|
## ## ######## ## ## ########
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
######### ###### ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ######## ### ########
|
|
|
|
HackSys Extreme Vulnerable Driver
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq[at]hacksys[dot]io
|
|
Website: https://hacksys.io/
|
|
|
|
Copyright (C) 2021-2023 HackSys Inc. All rights reserved.
|
|
Copyright (C) 2015-2020 Payatu Software Labs LLP. All rights reserved.
|
|
|
|
This program is free software: you can redistribute it and/or modify it under the terms of
|
|
the GNU General Public License as published by the Free Software Foundation, either version
|
|
3 of the License, or (at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
|
|
without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
See the GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License along with this program.
|
|
If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT,
|
|
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
|
|
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
See the file 'LICENSE' for complete copying permission.
|
|
|
|
Module Name:
|
|
WriteNULL.c
|
|
|
|
Abstract:
|
|
This module implements the functions to demonstrate
|
|
Write NULL vulnerability.
|
|
|
|
--*/
|
|
|
|
#include "WriteNULL.h"
|
|
|
|
#ifdef ALLOC_PRAGMA
|
|
#pragma alloc_text(PAGE, TriggerWriteNULL)
|
|
#pragma alloc_text(PAGE, WriteNULLIoctlHandler)
|
|
#endif // ALLOC_PRAGMA
|
|
|
|
|
|
/// <summary>
|
|
/// Trigger the Write NULL Vulnerability
|
|
/// </summary>
|
|
/// <param name="UserBuffer">The pointer to user mode buffer</param>
|
|
/// <returns>NTSTATUS</returns>
|
|
NTSTATUS
|
|
TriggerWriteNULL(
|
|
_In_ PVOID UserBuffer
|
|
)
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
|
|
PAGED_CODE();
|
|
|
|
__try
|
|
{
|
|
//
|
|
// Verify if the buffer resides in user mode
|
|
//
|
|
|
|
ProbeForRead(UserBuffer, sizeof(PVOID), (ULONG)__alignof(PVOID));
|
|
|
|
//
|
|
// Grab the user pointer to nullify to avoid race condition
|
|
//
|
|
|
|
PVOID UserPointerToNullify = *(PVOID *)UserBuffer;
|
|
|
|
DbgPrint("[+] UserBuffer: 0x%p\n", UserBuffer);
|
|
DbgPrint("[+] UserPointerToNullify: 0x%p\n", UserPointerToNullify);
|
|
|
|
#ifdef SECURE
|
|
|
|
//
|
|
// Secure Note: This is secure because the developer is properly validating if
|
|
// '*(UserBuffer)' resides in User mode by calling ProbeForWrite() routine before
|
|
// performing the write operation
|
|
//
|
|
|
|
ProbeForWrite(UserPointerToNullify, sizeof(PVOID), (ULONG)__alignof(PVOID));
|
|
|
|
*(PVOID *)UserPointerToNullify = NULL;
|
|
#else
|
|
DbgPrint("[+] Triggering Arbitrary NULL Write\n");
|
|
|
|
//
|
|
// Vulnerability Note: This is a vanilla Arbitrary NULL Write vulnerability
|
|
// because the developer is writing NULL to the memory pointed by '*(UserBuffer)'
|
|
// without properly validating if it resides in User mode
|
|
//
|
|
|
|
*(PVOID *)UserPointerToNullify = NULL;
|
|
#endif
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
Status = GetExceptionCode();
|
|
DbgPrint("[-] Exception Code: 0x%X\n", Status);
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
/// <summary>
|
|
/// Write NULL Ioctl Handler
|
|
/// </summary>
|
|
/// <param name="Irp">The pointer to IRP</param>
|
|
/// <param name="IrpSp">The pointer to IO_STACK_LOCATION structure</param>
|
|
/// <returns>NTSTATUS</returns>
|
|
NTSTATUS
|
|
WriteNULLIoctlHandler(
|
|
_In_ PIRP Irp,
|
|
_In_ PIO_STACK_LOCATION IrpSp
|
|
)
|
|
{
|
|
PVOID UserBuffer = NULL;
|
|
NTSTATUS Status = STATUS_UNSUCCESSFUL;
|
|
|
|
UNREFERENCED_PARAMETER(Irp);
|
|
PAGED_CODE();
|
|
|
|
UserBuffer = IrpSp->Parameters.DeviceIoControl.Type3InputBuffer;
|
|
|
|
if (UserBuffer)
|
|
{
|
|
Status = TriggerWriteNULL(UserBuffer);
|
|
}
|
|
|
|
return Status;
|
|
}
|