125 lines
No EOL
3.6 KiB
Text
125 lines
No EOL
3.6 KiB
Text
1.Description:
|
|
|
|
The HookCentre.sys kernel driver distributed with G Data TotalCare 2011
|
|
contains a race condition vulnerability in the handling arguments of
|
|
NtOpenkey function.
|
|
Exploitation of this issue allows an attacker to crash system(make infamous
|
|
BSoD) or gain escalated priviligies.
|
|
An attacker would need local access to a vulnerable computer to exploit this
|
|
vulnerability.
|
|
|
|
|
|
Affected application: G Data TotalCare 2011, up to date version 21.1.0.5.
|
|
Affected file: HookCentre.sys version 10.0.8.11.
|
|
|
|
2.Crash dump info:
|
|
kd> !analyze -v
|
|
*******************************************************************************
|
|
*
|
|
*
|
|
* Bugcheck
|
|
Analysis *
|
|
*
|
|
*
|
|
*******************************************************************************
|
|
|
|
PAGE_FAULT_IN_NONPAGED_AREA (50)
|
|
Invalid system memory was referenced. This cannot be protected by
|
|
try-except,
|
|
it must be protected by a Probe. Typically the address is just plain bad or
|
|
it
|
|
is pointing at freed memory.
|
|
Arguments:
|
|
Arg1: 90909090, memory referenced.
|
|
Arg2: 00000000, value 0 = read operation, 1 = write operation.
|
|
Arg3: 80536913, If non-zero, the instruction address which referenced the
|
|
bad memory
|
|
address.
|
|
Arg4: 00000000, (reserved)
|
|
|
|
Debugging Details:
|
|
------------------
|
|
|
|
|
|
READ_ADDRESS: 90909090
|
|
|
|
FAULTING_IP:
|
|
nt!memcpy+33
|
|
80536913 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
|
|
|
|
MM_INTERNAL_CODE: 0
|
|
|
|
DEFAULT_BUCKET_ID: DRIVER_FAULT
|
|
|
|
BUGCHECK_STR: 0x50
|
|
|
|
PROCESS_NAME: hookfuzz.exe
|
|
|
|
TRAP_FRAME: f06f7c24 -- (.trap 0xfffffffff06f7c24)
|
|
ErrCode = 00000000
|
|
eax=909090ea ebx=0012ff08 ecx=00000016 edx=00000002 esi=90909090
|
|
edi=81ae5d2c
|
|
eip=80536913 esp=f06f7c98 ebp=f06f7ca0 iopl=0 nv up ei pl nz ac po
|
|
nc
|
|
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
|
|
efl=00010212
|
|
nt!memcpy+0x33:
|
|
80536913 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
|
|
Resetting default scope
|
|
|
|
LAST_CONTROL_TRANSFER: from 804f7b9d to 80527bdc
|
|
|
|
STACK_TEXT:
|
|
f06f7760 804f7b9d 00000003 90909090 00000000
|
|
nt!RtlpBreakWithStatusInstruction
|
|
f06f77ac 804f878a 00000003 00000000 c0484848 nt!KiBugCheckDebugBreak+0x19
|
|
f06f7b8c 804f8cb5 00000050 90909090 00000000 nt!KeBugCheck2+0x574
|
|
f06f7bac 8051cc4f 00000050 90909090 00000000 nt!KeBugCheckEx+0x1b
|
|
f06f7c0c 8054051c 00000000 90909090 00000000 nt!MmAccessFault+0x8e7
|
|
f06f7c0c 80536913 00000000 90909090 00000000 nt!KiTrap0E+0xcc
|
|
f06f7ca0 f9cbc7d5 81ae5d2c 90909090 0000005a nt!memcpy+0x33
|
|
WARNING: Stack unwind information not available. Following frames may be
|
|
wrong.
|
|
f06f7cc0 f9cbd818 0012ff08 0012ff08 00000000 HookCentre+0x7d5
|
|
f06f7cd8 f9cbddd2 00000001 00000188 000006cc HookCentre+0x1818
|
|
f06f7d28 f9cbe50b 00000188 000006cc 000007d8 HookCentre+0x1dd2
|
|
f06f7d50 8053d638 0012ff04 00020000 00000000 HookCentre+0x250b
|
|
f06f7d50 7c90e4f4 0012ff04 00020000 00000000 nt!KiFastCallEntry+0xf8
|
|
0012fec4 7c90d5bc 004010d0 0012ff04 00020000 ntdll!KiFastSystemCallRet
|
|
0012fec8 004010d0 0012ff04 00020000 0012feec ntdll!ZwOpenKey+0xc
|
|
0012ff70 00401622 00000001 00342e68 00342e98 hookfuzz!wmain+0xd0
|
|
0012ffc0 7c817067 fdd46ae8 01cb4211 7ffdd000
|
|
hookfuzz!__tmainCRTStartup+0x15e
|
|
0012fff0 00000000 00401679 00000000 78746341 kernel32!BaseProcessStart+0x23
|
|
|
|
|
|
STACK_COMMAND: kb
|
|
|
|
FOLLOWUP_IP:
|
|
HookCentre+7d5
|
|
f9cbc7d5 83c40c add esp,0Ch
|
|
|
|
SYMBOL_STACK_INDEX: 7
|
|
|
|
SYMBOL_NAME: HookCentre+7d5
|
|
|
|
FOLLOWUP_NAME: MachineOwner
|
|
|
|
MODULE_NAME: HookCentre
|
|
|
|
IMAGE_NAME: HookCentre.sys
|
|
|
|
DEBUG_FLR_IMAGE_TIMESTAMP: 4c75a6b8
|
|
|
|
FAILURE_BUCKET_ID: 0x50_HookCentre+7d5
|
|
|
|
BUCKET_ID: 0x50_HookCentre+7d5
|
|
|
|
Followup: MachineOwner
|
|
---------
|
|
|
|
|
|
|
|
3.PoC is in NtOpenKey_poc.zip file.
|
|
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15444.zip (NtOpenKey_poc.zip) |