Microsoft Windows XP – Keyboard Layouts Pool Corruption (PoC) (MS12-034)

• Exploit Database
• 105 阅读

• 作者： Cr4sh
  日期： 2012-05-18
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18894/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127

  =========== Description ===========   Windows XP keyboard layouts pool corruption 0day PoC, post-MS12-034.   Vulnerability exists in the function win32k!ReadLayoutFile(), that parses keyboard layout files data. Possible attack vector -- local privileges escalation.   Similar vuln (CVE-2012-0183) was patched recently, but I wonder, that Microsoft missed to rewrite vulnerable code on Windows XP, and this PoC still able to crash fully-patched XP SP3.   However, pool corruption is not fully-controllable, and reliable code execution exploit development is quite a difficult task.   --------------------------------   By Oleksiuk Dmytro (aka Cr4sh)   http://twitter.com/d_olex http://blog.cr4.sh mailto:dmitry@esagelab.com   --------------------------------   Typical bugcheck:     ******************************************************************************* * * *Bugcheck Analysis* * * *******************************************************************************   PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced.This cannot be protected by try-except, it must be protected by a Probe.Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: e10650d3, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: bf881fb6, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000001, (reserved)   Debugging Details: ------------------     READ_ADDRESS:e10650d3 Paged pool   FAULTING_IP: win32k!ReadLayoutFile+183 bf881fb6 803800cmp byte ptr [eax],0   MM_INTERNAL_CODE:1   IMAGE_NAME:win32k.sys   DEBUG_FLR_IMAGE_TIMESTAMP:4f85831a   MODULE_NAME: win32k   FAULTING_MODULE: bf800000 win32k   DEFAULT_BUCKET_ID:DRIVER_FAULT   BUGCHECK_STR:0x50   PROCESS_NAME:win32k_Keyboard   TRAP_FRAME:b191c884 -- (.trap 0xffffffffb191c884) ErrCode = 00000000 eax=e10650d3 ebx=e105b008 ecx=e105b008 edx=00000000 esi=e106ac08 edi=e105c008 eip=bf881fb6 esp=b191c8f8 ebp=b191c90c iopl=0 nv up ei ng nz na po nc cs=0008ss=0010ds=0023es=0023fs=0030gs=0000 efl=00010282 win32k!ReadLayoutFile+0x183: bf881fb6 803800cmp byte ptr [eax],0 ds:0023:e10650d3=?? Resetting default scope   LAST_CONTROL_TRANSFER:from 804f7b8b to 80527c24   STACK_TEXT: b191c3c0 804f7b8b 00000003 e10650d3 00000000 nt!RtlpBreakWithStatusInstruction b191c40c 804f8778 00000003 00000000 c0708328 nt!KiBugCheckDebugBreak+0x19 b191c7ec 804f8ca3 00000050 e10650d3 00000000 nt!KeBugCheck2+0x574 b191c80c 8051cc4f 00000050 e10650d3 00000000 nt!KeBugCheckEx+0x1b b191c86c 805405f4 00000000 e10650d3 00000000 nt!MmAccessFault+0x8e7 b191c86c bf881fb6 00000000 e10650d3 00000000 nt!KiTrap0E+0xcc b191c90c bf881e25 e208f8e8 e10611c8 e105c008 win32k!ReadLayoutFile+0x183 b191c92c bf8b9574 800003a4 00000000 00000000 win32k!LoadKeyboardLayoutFile+0x6a b191c9b4 bf92a002 82273e08 800003a4 04090409 win32k!xxxLoadKeyboardLayoutEx+0x1b1 b191c9f0 bf8b91b5 82273e08 0000003c 04090409 win32k!xxxSafeLoadKeyboardLayoutEx+0xa9 b191cd40 8053d6f8 0000003c 00000000 0012fec8 win32k!NtUserLoadKeyboardLayoutEx+0x164 b191cd40 004011c4 0000003c 00000000 0012fec8 nt!KiFastCallEntry+0xf8 0012ff7c 004015de 00000001 00363c48 00362e80 win32k_KeyboardLayout_expl!NtUserLoadKeyboardLayoutEx+0x14 [x:\dev\_exploits\_local\win32k_keyboardlayout_expl\win32k_keyboardlayout_expl\win32k_keyboardlayout_expl.cpp @ 37] 0012ffc0 7c817077 00330036 00360038 7ffdd000 win32k_KeyboardLayout_expl!__tmainCRTStartup+0x10f [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 586] 0012fff0 00000000 00401726 00000000 78746341 kernel32!BaseProcessStart+0x23     STACK_COMMAND:kb   FOLLOWUP_IP: win32k!ReadLayoutFile+183 bf881fb6 803800cmp byte ptr [eax],0   SYMBOL_STACK_INDEX:6   SYMBOL_NAME:win32k!ReadLayoutFile+183   FOLLOWUP_NAME:MachineOwner   FAILURE_BUCKET_ID:0x50_win32k!ReadLayoutFile+183   BUCKET_ID:0x50_win32k!ReadLayoutFile+183   Followup: MachineOwner ---------   === POC ===   https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18894.zip