mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
Ashfaq Ansari
170 lines
8.0 KiB
C
170 lines
8.0 KiB
C
/*++
|
|
|
|
## ## ######## ## ## ########
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
######### ###### ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ######## ### ########
|
|
|
|
HackSys Extreme Vulnerable Driver Exploit
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq[at]payatu[dot]com
|
|
Website: http://www.payatu.com/
|
|
|
|
Copyright (C) 2011-2015 Payatu Technologies. All rights reserved.
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS
|
|
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
|
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
See the file 'LICENSE' for complete copying permission.
|
|
|
|
Module Name:
|
|
Common.h
|
|
|
|
Abstract:
|
|
This module implements the data structures which is
|
|
common to all the exploit modules.
|
|
|
|
--*/
|
|
|
|
#ifndef __COMMON_H__
|
|
#define __COMMON_H__
|
|
|
|
#pragma once
|
|
|
|
#include <time.h>
|
|
#include <stdio.h>
|
|
#include <Windows.h>
|
|
#include <winioctl.h>
|
|
#include <TlHelp32.h>
|
|
|
|
#include "Payloads.h"
|
|
#include "PoolOverflow.h"
|
|
#include "UseAfterFree.h"
|
|
#include "StackOverflow.h"
|
|
#include "TypeConfusion.h"
|
|
#include "StackOverflowGS.h"
|
|
#include "IntegerOverflow.h"
|
|
#include "ArbitraryOverwrite.h"
|
|
#include "NullPointerDereference.h"
|
|
|
|
#define BUFFER_SIZE 512
|
|
#define IO_COMPLETION_OBJECT 1
|
|
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
|
|
#define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L)
|
|
#define DEVICE_NAME "\\\\.\\HackSysExtremeVulnerableDriver"
|
|
|
|
#define DEBUG_INFO(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_BLUE, fmt, ##__VA_ARGS__); } while (0)
|
|
#define DEBUG_ERROR(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_RED, fmt, ##__VA_ARGS__); } while (0)
|
|
#define DEBUG_SUCCESS(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_GREEN, fmt, ##__VA_ARGS__); } while (0)
|
|
#define DEBUG_MESSAGE(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_RED | FOREGROUND_BLUE | FOREGROUND_GREEN, fmt, ##__VA_ARGS__); } while (0)
|
|
|
|
#define HACKSYS_EVD_IOCTL_STACK_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_POOL_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_CREATE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_USE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_FREE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_TYPE_CONFUSION CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x810, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
|
|
typedef time_t TIME;
|
|
|
|
typedef struct _LSA_UNICODE_STRING {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;
|
|
|
|
typedef struct _OBJECT_ATTRIBUTES {
|
|
ULONG Length;
|
|
HANDLE RootDirectory;
|
|
PUNICODE_STRING ObjectName;
|
|
ULONG Attributes;
|
|
PVOID SecurityDescriptor;
|
|
PVOID SecurityQualityOfService;
|
|
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
|
|
|
|
typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
|
|
PVOID Unknown1;
|
|
PVOID Unknown2;
|
|
PVOID Base;
|
|
ULONG Size;
|
|
ULONG Flags;
|
|
USHORT Index;
|
|
USHORT NameLength;
|
|
USHORT LoadCount;
|
|
USHORT PathLength;
|
|
CHAR ImageName[256];
|
|
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
|
|
|
|
typedef struct _SYSTEM_MODULE_INFORMATION {
|
|
ULONG Count;
|
|
SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
|
|
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
|
|
|
|
typedef enum _SYSTEM_INFORMATION_CLASS {
|
|
SystemModuleInformation = 11,
|
|
SystemHandleInformation = 16
|
|
} SYSTEM_INFORMATION_CLASS;
|
|
|
|
typedef NTSTATUS (WINAPI *NtQuerySystemInformation_t)(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
|
OUT PVOID SystemInformation,
|
|
IN ULONG SystemInformationLength,
|
|
OUT PULONG ReturnLength);
|
|
|
|
typedef NTSTATUS (WINAPI *NtQueryIntervalProfile_t)(IN ULONG ProfileSource,
|
|
OUT PULONG Interval);
|
|
|
|
typedef NTSTATUS(WINAPI *NtAllocateVirtualMemory_t)(IN HANDLE ProcessHandle,
|
|
IN OUT PVOID *BaseAddress,
|
|
IN ULONG ZeroBits,
|
|
IN OUT PULONG AllocationSize,
|
|
IN ULONG AllocationType,
|
|
IN ULONG Protect);
|
|
|
|
typedef NTSTATUS(WINAPI *NtAllocateReserveObject_t)(OUT PHANDLE hObject,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
IN DWORD ObjectType);
|
|
|
|
NtQueryIntervalProfile_t NtQueryIntervalProfile;
|
|
NtAllocateVirtualMemory_t NtAllocateVirtualMemory;
|
|
NtAllocateReserveObject_t NtAllocateReserveObject;
|
|
NtQuerySystemInformation_t NtQuerySystemInformation;
|
|
|
|
BOOL MapNullPage();
|
|
VOID ClearScreen();
|
|
VOID CenterConsoleScreen();
|
|
PVOID GetHalDispatchTable();
|
|
DWORD GetProcessID(LPCSTR processName);
|
|
HANDLE GetDeviceHandle(LPCSTR lpFileName);
|
|
VOID ColoredConsoleOuput(WORD wColor, CONST PTCHAR fmt, ...);
|
|
|
|
#endif //__COMMON_H__
|